Supplier Security Requirements Schedule

This Security Schedule describes the minimum administrative, technical and physical safeguards that the Supplier shall implement and maintain for the duration of the Services in order to protect the security, confidentiality, availability, integrity and privacy of all Customer Data. "Customer Data" means any data (a) provided by Customer, or any user of the Services, to the Supplier in connection with the Customer’s use of the Services, (b) otherwise processed by the Supplier on the Customer’s behalf; or (c) generated for the Customer’s use as part of the Services.

The Supplier shall: (a) maintain robust and comprehensive internal policies, guidelines and documentation that address the Supplier’s security processes to mitigate cybersecurity risks related to access controls, data loss prevention and the protection of Customer Data; (b) regularly update these to align with industry best practice; and (c) make such policies, guidelines and documents accessible to all personnel.

The Supplier shall ensure that all personnel with access to Customer Data have: (a) passed a comprehensive background check at onboarding where permitted in accordance with local law; (b) executed a confidentiality agreement with the Supplier with respect to Customer Data; and (c) completed annual mandatory security and privacy training.

The Supplier shall maintain strong physical security controls at all locations at which Customer Data is processed to prevent unauthorised access to locations and to safeguard the Supplier’s physical assets.This includes, but is not limited to, entry access controls, personnel badge requirements and securing IT equipment. The Supplier warrants that any infrastructure providers used by the Supplier maintains physical security standards that are at a minimum, aligned with SOC 2 standards.

The Supplier may use third party vendors to support the provision of the Services. The Supplier shall perform annual security risk assessments and due diligence on third party vendors with access to Customer Data to ensure that they have appropriate security controls proportional to the Service they are providing and the associated security-related risks. The Supplier will remain fully liable for any acts, errors or omissions of its third party vendors.

The Supplier shall maintain strong authentication mechanisms to prevent unauthorised access to Customer Data. This includes implementation of SSO and multi-factor authentication for the Supplier’s personnel where possible, with access permissions managed in accordance with the principles of least privilege and separation of duties.

The Supplier shall maintain robust change management processes, including formal change management procedures to ensure systematic transition of changes. This includes ensuring separate development, testing and operational environments, adhering to the principles of least privilege and documenting changes, to reduce the risks of unauthorised access or changes to the operational environment.

The Supplier shall use industry-standard encryption protocols to protect Customer Data both in transit and at rest, implement secure encryption key management practices and keep encryption algorithms up to date to protect against emerging threats.

The Supplier shall maintain continuous and proactive processes to identify, prioritise, prevent, recover, remediate and report on vulnerabilities that threaten the security and confidentiality of Customer Data. This shall include implementing firewalls and anti-virus and anti-malware software, conducting regular vulnerability scans, implementing patch management procedures for all systems without undue delay and performing regular assessments to prioritise and address critical vulnerabilities.

The Supplier shall conduct independent penetration tests at least annually to assess the effectiveness of its security controls, and address and resolve any identified vulnerabilities within a timely manner.

The Supplier shall maintain a comprehensive incident response plan outlining procedures for identifying, managing and resolving security incidents. The Supplier shall promptly investigate all security incidents upon becoming aware and to the extent permitted by applicable law, notify the Customer at dpo@alphasights.com without undue delay.

The Supplier shall maintain robust policies and procedures that are regularly tested to ensure minimum Service disruption following an issue or incident.

The Supplier shall implement regular backup procedures for Customer Data and regularly test these so Customer Data can be restored quickly in the event of an incident. This includes ensuring Customer Data is retained redundantly in secure offsite locations, separate from primary data centers and encrypted in transit and at rest using a modern encryption standard based on the type of Customer Data being encrypted.

The Supplier shall delete Customer Data on Customer’s request or following termination of the Agreement, subject only to legal requirements to retain Customer Data. The Supplier shall implement secure data deletion processes to ensure that data is irrecoverable when no longer needed, maintain audit trails for deletion activities to verify compliance and provide the Customer with a certification of destruction on request.

The Supplier shall maintain a current SOC2 Type II, ISO 27000 or equivalent certification on any applications and environments where Customer Data is processed. Upon the Customer’s request, the Supplier shall provide to the Customer, free of charge and within five business days, the latest copy of its report and any other necessary information to demonstrate its compliance with the terms of this Security Schedule. The Supplier shall also permit the Customer (or its independent auditor) on reasonable notice to audit, review and inspect the Supplier’s facilities, systems, processes and any relevant documentation, in order to verify its compliance with the Security Schedule. The Supplier shall provide reasonable assistance and access to designated personnel, data and resources as necessary for the conduct of the audit. Any audit shall be conducted in a manner that minimises disruption to the Supplier’s business operations. Each party shall bear its own costs in relation to any audit conducted, provided that if any audit uncovers a material breach of the Security Schedule, the Supplier shall reimburse the Customer for reasonable costs incurred in relation to such audit.