NetSuite CPQ Data Security Addendum (US - English) (PDF)

NETSUITE CPQ DATA SECURITY ADDENDUM

For the NetSuite CPQ Cloud Service procured on the applicable Estimate/Order Form, Oracle shall maintain commercially reasonable administrative Safeguards designed for the protection, confidentiality and integrity of Customer Data. All such safeguards shall be commensurate with the importance of the Customer Data being protected, but in no event less protective than safeguards that Oracle uses to protect its own information or data of similar importance, or as required by applicable law. As of the Effective Date of the applicable Estimate/Order Form, such Safeguards are described below in this Addendum 1 ; provided, however, that Customer acknowledges and agrees that such Safeguards described in this Addendum are not comprehensive and such Safeguards may change during the term of the applicable Estimate/Order Form, as applicable third party security audits, compliance standards and/or certifications evolve/change over time, provided that any such changes to Safeguards will not materially decrease the overall security of the NetSuite CPQ Service Cloud Services during the term of the applicable Estimate/Order Form. For the Term of the Agreement, Oracle shall comply with all obligations regarding Customer Data under the applicable Estimate/ Order Form, including without limitation Oracle's obligations to maintain commercially reasonab le Safeguards as provided herein.

1. Security Policy. Oracle has, and will maintain, a security policy for its security organization that requires security training and privacy training for Oracle security personnel supporting the NetSuite CPQ Cloud Service.
2. Oracle Security Organization. Oracle has, and will continue to have, a dedicated security organization that is responsible for the ongoing monitoring of Oracle's security infrastructure, the review of Oracle products and services, and for respond ing to security incidents.
3. Data Storage and Handling. Storage medium or any equipment with storage capability, including mobile media, used to store Customer Data will be secured and hardened in accordance with industry standard practices, such as:

• a. Oracle will maintain a reasonable asset management policy to manage the life cycle (commissioning, operating, maintaining, repairing, modifying, replacing and decommissioning/disposal) of such media.
• b. Decommissioned media containing Customer Data will be destroyed in accordance with NIST 800-88 Revision 2 at the Moderate level of sensitivity (or similar data destruction standard).
• c. Customer Data will be logically segmented from Oracle and other Oracle customers' data.
• d. Database fields in the NetSuite CPQ Cloud Service designated for credit card data information and social security numbers will be encrypted, and Oracle will not process such Customer Data in test, development or non-production environments.

4. Data Transmission. Oracle will use strong cryptography and security protocols consistent with industry standards, as documented in the User Guides for the NetSuite Service.
5. Incident Response. Oracle will monitor a variety of communication channels for known incidents, and Oracle's security team will react promptly to such known incidents. In the event of a Security Incident, Oracle will: (i) notify Customer in accordance with Or acle's obligations under applicable law or regulatory requirement, to the extent an applicable security breach law applies to such Security Incident; and (ii) perform a penetration test after corrective actions are implemented, if applicable, with a test results summary to be provided to Customer, and such test results to be deemed Oracle Confidential Information. Oracle's incident response plan is further described in Oracle's SOC 1 / ISAE 3402 Type II report and Oracle's SOC 2 Type II report .