Contract analysis

I. QUORUM'S VENDOR OVERSIGHT AND THIRD-PARTY RISK MANAGEMENT PROGRAM A. Organizational Structure and Governance Quorum maintains a dedicated vendor risk management function that is integrated into its broader enterprise risk management framework. The vendor risk management program is led by Priya Deshmukh, Vice President of Vendor Risk Management, who reports directly to Thomas R. Whitfield, Quorum's General Counsel.

1. A comprehensive review of the vendor's information security policies and procedures, including its written information security program ("WISP"), acceptable use policies, access control policies, incident response plan, and business continuity and disaster recovery plans;

2. A review of recent penetration test results conducted by a qualified independent third party, with particular attention to the identification and remediation of critical and high-severity findings;

3. A review of the vendor's most recent SOC 2 Type II audit report (where available) or equivalent independent assurance documentation;

4. An evaluation of the vendor's cyber-liability insurance coverage, including policy limits, coverage scope, and named insured entities;

5. A standardized security questionnaire administered by Quorum's Information Security team, covering topics including network security architecture, data encryption practices, patch management procedures, vulnerability management, access control mechanisms, logging and monitoring capabilities, employee security awareness training, and incident response preparedness; and

6. Where circumstances warrant, an on-site or virtual assessment conducted by Quorum's Information Security team or a qualified third-party assessor engaged by Quorum. In the case of Palomar, the pre-engagement due diligence process was completed in the third and fourth quarters of 2019, prior to the execution of the Master Services Agreement on November 12, 2019. At that time, the pre-engagement assessment did not i

II. PALOMAR MSA DATA SECURITY AND CONTRACTUAL PROVISIONS A. Master Services Agreement Overview The relationship between Quorum and Palomar is governed by a Master Services Agreement (the "MSA") executed on November 12, 2019, with an initial term of five years expiring on November 11, 2024. Palomar Data Solutions, Inc. is a Texas corporation (EIN: 75-3291048) headquartered at 7100 Greenville Avenue, Suite 450, Dallas,

Section 9.4 of the MSA imposed a contractual obligation on Palomar to notify Quorum within forty-eight (48) hours of discovering a security incident that affected, or was reasonably believed to affect, the confidentiality, integrity, or availability of Quorum data. The notification was required to be provided in writing to Quorum's General Counsel and Chief Information Security Officer and was required to include, to

Section 12.2 of the MSA provides that Palomar shall defend, indemnify, and hold harmless Quorum and its affiliates, officers, directors, employees, and agents from and against any and all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to Palomar's breach of its data security obligations under the MSA, including the obligations set forth in Exhibit D

Section 14.2 of the MSA provides that either party may terminate the MSA upon the material breach of the agreement by the other party, provided that the non-breaching party provides written notice of the breach and the breaching party fails to cure the breach within thirty (30) calendar days of receiving such notice. Palomar's failure to comply with the critical vulnerability patching requirement and the breach notif

III. INCIDENT SUMMARY AND CONNECTICUT-SPECIFIC IMPACT A. Incident Timeline Recap The following timeline summarizes the key events associated with the cybersecurity incident, drawing upon the findings of the forensic investigation conducted by Graystone Forensics LLC ("Graystone") under the direction and supervision of Calderwood & Harkness: March 14, 2023: A threat actor exploited CVE-2023-0669, a remote code executi

IV. POST-INCIDENT REMEDIATION MEASURES A. Quorum's Internal Remediation In the wake of the cybersecurity event, Quorum has undertaken a comprehensive review and enhancement of its vendor risk management procedures, internal monitoring capabilities, and incident response preparedness. These remediation measures reflect Quorum's commitment to incorporating the lessons learned from this incident into its ongoing risk ma

V. CYBER-INSURANCE COVERAGE Quorum maintains a robust cyber-liability insurance program that was in full force and effect at the time of the incident. The program was placed by Whitmore Risk Advisors Inc., a specialty insurance brokerage based in New York, New York (Lead Broker: Sandra Whitmore-Kim), and consists of primary and excess layers of coverage as follows: Primary Layer: • Insurer: Atlas Mutual Insurance Com

VI. CONCLUSION AND COOPERATION Quorum Insurance Holdings Corp. respectfully submits that this supplemental response, together with the initial notification filed on August 14, 2023, and the initial inquiry response submitted on September 22, 2023, provides the Connecticut Insurance Department with a comprehensive and transparent account of the cybersecurity event, Quorum's vendor oversight framework, the contractual