Contract analysis

1. PRIVILEGE DESIGNATION AND PURPOSE This Scope of Work and Investigation Plan (this "SOW") is prepared at the direction of Calderwood & Harkness LLP ("Calderwood & Harkness" or "Counsel"), outside counsel to Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation headquartered at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103, and publicly traded on the Nasdaq Stock Market under the ticke

2. BACKGROUND AND CONTEXT 2.1 The Client Quorum Insurance Holdings Corp. is a top-25 U.S. insurance holding company with operating subsidiaries licensed in all fifty states and the District of Columbia. Quorum reported annual revenue of approximately $4.82 billion for fiscal year 2022. The company employs approximately 11,400 individuals across its various operating entities and maintains a market capitalization of a

3. ENGAGEMENT OF GRAYSTONE FORENSICS LLC 3.1 Firm Overview Graystone Forensics LLC is a Virginia limited liability company headquartered at 1950 Old Gallows Road, Suite 600, Tysons Corner, VA 22182. Graystone specializes in cybersecurity incident response, digital forensics, threat intelligence, and expert advisory services for large enterprises, financial institutions, and their legal counsel. Graystone has conducte

4. SCOPE OF INVESTIGATION 4.1 Primary Objectives The forensic investigation to be conducted by Graystone under this SOW shall address the following primary objectives. These objectives are established by Counsel to support the provision of legal advice to Quorum regarding the data security incident, including analysis of regulatory notification obligations, contractual remedies against Palomar, litigation exposure, i

5. ACCESS AND COOPERATION REQUIREMENTS 5.1 Access to Palomar Systems and Data The successful completion of this forensic investigation requires Graystone to have timely and adequate access to Palomar's network environment, systems, and data. Specifically, Graystone will require access to the following Palomar resources, at a minimum: (a) Forensic images of the GoAnywhere MFT appliance(s) affected by the intrusion, in

6. DELIVERABLES AND REPORTING MILESTONES 6.1 Weekly Status Reports Graystone shall provide weekly written status reports to Alan Burke, with a copy to Kevin Ostrowski, summarizing the progress of the investigation, key findings to date, outstanding items, upcoming activities, and any access or cooperation issues encountered. The weekly status reports are intended to keep Counsel informed of the investigation's progre

7. INVESTIGATION METHODOLOGY Graystone shall employ the following investigative methodologies and techniques in conducting the forensic investigation. The specific tools, techniques, and analytical approaches employed may be adjusted by Graystone in the exercise of its professional judgment and in consultation with Counsel as the investigation progresses and new information becomes available. 7.1 Forensic Imaging and

8. COORDINATION WITH OTHER WORKSTREAMS The Graystone forensic investigation is one component of a broader, multi-workstream incident response effort being coordinated by Calderwood & Harkness on behalf of Quorum. Graystone's findings will inform and interface with several parallel workstreams as described below. Effective coordination across these workstreams is essential to a timely and comprehensive incident respon