Contract analysis

I. Executive Summary The purpose of this memorandum is to document the lessons learned from the data security incident originating from Quorum Insurance Holdings Corp.'s ("Quorum" or the "Company") third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), and to provide Calderwood & Harkness LLP's ("Calderwood & Harkness" or "outside counsel") actionable recommendations for strengthening Quorum'

1. Vendor Risk Management Program

2. Contractual Protections and Enforcement

3. Incident Response Plan and Preparedness

4. Regulatory Notification and Compliance

5. Data Minimization and Security Architecture These categories are followed by a financial summary and cost recovery context, an implementation roadmap with prioritized timelines, and concluding observations.

II. Incident Recap and Root Cause Analysis A. Incident Overview Palomar Data Solutions, Inc. is a data services firm that provides claims data processing, document management, and analytics services to Quorum's personal lines division. The relationship is governed by a Master Services Agreement originally executed on November 12, 2019, as subsequently amended by Amendment 1 (dated March 3, 2021) and Amendment 2 (date

III. Lessons Learned — Category 1: Vendor Risk Management Program A. Pre-Engagement Due Diligence Gaps Quorum's existing vendor risk management program, overseen by Priya Deshmukh (VP, Vendor Risk Management), incorporated a number of standard industry practices, including pre-engagement security questionnaires administered to prospective vendors, standard contractual data security requirements embedded in vendor agr

1. Implement a Formal Vendor Risk Tiering Framework. Quorum should establish a formal, documented framework for tiering all vendors into risk categories — Tier 1 (highest risk) through Tier 3 (lowest risk) — based on objective criteria including the sensitivity of data processed by the vendor, the volume of data processed, the level of system access granted to the vendor, and the criticality of the vendor's services

2. Deploy Continuous Security Monitoring for Tier 1 Vendors. Quorum should procure and deploy one or more third-party security rating and monitoring tools that provide continuous external visibility into Tier 1 vendors' security posture. These tools should, at a minimum, provide ongoing monitoring of vulnerability exposure, patching cadence, network hygiene, and publicly observable indicators of security risk. Alerts

3. Enhance Pre-Engagement Security Due Diligence. Quorum should enhance its pre-engagement security due diligence requirements for all prospective Tier 1 vendors. Before contract execution, Tier 1 vendor candidates should be required to provide, at a minimum: (a) a current SOC 2 Type II audit report with a report period ending no more than 12 months prior to the date of engagement; (b) results of a recent penetration

4. Quarterly Vendor Security Reviews for Tier 1 Vendors. Quorum should move from an annual to a quarterly security review cadence for all Tier 1 vendors. Quarterly reviews should include, at a minimum, review of the vendor's patching logs covering the preceding quarter, review of vulnerability scan results, an assessment of the vendor's incident response readiness, and discussion of any material changes to the vendor

5. Active Enforcement of Right-to-Audit Provisions. Quorum should actively and routinely exercise the right-to-audit provisions contained in its Tier 1 vendor agreements. Quorum should schedule annual on-site or virtual security assessments for all Tier 1 vendors, conducted by qualified internal or external assessors. Calderwood & Harkness notes that MSA Amendment 3 (executed October 27, 2023) now requires Palomar to

6. Establish a Cross-Functional Vendor Risk Committee. Quorum should establish a standing Vendor Risk Committee to provide governance oversight of Tier 1 vendor relationships and the vendor risk management program as a whole. The Committee should include representatives from the General Counsel's office (Thomas Whitfield or designee), the CISO (David Naranjo or designee), the CPO (Jennifer Liang or designee), the Ven

IV. Lessons Learned — Category 2: Contractual Protections and Enforcement A. Notification Window The 48-hour contractual notification window established in MSA Section 9.4 proved adequate in principle as a baseline requirement, providing Quorum with a reasonable expectation of timely notification in the event of a security incident. However, as discussed in Section II.C above, Palomar breached this obligation by appr

1. Standard 24-Hour Notification Window. Quorum should adopt a 24-hour incident notification requirement as the default standard for all Tier 1 vendor agreements. The notification obligation should be triggered upon the vendor's discovery of a confirmed or reasonably suspected security incident affecting Quorum data, and the notification should be directed to both the General Counsel and the CISO via pre-designated c

3. Enhanced Indemnification Terms. Quorum should review and, where commercially practicable, increase indemnification caps for Tier 1 data-processing vendors beyond the current 2× trailing twelve-month fee standard. Quorum should also negotiate carve-outs from general liability caps for data security breaches, ensuring that the costs of breach response, regulatory fines, class action settlements, and related expenses

4. Heightened Insurance Minimums. Quorum should increase minimum cyber liability coverage requirements to a range of $15 million to $25 million for Tier 1 vendors processing sensitive data on behalf of Quorum. Quorum should require additional insured status on all Tier 1 vendor cyber liability policies and require annual certificate of insurance delivery with prompt notice of any material change in coverage.

5. Mandatory Endpoint Detection and Response (EDR). Quorum should require all Tier 1 vendors to deploy and maintain endpoint detection and response ("EDR") solutions on all systems that process, store, or have access to Quorum data. This requirement is now applicable to Palomar under MSA Amendment 3 and should be extended to all Tier 1 vendor agreements. The EDR requirement should include a contractual obligation for

6. Periodic Contract Review Cadence. Quorum should establish a 12-month review cycle for all Tier 1 vendor agreements to ensure that data security exhibits, insurance requirements, indemnification provisions, and other risk-relevant contractual terms remain current with the evolving threat landscape, regulatory requirements, and Quorum's own security standards. Contract reviews should be coordinated between the Gener

V. Lessons Learned — Category 3: Incident Response Plan and Preparedness A. Incident Response Plan Activation Quorum's incident response plan was activated on May 4, 2023, when Calderwood & Harkness was engaged as outside counsel to lead the legal response to the incident. This engagement occurred approximately 13 days after Palomar's initial notification on April 21, 2023. The intervening period — April 21 through M

1. Semi-Annual Tabletop Exercise Program. Quorum should implement a semi-annual tabletop exercise program that simulates vendor-originated data breach scenarios of varying scope and complexity. Each exercise should be designed to test specific elements of the incident response plan, including internal escalation procedures, outside counsel and forensic vendor mobilization, regulatory notification decision-making, con

2. Pre-Negotiated Vendor Panels. Quorum should establish and maintain pre-negotiated retainer agreements with a panel of forensic investigation firms (such as Graystone Forensics LLC), notification vendors (such as Clearfield Notification Services LLC), and crisis communications firms (such as BrightPath Consulting Group, Inc.) to enable immediate engagement upon incident detection. Pre-negotiated retainers eliminate

3. Compressed Engagement Timeline Target. Quorum should establish an organizational target of engaging outside counsel within 72 hours of receiving a vendor breach notification for incidents involving Tier 1 vendors or incidents that, based on the vendor's initial notification, appear to involve a significant volume of records, PHI, or financial data. The current experience — 13 days between Palomar's April 21, 2023

4. Formalized Escalation Protocol. Quorum should develop and document a formal internal escalation protocol that defines the specific criteria triggering mandatory escalation to the full incident response team and engagement of outside counsel. Recommended escalation triggers include: (a) any vendor security incident involving more than 1,000 individual records; (b) any incident involving PHI; (c) any incident involv

5. Board Reporting Playbook. Quorum should formalize the cadence and content framework for Board Audit Committee briefings during active incident response, based on the model employed during this engagement. The playbook should specify: (a) an initial report to the Audit Committee Chair within 10 business days of outside counsel engagement, providing a factual summary of the incident, preliminary scope assessment, an

6. Privilege Protocol Template. Quorum should maintain a standing privilege protocol template, based on the May 5, 2023 Privilege Protocol Memo developed for this engagement, for immediate deployment in future incidents. The template should be pre-approved by the General Counsel and should include standard privilege legends, instructions for marking and channeling privileged communications and work product, protocols

VI. Lessons Learned — Category 4: Regulatory Notification and Compliance A. Multistate Notification Complexity The scope of this incident — 318,247 affected individuals spanning 29 states and the District of Columbia, with data types triggering obligations under multiple state breach notification statutes, the HIPAA Breach Notification Rule, and the Connecticut Insurance Data Security Law — generated a regulatory not

1. Maintain an Updated Notification Law Database. Quorum should invest in a continuously updated breach notification law database or subscription service to supplement the notification law survey work performed by outside counsel during active incident response. State data breach notification laws evolve frequently — multiple states amend their statutes each legislative session, and new requirements regarding notific

2. Pre-Built Notification Templates. Quorum should develop and maintain a library of pre-drafted notification letter templates for the most common data element combinations (PII only, PII plus financial data, PII plus PHI, PII plus financial data plus PHI) in the jurisdictions where Quorum has the highest concentrations of policyholders: Connecticut, New York, California, Texas, Florida, Pennsylvania, Illinois, New J

3. Regulatory Relationship Management. Quorum should consider proactive engagement with the Connecticut Insurance Department and other key state regulators regarding Quorum's cybersecurity program enhancements, outside of any incident context. Proactive engagement — such as participating in industry working groups, attending regulator-sponsored cybersecurity events, or scheduling informational briefings with key regu

4. HIPAA Compliance Program Review. Quorum should conduct a comprehensive review of its HIPAA compliance program, including a review of all business associate agreements ("BAAs") with vendors that process, store, or have access to PHI on behalf of Quorum. The review should ensure that all BAAs are current, contain the required provisions under 45 C.F.R. § 164.314(a), and are consistent with current HHS-OCR enforcemen

VII. Lessons Learned — Category 5: Data Minimization and Security Architecture A. Volume and Sensitivity of Data Shared with Vendors One of the most fundamental lessons of this incident is that the scope and severity of a vendor-originated breach are directly proportional to the volume and sensitivity of data accessible within the vendor's environment. Palomar processed data for 318,247 individuals, encompassing Soci

1. Comprehensive Data Minimization Review. Quorum should conduct a comprehensive review of all data elements shared with Tier 1 vendors, beginning with Palomar and extending to all other Tier 1 data-processing vendors. The review should identify specific opportunities to reduce the volume and sensitivity of data transferred to each vendor, evaluating whether Social Security numbers, full financial account numbers, gr