Contract analysis

I. Introduction and Purpose The purpose of this Exhibit D is to provide the Multistate Attorney General Coalition (the "Coalition") with a comprehensive overview of the information security program maintained by Quorum Insurance Holdings Corp. ("Quorum" or the "Company"). This overview addresses the governance framework, technical and administrative safeguards, vendor risk management practices, incident response capa

II. Information Security Governance Structure Quorum's information security program operates within a governance framework designed to ensure that cybersecurity risk receives appropriate attention at the highest levels of the organization, that accountability is clearly defined, and that information flows effectively between technical practitioners, executive leadership, and the Board of Directors. The governance str

III. Information Security Program Framework A. Program Foundation and Standards Alignment Quorum's information security program is built upon, and designed in alignment with, recognized industry frameworks and standards. The Company's program draws principally from the following frameworks: • NIST Cybersecurity Framework (CSF): Quorum utilizes the NIST CSF as the foundational organizing framework for its information

IV. Technical Safeguards Quorum's information security program incorporates a defense-in-depth approach, employing multiple layers of technical safeguards to protect the Company's information assets, detect threats, and support rapid response to security incidents. The principal categories of technical controls deployed by Quorum are described below. A. Network Security Quorum maintains a multi-layered network archit

V. Vendor Risk Management Program A. Program Overview Quorum's Vendor Risk Management Program (the "VRM Program") is a comprehensive, risk-based program designed to assess, manage, and monitor the cybersecurity and data protection risks associated with the Company's third-party vendor relationships. The VRM Program is led by Priya Deshmukh, VP, Vendor Risk Management, and operates under the oversight of the CISO, Dav

VI. Incident Response Program A. Incident Response Plan Quorum maintains a formal, documented Incident Response Plan ("IRP") that defines the Company's procedures for detecting, reporting, escalating, containing, investigating, and remediating security incidents. The IRP is designed to enable a rapid, coordinated, and effective response to security events of all types and severity levels, from minor security alerts t

VII. Employee Training and Awareness Quorum recognizes that its employees are a critical line of defense in the protection of Company and policyholder data. The Company maintains a comprehensive information security and privacy awareness training program designed to equip all employees with the knowledge and skills necessary to identify, prevent, and report security threats. Annual Training Requirement. All Quorum em

VIII. Regulatory Compliance Quorum's information security program is designed to comply with the numerous federal and state regulatory requirements applicable to the Company and its operating subsidiaries. As a large, diversified insurance holding company conducting business in all fifty states and the District of Columbia, Quorum is subject to an extensive and evolving body of data protection and privacy regulation.

IX. Post-Incident Enhancements Following the Palomar data breach incident, Quorum undertook a comprehensive review of its information security program and vendor risk management practices to identify opportunities for enhancement. While Quorum believes that its pre-incident security program was robust and commensurate with industry standards, the Company recognizes that continuous improvement is essential in the face