15. Audit

15.1 Glesys continuously monitors its compliance with the security requirements set out in this Information Security Annex.

15.2 Glesys shall provide the Customer with access to information necessary to demonstrate compliance with the Cyber Security Rules and this Information Security Annex and allow for and contribute to audits, including inspections, conducted by the Customer or by another auditor agreed by the Parties. Such audits shall be limited to once per calendar year, unless a higher frequency is required under applicable law or by a competent supervisory authority. Glesys shall be entitled to withhold commercially sensitive information and information that may adversely affect the security of Glesys' services.

15.3 Each Party shall bear its own costs and expenses incurred in connection with any audit as set out above, unless otherwise set out by section Fel! Hittar inte referenskälla. below.

15.4 The Customer shall take all necessary measures to ensure the confidentiality of any information disclosed by Glesys pursuant to the above or as revealed through audits.