To maintain its information security capabilities and performance, the company commissions a third party auditor to conduct an annual audit and review of its information security performance, during which a vulnerability scan and penetration test are performed to ensure that the company’s information systems and network environment are compliant with the code of practice for information security management.