Five9 Data Processing Addendum for ISV Partners

1. INFORMATION SECURITY PROGRAM

Five9 has implemented and will maintain during the Term an information security program based on ISO/IEC 27001 standards that are applicable to Five9 as a service provider and designed to (i) implement secure methods for processing, transmitting and storing Customer Data, (ii) secure Customer Data against unauthorized  access, acquisition, use, or disclosure, and (iii) minimize physical and logical security risks to the Five9 network, including through regular risk assessment and testing (collectively, the “Security Program”). Five9 designates one or more employees to coordinate and be accountable for the Security Program. Five9 conducts periodic reviews of the Security Program, which Five9 may update or modify as it deems necessary.

8. AVAILABILITY CONTROLS AND BUSINESS CONTINUITY

a. Five9 will take measures designed to ensure that data are protected against accidental destruction or loss. These include data backup procedures; uninterruptible power supply (UPS); 24x7 Network Operations Centre (NOC) monitoring; critical jobs monitored for successful completion and error resolution; problem and incident management and response procedures; security incident management and response procedures; and root cause analysis required for problems and incidents affecting production.

b. Five9 has and will maintain an appropriate disaster recovery, business continuity and contingency plan and related policies and procedures (collectively, the “Business Continuity Plan”). The Business Continuity Plan will be reviewed by Five9 no less than annually and is designed to provide for continued operation in the event of a catastrophic event affecting Five9’s business operations.

c. Five9 will routinely test features of its Business Continuity Plan and will provide a summary report of the results of such tests to Customer upon written request.

2. FIVE9 CERTIFICATION AND SECURITY STANDARDS

a. During the Term, Five9 will maintain an ISO/IEC 27001 certification and SOC 2 Type 2 report (“SOC 2 Report”).

b. Upon reasonable written request, Five9 will provide Customer such SOC 2 Report and any other of its currently available certifications. In addition, Five9 will provide its security assessment upon Customer’s reasonable written request.

c. As a certified Level 1 Payment Card Industry (PCI) Data Security Standard (DSS) Service Provider, Five9 engages an independent Qualified Security Assessor (QSA) to perform an annual assessment of Five9’s control environment covering all 12 PCI DSS requirements. Upon reasonable written request, Five9 will provide its current PCI attestation letter.

9. MALICIOUS SOFTWARE

a. Five9 will install and maintain a relevant industry standard anti-malware software and, to the extent feasible, use real-time protection features designed to prevent the Services from being infected or affected by the presence of malicious code.

b. Five9 will promptly remove malicious code discovered in Five9’s applications or the Services.

c. Five9 will perform real-time scanning on files and other data uploaded into the Services to identify and eliminate any files or other data containing malicious code to the extent feasible.

d. Five9 will use commercially reasonable efforts to prevent the transmission or the introduction of any malicious code into its applications.

3. ACCESS CONTROLS TO SYSTEMS

Five9 has implemented and will maintain commercially reasonable measures designed to prevent unauthorized access to Five9’s network. These may include the following technical and organizational measures for user identification and authentication: anti-virus protection; stateful inspection firewalls; internal and external vulnerability scans; intrusion detection and prevention systems; least-privilege access to IT systems based on job role and segregation of duties; strong password procedures; no access for guest users or anonymous accounts; and two-factor authentication for privileged IT administrators.

a. Penetration Testing. Five9 will perform application penetration tests of its proprietary applications using relevant industry standard practices to detect vulnerabilities in the applications and to measure the effectiveness of the applications’ security controls. Vulnerabilities identified will be tracked and remediated in accordance with Five9’s internal policies to the extent remediation is reasonably feasible and within Five9’s reasonable control.

b. Vulnerability Management. Five9 will implement and review no less than annually a comprehensive vulnerability management program for the regular identification, categorization, and timely remediation of technical and process vulnerabilities at the infrastructure and application layers of the application to the extent remediation is feasible and within Five9’s reasonable control.

c. Logging.  Five9 has and will maintain a log management program based on the NIST 800-92 and provides logging capabilities in accordance with the following: (i) the scope of logging and the retention policy utilize a risk-based approach; (ii) logs will be sufficient to permit forensic analysis on Personal Data Breaches; (iii) logs will record administrative changes to the Services; (iv) log records will be kept physically and virtually secured to prevent tampering; and (v) passwords will not be logged.

d. Firewalls. Five9 has and shall maintain intrusion prevention systems.  At a minimum, such intrusion prevention systems will include firewalls, which will: (i) be configured to deny access, except for what is explicitly allowed; (ii) restrict publicly accessible systems and wireless access from any internal system that contains Customer Data; and (iii) block all protocols and services that are not required under the Agreement or for other general business purposes. 

10. DISCLOSURE CONTROLS AND DATA ENCRYPTION

a. Five9 will take measures designed to prevent the unauthorized access, alteration, or removal of data during transfer, and to ensure that all transfers are secure and are logged. These measures include secure File Transfer Protocol (sFTP) for transport and communication of data, if ordered; and media sanitization and destruction procedures. Customer agrees to order encryption of voice in transit (sRTP or a VPN) if voice data traverses a public network to reach a Customer agent.

b. Five9 will implement and utilize encryption based on NIST Special Publication 800-52 encryption guidelines to protect Customer Data in-transit and at rest. Customer acknowledges and agrees that in the event of requiring voice data traversing a public network to reach a Customer agent as part of the Services, Customer shall promptly order Secure Real-time Transport Protocol (sRTP) or a Virtual Private Network (VPN) from Five9.

c. Five9 maintains and will maintain a formal process for managing and protecting encryption keys which follow relevant industry standards.

4. RESTRICTED ACCESS CONTROLS TO DATA

Five9 will take measures designed to prevent unauthorized access to Customer Data beyond permitted access rights. These measures may include:

a. least-privilege access rights based on job role and segregation of duties;

b. management approval required for new or modified access prior to provisioning or change;

c. terminated user access promptly disabled from human resources;

d. quarterly logical and physical access review for workforce members with access to production;

e. quarterly administrator access revalidated by management;

f. physical access to the data centers restricted to appropriate individuals; and

g. two-factor authentication for privileged IT administrators.

11. DATA PROCESSING CONTROLS

Five9 will take measures designed to ensure that data is processed strictly in compliance with the data exporter's instructions. These must include unambiguous wording of contractual instructions; monitoring of contract performance; and monitoring of service level agreements.

5. CHANGE MANAGEMENT CONTROLS

Five9 will take measures designed to ensure all changes to production systems are logged, tested, and approved. These must include change request and approval required prior to implementation into production; critical application changes tested and approved prior to implementation into production; access to migrate changes into production restricted to appropriate individuals; and critical changes routinely reviewed to confirm appropriateness and authorization.

12. SEGREGATION CONTROLS

Five9 will take measures designed to allow data collected for different purposes to be processed separately. These include restriction of access to data according to job role and segregation of duties; segregation of business IT systems; and segregation of IT testing and production environment.

6. ACCESS CONTROLS TO PREMISES AND FACILITIES

Five9 will take measures designed to prevent unauthorized physical access to premises and facilities holding personal data, which include:

a. appropriate physical environmental safeguards;

b. on-site backup; and

c. appropriate controls designed to ensure that only authorized Five9 personnel are allowed physical access to such facilities which may include access control system; ID reader, chip card; issue of keys; door locking (electric door openers, etc.); video/CCTV monitor; and logging of facility exits/entries.

13. MEDIA HANDLING

Five9 will ensure that relevant industry standard media handling procedures are implemented and maintained.  The media will be encrypted, transported in a secure manner, and stored in a location that is physically secure. Devices must be purged, degaussed, or physically destroyed, so that data cannot be reconstructed based on disposition protocols defined within NIST 800-88 Media Sanitation Standard. Five9 shall ensure proper documentation or certificate of destruction of the disposal of any hardware or media (such as, but not limited to tape drives, thumb drives, diskettes, CD’s, DVD’s, laptop drives, workstation drives or server drives) that stores Customer Data. 

7. DATA RETENTION

Five9 will:

a. maintain Customer Data and store it in a location and format available for retrieval in accordance with Five9’s data retention policy as set forth at https://www.five9.com/legal/dataretention;

b. have specific procedures in place governing access to copies of Customer Data in connection with a legal action or regulatory requirement to disclose;

c. review and test data recovery procedures on a routine basis or when a material change occurs; and

d. log data restoration efforts, including the person responsible, the description of the restored data and which data (if any) had to be input manually in the data recovery process.

14. HUMAN RESOURCES SECURITY

Five9 provides information security, regulatory compliance, and privacy training to all of its employees that handle Customer Data to support a common understanding of applicable data protection laws and regulations, as well as how to detect and report security issues. Such training shall:

a. include secure handling protocols when handling Customer Data;

b. be provided at the time of hire and annually thereafter; and

c. be documented with the names of the employees who completed the training and the dates the training was completed.

Furthermore, Five9 personnel with access to Customer Data will also be subject to confidentiality obligations.