Contract analysis

ARTICLE I — PURPOSE The Board of Directors (the "Board") of Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), a Delaware corporation incorporated under the Delaware General Corporation Law (the "DGCL"), hereby creates the Technology & Cybersecurity Oversight Committee (the "Committee") as a standing committee of the Board, established pursuant to Section 141(c) of the DGCL and Article III, Section 3.3 of t

Section 2.1 — Number of Members The Committee shall consist of no fewer than three (3) members of the Board of Directors. The Board may, from time to time, increase the size of the Committee as the Board deems appropriate, provided that the Committee shall at all times maintain a minimum of three (3) voting members. All voting members of the Committee shall be "independent directors" as defined by the New York Stock

Section 2.2 — Qualifications At least one (1) voting member of the Committee shall possess cybersecurity expertise or technology expertise, as defined in Section 2.3 below. The Board shall identify such member or members in the Company's annual proxy statement, to the extent required or recommended by applicable rules, regulations, or governance best practices. Members of the Committee should collectively possess a m

Section 2.3 — Definition of Cybersecurity or Technology Expertise For purposes of this Charter, a member of the Committee shall be deemed to possess "cybersecurity or technology expertise" if, through education, professional experience (including service as a chief information officer, chief technology officer, chief information security officer, or in an equivalent executive role), or other relevant background, such

Section 2.4 — Appointment and Removal Members of the Committee shall be appointed annually by the Board upon the recommendation of the Nominating & Corporate Governance Committee (currently chaired by Arthur J. Pennington, Lead Independent Director) at the first regular meeting of the Board following the annual meeting of shareholders, and shall serve until their successors are duly appointed or until their earlier r

Section 2.5 — Chairperson The Board shall designate one voting member of the Committee as Chairperson. The Chairperson shall preside at all meetings of the Committee, set the agenda for each meeting in consultation with management and other committee chairs, and serve as the primary liaison between the Committee and the full Board. The Chairperson shall report to the full Board on the Committee's activities, findings

Section 2.6 — Initial Members The initial members of the Committee, effective upon adoption of this Charter by the Board on December 11, 2025, shall be: Priya Narasimhan — Chairperson. Ms. Narasimhan is an independent director of the Company and serves as Chief Executive Officer of Tessera Fintech Corp. She has served as a director of the Company since 2023. Ms. Narasimhan possesses technology expertise within the me

Section 3.1 — Frequency The Committee shall meet at least four (4) times per calendar year on a quarterly basis, with meetings generally scheduled to occur in advance of regularly scheduled meetings of the full Board. The Committee may meet more frequently as circumstances require, including in response to significant cybersecurity incidents, material technology developments, or emerging regulatory matters. Additiona

Section 3.2 — Quorum A majority of the voting members of the Committee shall constitute a quorum for the transaction of business at any meeting of the Committee. Non-voting advisory members shall not be counted for purposes of determining whether a quorum is present. If a quorum is not present at any meeting, the members present may adjourn the meeting to another time and place without further notice, except as may b

Section 3.3 — Voting All actions of the Committee shall be taken by a majority vote of the voting members present at a meeting at which a quorum is present. Each voting member shall have one vote. In the event of a tie, the matter shall be referred to the full Board for resolution. The Committee may also act by unanimous written consent in lieu of a meeting, in accordance with Section 141(f) of the DGCL and the appli

Section 3.4 — Attendance of Non-Members The Committee may invite members of management, including the Chief Information Officer, Chief Information Security Officer, Chief Technology Officer, or equivalent officers, to attend meetings of the Committee as the Committee deems appropriate. The Committee may also invite the Chief Audit Executive (Renata M. Vásquez), external advisors, legal counsel, and other persons to a

Section 3.5 — Agenda and Minutes The Chairperson, in consultation with the Corporate Secretary's office, shall be responsible for establishing the agenda for each meeting of the Committee. The agenda shall be distributed to Committee members, together with any supporting materials, in advance of each meeting, with the goal of providing materials at least five (5) business days prior to each regularly scheduled meetin

ARTICLE IV — AUTHORITY AND RESPONSIBILITIES The Committee shall have the following authority and responsibilities, in addition to any other duties that may be assigned to the Committee by the Board from time to time. In discharging its responsibilities, the Committee shall have full access to all books, records, facilities, and personnel of the Company and its subsidiaries, and shall have the authority to direct any

Section 4.1 — Cybersecurity Program Oversight The Committee shall oversee the Company's enterprise cybersecurity program, including the adequacy and effectiveness of the Company's cybersecurity policies, procedures, and controls. The Committee's cybersecurity oversight responsibilities shall include, without limitation, the following: (a) Risk Profile Assessment. Review and assess the Company's cybersecurity risk pro

Section 4.2 — Information Technology Strategy The Committee shall review and provide oversight of the Company's information technology ("IT") strategic plan, including investments in technology infrastructure, digital transformation initiatives, and technology modernization programs. In fulfilling this responsibility, the Committee shall: (a) Strategic Plan Review. Review the Company's multi-year IT strategic plan, i

Section 4.3 — Data Privacy The Committee shall oversee the Company's data privacy program, including compliance with applicable federal and state data privacy laws and regulations, such as the California Consumer Privacy Act (as amended by the California Privacy Rights Act), the Connecticut Data Privacy Act, the Texas Data Privacy and Security Act, and other applicable data privacy statutes and regulations. In fulfil

Section 4.4 — Insurtech Initiatives The Committee shall oversee technology-driven insurance initiatives, including digital distribution platforms, automated underwriting systems, telematics-based insurance products, usage-based insurance models, and other insurtech innovations deployed by or through the Company's subsidiaries. The Committee shall: (a) Innovation Oversight. Review and evaluate the Company's insurtech

Section 4.5 — Artificial intelligence Governance The Committee shall oversee the Company's use of artificial intelligence ("AI") and machine learning ("ML") technologies, including underwriting algorithms, claims processing automation, fraud detection systems, customer-facing AI tools (including chatbots and virtual assistants), and predictive analytics models. In fulfilling this responsibility, the Committee shall:

Section 4.6 — Third-Party Technology Risk The Committee shall oversee the Company's management of third-party technology risks, including risks arising from outsourced IT services, cloud computing providers, software vendors, managed service providers, and other technology-related third parties. In fulfilling this responsibility, the Committee shall: (a) Vendor Risk Management. Review the Company's vendor risk manage

Section 4.7 — Incident Response The Committee shall oversee the Company's incident response and business continuity plans as they relate to cybersecurity incidents, technology failures, and data breaches. In fulfilling this responsibility, the Committee shall: (a) Incident Response Plans. Review and assess the adequacy of the Company's incident response plans, including the roles and responsibilities of the incident

Section 4.8 — Insurance Regulatory Technology Requirements The Committee shall monitor technology-related regulatory requirements applicable to the Company's regulated insurance subsidiaries, including requirements imposed by the relevant state departments of insurance and any other regulatory authorities with jurisdiction over the Company's insurance operations. Such regulatory requirements include, without limitati

Section 4.9 — Budget and Resources The Committee shall review and recommend to the Board the annual technology and cybersecurity budget, including expenditures for staffing, tools, training, third-party services, and external assessments. In fulfilling this responsibility, the Committee shall: (a) Assess whether the Company's technology and cybersecurity functions have adequate resources, personnel, and organizationa

Section 4.10 — Talent and Organizational Structure The Committee shall review the qualifications, organizational positioning, and effectiveness of the Company's senior technology and cybersecurity leadership, including the Chief Information Officer, Chief Information Security Officer, Chief Technology Officer, and other senior technology officers. The Committee shall: (a) Assess the experience, qualifications, and pe

ARTICLE V — INTER-COMMITTEE COORDINATION

Section 5.1 — Coordination with the Risk Committee The Committee shall maintain a coordination protocol with the Risk Committee (chaired by Raymond T. Huerta) to avoid duplication of effort and to ensure comprehensive oversight of technology and cybersecurity risks within the broader enterprise risk management framework. Specifically: (a) The Chairpersons of the Committee and the Risk Committee shall confer at least

Section 5.2 — Coordination with the Audit Committee The Committee shall maintain a coordination protocol with the Audit Committee (chaired by Dr. Lilian Fong-Archer) to ensure alignment on matters of mutual interest. Such matters include, without limitation: (a) Internal audit findings related to IT controls, cybersecurity, and data integrity, as reported by the Chief Audit Executive (Renata M. Vásquez) and the Compa

Section 5.3 — Coordination with the Investment Committee The Committee shall coordinate with the Investment Committee (chaired by Jonathan K. Whitmore) on technology risks that may affect the Company's invested assets portfolio, which had total invested assets of approximately sixteen billion four hundred million dollars ($16.4 billion) as of December 31, 2024 (fiscal year 2024). Such technology risks include, withou

Section 5.4 — Coordination with the Nominating & Corporate Governance Committee The Committee shall coordinate with the Nominating & Corporate Governance Committee (chaired by Arthur J. Pennington, Lead Independent Director) regarding director skills and qualifications related to technology and cybersecurity oversight. The Committee shall provide input to the Nominating & Corporate Governance Committee to inform the

Section 6.1 — Reports to the Board The Chairperson shall report to the full Board of Directors on the Committee's activities, findings, and recommendations at least quarterly, at each regularly scheduled meeting of the Board. Such reports shall include a summary of the matters discussed at the most recent Committee meeting, any significant actions taken by the Committee, and any matters requiring Board attention or a

Section 6.2 — Annual Report The Committee shall prepare and present to the Board an annual report summarizing the Committee's activities and findings for the preceding calendar year. The annual report shall include, at a minimum: (a) An assessment of the state of the Company's cybersecurity program and IT strategy, including the Committee's evaluation of the program's effectiveness, maturity, and alignment with the C

ARTICLE VII — DELEGATION AND ADVISORS

Section 7.1 — Delegation to Subcommittees The Committee may, in its discretion, delegate specific responsibilities to one or more subcommittees, each consisting of one or more members of the Committee, to the extent permitted under Section 141(c) of the DGCL and the Company's Bylaws. Any such delegation shall be made by a majority vote of the voting members of the Committee. The Committee shall retain oversight of an

Section 7.2 — Retention of Advisors The Committee shall have the sole authority to retain and terminate independent outside advisors, including technology consultants, cybersecurity experts, forensic investigators, legal counsel, and other specialists, as the Committee deems necessary or appropriate to fulfill its responsibilities under this Charter. The Committee may retain such advisors without obtaining further Bo

ARTICLE VIII — ANNUAL SELF-EVALUATION The Committee shall conduct an annual self-evaluation of its own performance, including a review of the adequacy of this Charter. The self-evaluation shall assess the Committee's effectiveness in fulfilling the responsibilities set forth in this Charter, the quality and timeliness of information received from management, the Committee's working relationship with management and wi

ARTICLE IX — LIMITATIONS While the Committee has the responsibilities and powers set forth in this Charter, it is not the duty of the Committee to design, implement, or operate the Company's technology systems, cybersecurity program, data privacy compliance program, or any other operational function. These are the responsibilities of the Company's management. The Committee's function is one of oversight, and the memb

ARTICLE X — AMENDMENT This Charter may be amended, modified, or repealed by the Board of Directors at any time, by the affirmative vote of a majority of the directors then in office at any regular or special meeting of the Board. The Committee shall review this Charter at least annually and shall recommend any proposed changes to the Board through the Nominating & Corporate Governance Committee. The Committee's annua