Contract analysis

1. Introduction and Purpose of Retention Calderwood & Harkness LLP ("C&H" or "the Firm") writes on behalf of its client, Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker: QIHC), with its principal offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. C&H has been retained by Quorum to provide legal counsel in c

2. Background of the Incident On or about March 14, 2023, a threat actor is believed to have gained unauthorized access to the network environment of Palomar Data Solutions, Inc. by exploiting a known remote code execution vulnerability, identified in the National Vulnerability Database as CVE-2023-0669, present in Palomar's GoAnywhere MFT managed file transfer appliance. CVE-2023-0669 is a pre-authentication command

3. Scope of Engagement Graystone is retained to perform the following categories of services at the direction, and under the supervision, of C&H counsel. The scope of the engagement may be modified, expanded, or narrowed by C&H in writing from time to time as the investigation progresses and as additional information becomes available. Graystone shall not undertake work outside the scope described herein, or as subse

4. Reporting and Deliverables All reports, findings, analyses, communications, and work product prepared by Graystone in connection with this engagement shall be directed exclusively to Calderwood & Harkness LLP — specifically to Kevin Ostrowski, Partner, and Alan Burke, Associate — and shall not be transmitted directly to Quorum Insurance Holdings Corp., Palomar Data Solutions, Inc., or any other person or entity wi

5. Attorney-Client Privilege and Work Product Protection The parties acknowledge that the protection of the attorney-client privilege and the work product doctrine is of paramount importance to this engagement. The following provisions are intended to establish and preserve those protections throughout the engagement and thereafter. Graystone is retained as a consulting expert at the direction of counsel, Calderwood

6. Engagement Team 6.1 Calderwood & Harkness LLP Contacts The following C&H attorneys shall serve as the primary points of contact for this engagement: Kevin Ostrowski, Partner, Privacy & Data Security — Responsible Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7418 Email: kostrowski@calderwoodharkness.com Alan Burke, Associate, Privacy & Data Security — Lea

7. Coordination with Quorum Personnel All coordination between Graystone and Quorum Insurance Holdings Corp. personnel shall be conducted through, or at the express direction of, Calderwood & Harkness LLP counsel. Graystone shall not initiate contact with any Quorum employee, officer, director, or other representative without first obtaining authorization from C&H. C&H may, from time to time, authorize direct technic

8. Fees and Billing Graystone shall invoice Calderwood & Harkness LLP — not Quorum Insurance Holdings Corp. directly — for all professional fees, costs, and expenses incurred in connection with this engagement, in accordance with the fee schedule attached hereto as Exhibit A or as separately agreed in writing between C&H and Graystone. In the event of any conflict between the terms of this letter and the terms of any

9. Confidentiality Graystone shall maintain the strict confidentiality of all information received, developed, or generated in connection with this engagement. This obligation of confidentiality applies to all information concerning the Incident, Quorum Insurance Holdings Corp., Palomar Data Solutions, Inc., the investigation, the findings and conclusions of the investigation, and any other matter related to this eng

10. Document and Evidence Preservation Graystone shall preserve all evidence, data, notes, analyses, logs, forensic images, memory captures, network packet captures, correspondence, and other materials collected or generated during the investigation in accordance with forensic best practices, including but not limited to the standards and guidelines published by the National Institute of Standards and Technology (NIS

11. No Testimony or Public Statements Graystone shall not provide testimony — whether by deposition, declaration, affidavit, hearing, trial, regulatory proceeding, or otherwise — regarding this engagement or any findings, analyses, or conclusions developed in connection with this engagement, without the prior written consent of Calderwood & Harkness LLP. In the event that C&H authorizes any such testimony, C&H and Gr

12. Term and Termination This engagement shall commence on the Effective Date and shall continue until terminated by C&H in writing. The engagement is project-based in nature and is expected to conclude upon the delivery of the Final Forensic Investigation Report and the completion of any additional tasks requested by C&H. Either party may terminate this engagement upon thirty (30) days' prior written notice to the o

13. Limitation of Liability and Indemnification Each party's aggregate liability to the other party for any claims, damages, losses, costs, or expenses arising out of or relating to this engagement shall not exceed the total fees paid by C&H to Graystone under this engagement, except that this limitation shall not apply to claims arising from a party's willful misconduct, gross negligence, or breach of its confidenti

14. Governing Law This retention letter and all matters arising out of or relating to this engagement, including any disputes between C&H and Graystone regarding the terms, performance, or termination of the engagement, shall be governed by and construed in accordance with the laws of the Commonwealth of Virginia, without regard to its conflict-of-laws principles.

15. Acceptance We ask that Dr. Briggs countersign this letter in the space provided below and return one fully executed copy to Kevin Ostrowski at Calderwood & Harkness LLP to confirm Graystone's acceptance of the engagement and the terms and conditions set forth herein. This letter, together with any attachments and exhibits referenced herein, constitutes the entire agreement between Calderwood & Harkness LLP and Gr