Contract analysis

Section 1 — Definitions 1.1 "Customer Data" means all data, information, content, records, and files provided by or on behalf of Customer, transmitted over the managed network, processed through the ArcMesh platform (version 4.2), or otherwise accessed by Service Provider in connection with the Services, including but not limited to network traffic data, configuration data, user credentials, device identifiers, perfo

Section 2 — Data Handling Standards 2.1 General Obligation. Service Provider shall implement and maintain administrative, technical, and physical safeguards designed to protect Customer Data against unauthorized access, use, disclosure, alteration, or destruction, consistent with industry best practices applicable to managed network services and software-defined wide area network ("SD-WAN") platforms. Such safeguards

Section 3 — Encryption Requirements 3.1 Data in Transit. All Customer Data transmitted over the managed network, between managed nodes, between Customer premises and Service Provider Systems, and between the Reston NOC and Winnipeg NOC shall be encrypted using Transport Layer Security ("TLS") version 1.2 or higher, or Internet Protocol Security ("IPsec") with Advanced Encryption Standard ("AES") 256-bit encryption. S

Section 4 — Access Controls 4.1 Principle of Least Privilege. Access to Customer Data shall be granted on a strict need-to-know basis and shall be limited to Authorized Personnel who require such access to perform specific duties in connection with the Services. Service Provider shall not grant blanket or default access to Customer Data to any employee, contractor, or agent. Access privileges shall be commensurate wi

Section 5 — Personnel Security 5.1 Background Checks. Service Provider shall conduct comprehensive background checks on all Authorized Personnel prior to granting such individuals access to Customer Data. Background checks shall include, at a minimum, verification of identity, criminal history checks, and employment history verification, to the extent permitted by applicable law. For Authorized Personnel located in C

Section 6 — Security Incident and Breach Notification Procedures 6.1 Notification Timeline. Service Provider shall notify Customer of any Security Incident without unreasonable delay and in no event later than seventy-two (72) hours after Service Provider becomes aware of the Security Incident. For purposes of this Section 6.1, Service Provider shall be deemed to be "aware" of a Security Incident at the time any empl

Section 7 — Audit Rights 7.1 Customer Audit Right. Customer and its designated representatives, including its external auditors, Dunmore & Pratt LLP, shall have the right, upon thirty (30) days' prior written notice to Service Provider, to audit Service Provider's compliance with the terms and conditions of this Exhibit E. Such audits may be conducted no more than once per calendar year under ordinary circumstances;

Section 8 — Data Localization 8.1 Primary Processing Locations. Customer Data shall be processed, stored, and accessed only at the following approved locations: (a) Service Provider's Reston NOC facility, located at 11400 Commerce Park Drive, Suite 600, Reston, VA 20191, United States; (b) Service Provider's Winnipeg NOC facility, located at 200 Portage Avenue, Suite 1500, Winnipeg, MB R3C 3X2, Canada; (c) Customer's

Section 9 — Data Retention and Destruction 9.1 Retention During Term. Service Provider shall retain Customer Data only for so long as necessary to perform the Services and as required by the Agreement and any applicable Statement of Work (Exhibit A). Service Provider shall not retain copies of Customer Data, including backup copies, cached copies, or archived copies, beyond the retention periods specified in the Agre

Section 10 — Compliance with Applicable Data Protection Laws 10.1 General Compliance. Service Provider shall comply with all Applicable Data Protection Laws in its performance of the Services, including without limitation: (a) All applicable United States state data privacy and data breach notification statutes across the twenty-eight (28) US states in which managed nodes are located; (b) PIPEDA and applicable provin

Section 11 — Network Security and Monitoring 11.1 Cybersecurity Monitoring. Service Provider shall provide twenty-four hours per day, seven days per week (24×7) cybersecurity monitoring, threat detection, and incident response for the managed network perimeter and all Service Provider Systems processing or transmitting Customer Data, as further described in Exhibit A (Statement of Work) to the Agreement. Cybersecurit

Section 12 — Business Continuity and Disaster Recovery 12.1 BCP/DR Plans. Service Provider shall maintain comprehensive, documented business continuity plans ("BCP") and disaster recovery plans ("DRP") covering all Service Provider Systems and the Services. BCP/DRP plans shall address, at a minimum, the following scenarios: natural disasters, power outages, network failures, hardware failures, cyberattacks, pandemic

Section 13 — Subcontractor and Third-Party Management 13.1 Approval Requirement. As set forth in Section 8.3 of this Exhibit E, no subcontractor or sub-processor may access, process, store, or handle Customer Data without Customer's prior written consent. Service Provider shall submit requests for subcontractor approval in writing, providing sufficient detail for Customer to evaluate the proposed subcontractor's qual

Section 14 — Cooperation and Reporting 14.1 Quarterly Security Reports. Service Provider shall provide Customer with written quarterly reports summarizing Service Provider's security posture and compliance with this Exhibit E. Quarterly reports shall include, at a minimum: (a) a summary of any Security Incidents during the reporting period, including status and resolution; (b) vulnerability scan results and remediati

Section 15 — Remedies 15.1 Material Breach. A material or persistent failure by Service Provider to comply with the obligations set forth in this Exhibit E shall constitute a material breach of the Agreement, entitling Customer to exercise its termination rights under the Agreement, including without limitation the right to terminate the Agreement for cause under Section 7 of the Agreement. Service Provider acknowled

Section 16 — Miscellaneous 16.1 Governing Law. This Exhibit E shall be governed by and construed in accordance with the laws of the State of New York, without giving effect to any choice or conflict of law provision or rule that would cause the application of the laws of any other jurisdiction, consistent with the governing law provision set forth in the Agreement. 16.2 Conflict. In the event of any conflict or incon