[[Bank of America:Organization]] may perform vulnerability testing of [[Organization A:Organization]]’s system to test the remediation measures implemented after a security incident or event to protect Confidential Information.

[[Organization A:Organization]] shall permit [[Bank of America:Organization]], at the election of [[Bank of America:Organization]], to conduct security vulnerability (penetration) testing on those portions of the [[Organization A:Organization]] network, and any application servers that [[Organization A:Organization]] hosts on behalf of [[Bank of America:Organization]], on which Confidential Information is stored or processed. Such vulnerability testing shall be conducted in a non-production environment with production equivalent security controls and with prior notice to [[Organization A:Organization]]. [[Organization A:Organization]] also agrees to make available to [[Bank of America:Organization]] the results of any vulnerability testing conducted by [[Organization A:Organization]] or a qualified third party provider of this service.