Information Security Schedule
TermDefinition

Affiliate:

means an entity that, either directly or indirectly, controls, is controlled by, or is under common
control with, the relevant entity, where “control” means the ability to direct the affairs of anotherby ownership, contract or otherwise.

Agreement:

means the agreement between the Client and the Supplier which incorporates this information
security schedule.

Asset:

means: (i) any item or element of hardware, software or equipment that is or may be used forthe purpose of creating, accessing, processing, protecting, monitoring, storing, retrieving,
displaying or transmitting data of any type); and (ii) any documentation (in whatever medium)that relates to the use or operation of such items and elements; and (iii) any data stored ortransferred on the assets listed at (i).

Client:means the person purchasing the Services under the Agreement.

Client Data:

means data that either:(a) the Client, or a person acting on its behalf, provides to the Supplier, or permits the Supplierto access, in connection with the Agreement; or(b) the Supplier creates or collects in connection with the Agreement; or(c) is derived from the data listed in (a) and (b).

Client Group:means the Client and all its Affiliates (and “member of the Client Group” shall be construed
accordingly).

Client System:means a System or Asset which is owned by or reserved (in whole or in part) for operation by
or on behalf of any member of the Client Group.

Data Subject:means an identified or identifiable natural or legal person; an “identifiable” person is one who
can be identified, directly or indirectly, in particular by reference to an identification number orto one or more factors specific to his physical, physiological, mental, economic, cultural or social
identity.
means certification documentation that is no more than 12 months old, covers the scope of theServices, and provided by a reputable independent assessor. Such documentation could include:

Evidence:

Good Security
Practice:

•
•
•
•
•
•

SOC 2 Type II reports;
ISO27000 Certification reports;
PCI-DSS AOC certification reports;
Vulnerability Assessment and Penetration Testing (VAPT) reports; andRegulatory Compliance reports (e.g. FDA certifications).
Assessments conducted by an independent provider as designated by Clientmeans measures and practices consistent with:(a) the technical and organizational measures and practices that are required by, or
recommended in, internationally accepted management standards and codes of practicerelating to Information Security (such as ISO/IEC 27001 (Information Security Management
Systems – Requirements) and ISO/IEC 27002 (Code of Practice for Information Security
Management)); and(b) accepted management standards and codes of practice relating to technical security (such as
NIST SP 800-161); and(c) security standards and guidelines (including generally accepted principles regarding thesegregation of the duties of governance, implementation, administration and control) andtechniques such as strong authentication, access control and auditing, “least privilege”
assignment, all as reasonably made available to the general public or information security
practitioners and stakeholders by generally recognized authorities and organizations
regarding Information Security,
as the same are expanded, varied and replaced from time to time.

means, in respect of a process, policy, procedure, a plan, a measure or a control (for the purposes“implement” of this definition, each a “process”), to plan that process; document the process; issue the(and variants of it,process; require staff to follow the process; train staff on the process; embed the process in
suchas“Implementation”): operations; enforce it; regularly review, and measure, the extent to which the process is followed
and effective; and update it as appropriate.
to

1 of 10 - Information Security Schedule (TPISS) v1.8

PMI InternalInformation
Security:means:(a) the protection and assurance of:(i) the confidentiality, integrity, reliability and availability of information and Systems; and(ii) related properties of information such as authenticity, accountability, and nonrepudiation; and(b) compliance with all regulations applicable to the Processing of information.

Personal Data:

means any information relating to a Data Subject.

referencesto“personnel”:

in addition to the relevant party’s staff (permanent or otherwise), such references include also
references to that party’s Service Providers.

to “Process”(and variants of
it,
such
as
“Processing”):

means to perform any operation or set of operations upon data, whether or not by automaticmeans, such as collecting, recording, organizing, storing, adapting or altering, retrieving,
consulting, using, disclosing (by transmission, dissemination or otherwise making available),aligning or combining, blocking, erasing or destroying.

“Security
Event”

means any occurrence related to Supplier Systems indicating a potential (i) breach of information
security (including a compromise to the confidentiality, integrity, or availability of Client Data);or(ii) compromise of business operations; or (iii) may require a review of security arrangements.

“Security
Incident”

means one or more Security Events that has or might compromise the confidentiality, integrity
or availability of Client Data (including a Security Event that compromises business operationsor threatens information security (including confidentiality, integrity, and availability of ClientData)).

Services:means the services being provided by the Supplier under the Agreement.

Service
Providermeans a subcontractor or subprocessor of the Supplier.

Supplier:

means the person providing the Services to the Client under the Agreement.

Supplier
Personnelmeans individuals who are employees, agents and officers of either:(a) the Supplier; or(b) the Supplier’s Service Providers.

Supplier
System:means a System or Asset which is owned or reserved (in whole or in part) for operation by or on
behalf of the Supplier or any of its Affiliates.

System:means an information technology or communication system, network, service or solution(including all Assets that either (a) form part of it, or (b) are used to provide it).

System Data:

means the data used to operate a System, including metadata and system code.

(a) The Supplier shall provide the Services and perform its obligations under the Agreement in accordance with:(i) this information security schedule; and(ii) Good Security Practice.
(b) Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposesof the Processing as well as the risk of varying likelihood and severity for the rights and freedoms of individuals
to whom the data may relate, the Supplier shall implement the technical and organizational measures describedin the table below (the “Security Measures”) to protect the Services and the Client Data in such a way as toensure a level of security appropriate to the risk.
(c) In assessing the appropriate level of security mentioned above:(i) where the Security Measures address a topic without indicating specific measures, the Supplier shall address
the topic, taking account in particular of the risks that are presented by the Processing, in particular from
accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to data transmitted,
stored or otherwise processed (“Data Risks”); and(ii) where the Security Measures indicate specific measures (for example, MFA requirements or password
requirements), the Supplier may implement more stringent standards to ensures that the Data Risks areappropriately addressed, but may not implement a lesser standard.

2 of 10 - Information Security Schedule (TPISS) v1.8

PMI Internal

Topic

Details of the Security Measures

Compliancewith internal
policies:

1. The Supplier shall issue and comply with written policies and procedures that address eachof the control areas for securing Client Data set out in this document. The Supplier shallsupport this with:(a) a documented approach;(b) a risk managed approach;(c) a mechanism for measuring compliance against the rules;(d) a plan for training and promoting awareness, including:(i) roles and responsibilities for protecting Client Data;(ii) legal and contractual obligations; and(iii) mitigating the risk of non-compliance.
2. The Supplier shall document how it:(a) organizes the security of Client Data;(b) assigns responsibilities; and(c) addresses security in mobile devices and remote working.
3. The Supplier shall implement internal policies and procedures that ensure:(a) that the confidentiality, integrity and availability of Client Data are maintained; and(b) compliance with legal and regulatory requirements to which the Client and the Client
Data may be subject.
4. The Supplier shall review its policies and procedures at least annually, and in response to
any significant change in circumstances.
5. The Supplier, with respect to these policies and procedures, shall:(a) train its employees and relevant third parties (such as contractors);(b) monitor compliance with its own policies and procedures;(c) to the extent the Supplier has access to any Client System:(i) ensure that Supplier Personnel who are engaged from time to time in the provisionof the Services are trained on Client policies and procedures; and(ii) monitor compliance with the Supplier’s obligations arising under this Agreement,
except to the extent that only the Client can perform such monitoring;(d) implement processes to identify, assess, respond to, and monitor risks towards Client
Data and the Services; and(e) inform, promptly as they are confirmed, the Client of such risks and measures to
respond to them that are being taken or necessary.
6. Where Client Data is stored or processed on endpoints, including mobile devices (forexample, smartphones, tablets), the Supplier shall employ software that allows IT
administrators to control, secure and enforce policies on those endpoints.

Internal
security
management
procedures:

1. The Supplier shall implement measures to secure Client Data by:(a) controlling Processing rights and access rights to Client Data(b) controlling use of systems that either protect Client Data, or that hold Client Data (bothat rest and in transit) (or both);(c) monitoring access to the systems described in paragraph (b) above;(d) retaining, deleting and returning Client Data in accordance with periods agreed with
the Client;(e) imposing, where the Supplier works with Service Providers on such Service Providers
substantially the same security requirements as described in this document to protect
Client Data. In addition the Supplier shall meet all of their responsibilities under any
applicable shared responsibility model as provided by their cloud-Service Provider(s).;and(f) implementing a process to provide annual assurance (where required by Client) of the
security of Client Data (irrespective of whether it is processed by the Supplier or by
any of its Service Providers) in accordance with the principles of this document,
including Evidence to demonstrate that security. To the extent any areas are identified
as requiring improvement, the Supplier agrees to improve them promptly. Associatedcosts of this assurance shall be borne by the Supplier.

3 of 10 - Information Security Schedule (TPISS) v1.8

PMI Internal

Topic

Details of the Security Measures
2. To the extent that the Supplier Processes Client Data otherwise than directly on Client
Systems, the Supplier has established, and implements, internal security management
procedures that cover the following elements:(a) requesting and approving data processing rights in the Supplier’s Systems;(b) granting such rights in the Systems;(c) reviewing such rights in the Systems;(d) attributing to different individuals the roles for requesting, approving, granting andreviewing such rights; and(e) documenting the roles and responsibilities in relation to the above, and to whom such
responsibilities and rights are attributed.
3. Where dealing with Client Data in the Supplier Systems, the Supplier shall implement
standard operating procedures (SOPs) governing:(a) methods and resources for authenticating System users, and procedures for that;(b) creation and use of copies of System Data, programs and program tools used forbacking-up and restoring Systems;(c) creation and maintenance of System Data required for System testing and migration;(d) the protection of any copies required for System backup, archiving and other purposes;(e) securing Systems against unauthorized access;(f) recording who has accessed such Systems, stating the date and scope of such access;(g) conducting reviews and maintenance of media and Systems used for data Processing;(h) disposing securely of information that no longer needs to be retained, including:(i) customization of data retention periods; and(ii) arrangements for emergency deletion of PMI data.
4. In the event that the Supplier personnel provide any or all of these Services using Client
Systems (for example staff augmentation services) then the Supplier shall classify Client
Data and adhere to relevant Client IT standards in accordance with the Client’s instructions
and Supplier personnel shall undertake all training mandated by Client.

Building access
controls:

1. The Supplier shall implement physical and environmental controls to prevent:(a) unauthorized physical access to Client Data;(b) damage to Client Data;(c) interference with Client Data;(d) loss of Client Data; and(e) theft of Client Data.
2. The Supplier maintains a list of the locations (e.g., data centers, computer rooms, offices)where Client Data under its control is processed or stored.
3. The Supplier controls access to such locations where Client data may be processed orstored through implementation of appropriate logical, physical or technical controls (or any
combination of them).
4. The Supplier shall apply appropriate logical and/or technical controls for the protection ofdata in the Supplier’s environment. These shall include physical controls such as fences,
locked doors and windows, environmental controls to detect, alert and prevent
inappropriate conditions for operating computer systems due to (amongst others) fire,temperature, electrical power, or humidity.
5. The Supplier shall ensure that its representatives comply with those control arrangements
agreed with the Client.
6. In addition, to the extent that the Supplier may process or store Client Data on fourth party
system, the Supplier shall ensure measures are in place which deliver a similar level ofprotection to systems under their direct control.

Access andSysteminfrastructure
controls for
Client Data:

1. The Supplier shall implement measures to control access to Client Data (including at restand in transit) including:(a) the business aspects of access control;(b) user access management;(c) user responsibilities; and(d) system and access controls.
2. The Supplier shall document and enforce:

4 of 10 - Information Security Schedule (TPISS) v1.8

PMI Internal

Topic

Details of the Security Measures(a) operational procedures and responsibilities ensuring the Supplier has adequate
protections against malware and viruses;(b) System and data backup (including how to perform a back-up, when to do a back-up,
who should perform a back-up, and logs of the back-ups made);(c) logging use of Supplier Systems (including details of who logged on, when did theylog on and log off, what they did in the System (including changes made to the data));(d) monitoring the above logs;(e) retaining the above logs for no less than 18 months or, where the Supplier gives the
Client the opportunity to download the logs, for no less than 3 months;(f) protecting the integrity of operational software; and(g) technical vulnerability management.
3. The Supplier shall implement measures to protect the security of Client Data by:(a) controlling the purposes for which Client data may be used and ensuring such purposes
are permitted by the Agreement;(b) controlling the extent to which copies of Client Data are made and limiting thosecopies to what is necessary (for example, the Supplier shall not use Client Data outside
the production environment unless such use is necessary and has a businessjustification);(c) controlling the location of copies of Client Data;(d) controlling the disposal of Client Data; and(e) maintaining records of the above.
4. The Supplier shall process and store Client Data only through Assets and Systems
effectively controlled by the Supplier.
5. The Supplier shall ensure that any access over the internet to Supplier Systems that store orprocess Client Data will be subject to Multi-Factor Authentication (MFA).
6. The Supplier shall ensure that all Supplier Personnel who require access to Client Systems
and Data are equipped with devices that comply with the Client’s Multi-Factor
Authentication (MFA) requirements for such access.
7. To the extent that Client Data are Processed in a Supplier System, and to the extent that theSupplier Processes Client Data in a Client System and can exercise such control over the
System, the Supplier shall restrict access to that System including by:(a) ensuring access is granted to a named individual only;(b) maintaining lists of individual access to production Systems and the permissions
granted to user accounts; and(c) implementing access control which records and restricts the number of persons withprivileged access to those with an approved business need.
8. The Supplier shall restrict individual access by users to only those parts of the System towhich they need it to perform an approved role.
9. The Supplier shall restrict using the principles of:(a) authentication;(b) identity management; and(c) user access management.
10. The Supplier shall implement a process to:(a) manage access to Client Data systems to defined time periods, ensuring those periods
have an approved business justification; and(b) record the following information against each instance where access permission is
granted:(i) the date and time when the access starts; and(ii) the date and time when the access ends.
11. When any changes are made to an existing access, the Supplier shall record the change andits justification.
12. The Supplier shall implement a process for removing access permissions when thepermission expires, whether:(a) on completion of the task for which access was granted;(b) on expiry of the initially approved time period; or(c) termination of the privileged users’ role (including through termination of
employment).

5 of 10 - Information Security Schedule (TPISS) v1.8

PMI Internal

Topic

Details of the Security Measures
13. The Supplier shall:(a) review user access privileges used by or on behalf of the Supplier to access the Client
Data and Systems holding Client Data with the frequency required by the Supplier’s
security policies;(b) in any event no less frequently than once per calendar year;(c) ensure that personnel who have access to the System act responsibly and with due care;(d) maintain access control lists to production systems and the permissions granted to user
accounts;(e) disable or revoke a user’s access rights when the user no longer needs such accessrights; and(f) have a process to ensure that access rights to Supplier Systems, and to other Systems(e.g. Client Systems) to which the Supplier (either itself or through a third party) has
granted access, are revoked from the time the employment ends.
14. The Supplier shall link all of the procedures in this section (on Access and Systeminfrastructure controls for Client Data) to the Supplier’s policy on Joiners, Movers andLeavers.
15. Where the Supplier requires access to, or copies of, any Client Data for the purposes ofsoftware development or testing, the Supplier shall protect the Client Data with equivalentsystem access restrictions to those used in production environments.
16. Where appropriate, the Supplier shall use separate secure environments for development(including updating data), testing and production.
17. The Supplier shall implement a process for periodic and timely maintenance of Systems
where Client Data is Processed which will include procedures for patching and upgrades.
18. The Supplier shall maintain specifications of technical and organizational resources(covering System authentication, authorization and accounting) required to ensure theconfidentiality, integrity and availability of Client Data that are Processed by the Supplier.
19. To the extent that the Supplier permits the Client to itself manage users’ access rights, theSupplier shall:(a) ensure the Client’s access to such Systems is secure; and(b) provide the Client with tools that enable it to perform the functions required to ensure
the security of Client Data in the Supplier environment.
20. The Supplier shall periodically (and no less frequently than annually) review the identityand access management process.
21. The Supplier shall ensure that any systems where Client Data are Processed use a Secure
Architecture approach that applies Security by Design principles.
22. Where changes are made to systems where Client Data are Processed the Change follows adocumented process that embodies the principle of segregation of duties.
23. The Supplier shall apply suitable technical protections to Client Data to include:(a) firewalls (including a process to review firewall rules on a periodic basis) and othermeasures to identify and prevent unauthorized attempts to access applications sites orservices;(b) restricting access to system features and settings to privileged users;(c) applying industry standard cryptographic protection measures to data used forauthentication;(d) encryption to protect client data in transit;(e) encryption to protect client data at rest, where appropriate;(f) ensuring the effectiveness of technical protections is regularly reviewed and updated toaddress emerging threats;(g) enforcing a password policy that complies with one set out in a best practiceframework (a combination of at least nine upper & lower case letters, numerals andspecial characters);(h) automatically disabling user accounts after invalid login attempts; and(i) automatically locking idle login sessions.
24. Where the Supplier is developing software on behalf of the Client, and whether thatsoftware is implemented on Client or Supplier Systems, the Supplier shall apply
frameworks that are objectively considered to be best practice, e.g. Open Web Application

6 of 10 - Information Security Schedule (TPISS) v1.8

PMI Internal

Topic

Details of the Security Measures
Security Project (OWASP) as appropriate. The Supplier shall be prohibited from utilizing
copyleft open source software, in any Services.
25. The Supplier shall store Source Code in an industry standard secure repository.
26. In software development, the Supplier shall, prior to go live of the software (and prior to
making any updates of it) and (to the extent such software is run on Supplier Systems)
thereafter no less frequently than annually, conduct appropriate vulnerability testing. Thisshould include:(a) a combination of Static Application Security Testing (SAST) and Dynamic
Application Security Testing (DAST);(b) Interactive Application Security Testing (IAST); and(c) vulnerability scanning of the underlying infrastructure.
27. Where dealing with Client Data in a Supplier System, the Supplier shall document
standard operating procedures (SOPs) for:(a) security hardening for the end user devices used to provide the Services(b) management and use of System Data;(c) creation and use of copies of System Data;(d) programs and program tools used for backing-up and restoring Systems;(e) creation and maintenance of system data required for system testing and migration;(f) protection of any copies required for System backup, archiving and other purposes;(g) how to secure Systems against unauthorized access;(h) how Systems record who has accessed such Systems, stating the date and scope ofsuch access;(i) how to conduct reviews and maintenance of media and Systems used for dataprocessing; and(j) how to dispose securely of information that no longer needs to be retained including:(i) customization of data retention periods; and(ii) arrangements for emergency deletion of Client Data.
28. The Supplier shall implement a process to obtain assurance about the security of Client
Data where Client Data is Processed by any Service Provider, to be available to the Client
upon request, including:(a) maintaining guidelines for retention and disposal of business correspondence and otherrecords;(b) maintaining policies and procedures regulating the downloading, use and retention of
third-party software and data;(c) ensuring the information security of Client Data that is electronically transmitted(directly or via staging facilities) between Systems (whether at the Supplier’s or otherparties’ facilities); and(d) managing removable and portable media in accordance with Good Security Practice,including where appropriate storing them in a safe, secure environment in accordancewith manufacturers’ specifications.
29. The Supplier shall, where appropriate, implement a Data Loss Prevention solution.

Transmission

1. The Supplier shall document and enforce measures to protect Client Data duringtransmission by:(a) applying network security management; and(b) applying measures to secure data in transit.
2. The Supplier shall not transmit, or request any user to transmit, passwords used to access
Client Data in clear text over Systems or between Systems.
3. The Supplier shall not host, nor transmit to/from any member of the Client Group, or
permit such transmission by any Supplier Personnel, of any Client Data, or any
unstructured data, using any means other than through Supplier Systems or Client Systems.
For example, the Supplier shall not use, and shall not permit the use, for those purposes,
of:(a) non-corporate e-mail accounts (e.g. Yahoo!, Gmail, etc.);(b) unsecured FTP; or(c) consumer file sharing services.

7 of 10 - Information Security Schedule (TPISS) v1.8

PMI Internal

Topic

Details of the Security Measures
4. The Supplier shall not send any physical media device(s) containing Client Data to any
recipient (including the Client or any of its Affiliates) via any postal or courier service
except with the prior written (including e-mail) agreement of the Client’s designatedsecurity contact. Any such approval shall be valid for only one individual transmission.

Managing
Assets

1. The Supplier shall document and enforce measures to protect the security of the Client’s
Assets by:(a) identifying Client Assets on Supplier Systems;(b) understanding the risk classification of information Assets on Supplier Systems; and(c) ensuring that Client Data is not subject to unauthorized disclosure, modification,
removal or destruction.
2. The Supplier shall develop and maintain inventories of:(a) physical devices and Systems where Client Data are Processed within the organization;and(b) software platforms and applications where Client Data are Processed within theorganization,
including in each case details of relevant resources (e.g., hardware, devices, data, andsoftware) where Client Data are Processed prioritized based on their classification,
criticality, and business value.
3. If the Supplier is to decommission, or dispose of, any Asset containing Client Data, theSupplier shall ensure either:(a) that the Asset is irretrievably destroyed or returned to the Client; or(b) that the Client Data or relevant information held on the Asset is deleted and renderedirrecoverable prior to decommissioning, or disposing of, the Asset.

Review reports
andnotification

1. The Supplier shall document and enforce measures to protect its data, and maintain
Evidence of the effectiveness of these measures, for example by:(a) external and internal audit;(b) logs and reports;(c) testing and scanning; and(d) evaluating performance against documented agreements.
2. The Supplier shall conduct regular risk-based audits, whether external or internal coveringsystems where Client Data is Processed.
3. The Supplier shall measure the effectiveness of the measures put in place to protect Client
Data against:(a) formal agreement between the Client and Supplier; or(b) a recognized best practice framework such as ISO/IEC 27000, NIST or System andOrganization Controls (SOC).
4. Where the Supplier is subject to external audit, the Supplier shall share with the Client
such reports (or such elements of reports as are relevant to Client Data) with the Client.
These reports are likely to include:(a) ISO/IEC certification and monitoring audit reports; and(b) System and Organization Controls (SOC) reports.
5. Where IT systems are in scope of Payment Card Industry Data Security Standard (PCI
DSS), the Supplier shall maintain compliance with the current applicable version of PCI
DSS as published by the PCI Security Standards Council. The Supplier will provide
Evidence of such compliance to the Client to fulfil contractual requirements on request.
6. The Supplier shall conduct regular penetration testing.
7. The Supplier shall conduct regular vulnerability scanning.
8. The Supplier shall perform security assessments (including performing tests) of Systems
that Process Client Data no less frequently than annually.
9. The Supplier shall:(a) share the reports created, and results of testing performed, in such audits with the
Client in a timely manner, the format and timescale to be agreed with the Client; and(b) permit the Client to perform its own security assessments of such Systems incoordination with the Supplier.

8 of 10 - Information Security Schedule (TPISS) v1.8

PMI Internal

Topic

Details of the Security Measures
10. The Supplier shall provide the Client, no less frequently than each quarter (or such otherperiod as the Client may agree), with comprehensive and readily understandable overviews
regarding:(a) the access permissions of all persons with access to the Client Data;(b) audit trails of all persons with access to the Client Data;(c) records of detection of unauthorized mobile code;(d) records of external Service Provider activity;(e) records of monitoring for unauthorized personnel, connections, devices, and software;and(f) records of vulnerability scans.

Incident
management

1. In the event of any unauthorized access, loss or physical and/or technical incident
impacting the Services, Client Confidential Information and/or Client Personal Data, thenthe Supplier shall promptly notify the Client at soc@pmi.com and provide the Client withall reasonable assistance.
2. The Supplier shall document and implement technical and organizational measures for the
secure management of Security Events and Security Incidents. These measures should
include:(a) appointing employees to be responsible for particular roles so that the Supplier has aconsistent approach to incidents;(b) an incident management process which shall include measures to:(i) detect, track, escalate and resolve any Security Events or Security Incidents,
failures, or other operational risks; and(ii) understand the impact of the above
in a timely manner; and(c) appointing an incident management team with a defined role and invocation point;(d) defined and prompt detection and response procedures and timelines, and sharing thesewith the Client;(e) procedures to minimize and control the potential impact of Security Incidents,
including:(i) Asset management;(ii) impact assessment;(iii) creation of a response plan to promptly handle and remediate the impact of the
Security Incident; and(iv) implementation of that response plan, including escalation to all appropriate
parties.

Servicecontinuity

1. The Supplier shall document and enforce measures to minimize disruption to service
availability following a Security Incident or other disruptive event (e.g. earthquake, flood,
power outage, pandemic). This shall include ensuring that:(a) security arrangements remain in place throughout; and(b) redundancy measures are in place for continued delivery of the Services.
2. The Supplier shall:(a) test, approve and deploy changes to the Supplier Systems in a controlled manner with
only minimal disruption to the Client;(b) implement the appropriate organizational and technical measures necessary to sustain
or rapidly recover the services being provided to the Client in the case of any
reasonably foreseeable disruptive event; and(c) ensure that any stand-by or alternative location used for the purposes of the Supplier’s
service continuity is subject to information security controls at least equivalent to thosein force at the facility from which the Supplier usually operates the relocatedprocesses.
Supplier certifies that:

Third
party
access requests

1.

Supplier has not purposefully created back doors or similar programming that could be
used to access the Supplier system and/or Client Data;

9 of 10 - Information Security Schedule (TPISS) v1.8

PMI Internal

Topic

Details of the Security Measures
2.
3.

4.

Supplier has not purposefully created or changed its business processes in a manner thatfacilitates access to the Supplier system or Client Data;
Applicable law or government policy does not require Supplier to create or maintain backdoors or to facilitate access to Client Data or Supplier’s systems, or for Supplier to be inpossession or to hand over the encryption key; andSupplier has implemented organisational measures to challenge requests from applicablegovernment authorities if such requests are disproportionate or unlawful.

10 of 10 - Information Security Schedule (TPISS) v1.8

PMI Internal