Contract analysis

Section 1: Parties 1.1 Claimant / Indemnified Party Quorum Insurance Holdings Corp. ("Quorum"), a corporation organized and existing under the laws of the State of Delaware, with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103 (Nasdaq: QIHC; Employer Identification Number: 06-4832197). Quorum is a publicly traded specialty insurance holding company with perso

Section 2: Recitals / Background 2.1 The Master Services Agreement The Parties entered into that certain Master Services Agreement dated November 12, 2019 (the "MSA"), pursuant to which Palomar agreed to provide certain claims data processing, enterprise document management, and analytics services to Quorum's personal lines insurance division. The MSA was executed for an original five-year term commencing on November

Section 3: Quorum's Claimed Losses 3.1 Total Incident Response Costs Quorum has incurred significant costs in responding to the Security Incident, including forensic investigation, regulatory notification and consumer credit monitoring, crisis communications, legal advisory fees, and internal IT remediation and related operational costs. The table below sets forth an itemized summary of Quorum's total incident respon

Section 4: Proposed Settlement Terms 4.1 Cash Payment Palomar shall pay to Quorum a lump-sum cash payment of Five Million Five Hundred Thousand Dollars ($5,500,000) (the "Cash Payment") within thirty (30) calendar days of the date of execution of the definitive settlement agreement by both Parties. The Cash Payment shall be made by wire transfer of immediately available funds to a bank account designated by Quorum in

Section 5: Enhanced Data Security Requirements In addition to the financial terms set forth in Section 4, Quorum requires that Palomar implement the following enhanced data security measures to reduce the risk of future security incidents and to strengthen the protections afforded to Quorum data processed, stored, or transmitted by Palomar. These enhanced requirements are a material component of the proposed settleme

Section 6: Mutual Release 6.1 Scope of Release Upon (i) execution of the definitive settlement agreement by both Parties, and (ii) Palomar's timely remittance of the Cash Payment in accordance with Section 4.1, each Party shall release, remise, and forever discharge the other Party, and its respective affiliates, subsidiaries, parent companies, officers, directors, employees, agents, attorneys, successors, and assign

Section 7: Confidentiality 7.1 Confidentiality of Settlement Terms The terms of the settlement, including without limitation the amount of the Cash Payment, the terms and duration of the fee reduction, the aggregate settlement recovery, and the specific enhanced data security requirements, shall be treated as strictly confidential and shall not be disclosed by either Party to any third party, except in the following

Section 8: Continuation of MSA 8.1 MSA Remains in Effect The Parties confirm and agree that the MSA, as amended by Amendment 1, Amendment 2, and the proposed Amendment 3 (to be executed contemporaneously with the definitive settlement agreement), shall remain in full force and effect for the remainder of its term through November 11, 2024, and shall continue to govern the Parties' commercial relationship, service del

Section 9: Insurance Coordination 9.1 No Double Recovery The Parties acknowledge that Quorum has submitted a claim under its own cyber-liability insurance program in connection with the Security Incident. The relevant policies and claim information are as follows: Primary Policy: Atlas Mutual Insurance Company, Cyber Liability Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892. Excess Policy: Pinnacle Surplus L

Section 10: Definitive Documentation 10.1 Documents to be Executed The Parties anticipate that the following definitive documents will be negotiated, finalized, and executed to implement the settlement terms described herein: (a) Settlement Agreement and Mutual Release — A comprehensive settlement agreement incorporating all financial terms, release provisions, confidentiality obligations, insurance coordination prov

Section 11: Non-Binding Nature of Term Sheet This term sheet is intended solely to facilitate settlement discussions between the Parties and does not constitute a binding agreement between the Parties. Neither Party shall be bound by any term set forth herein unless and until the Parties negotiate, finalize, and execute a definitive settlement agreement containing mutually acceptable terms. Until such time, either Pa

1. Patch Management Critical vulnerability patches (CVSS 9.0+ or vendor-designated "critical") shall be applied within fourteen (14) calendar days of vendor patch release, reduced from the current thirty (30) day requirement under Exhibit D (as amended by Amendment 2). Palomar shall deploy automated patch management tools for all internet-facing systems and managed file transfer appliances. Compliance with the enhanc

2. Endpoint Detection and Response (EDR) Palomar shall deploy enterprise-grade EDR solutions across all systems that process, store, or transmit Quorum data. Deployment shall be completed within ninety (90) days of execution of Amendment 3. The EDR solution shall provide real-time threat detection, automated alerting, incident response workflow support, and forensic data retention capabilities.

3. Quarterly Vulnerability Scanning Palomar shall conduct vulnerability scans of all in-scope systems on a quarterly basis. Written Vulnerability Scan Reports shall be provided to Quorum's CISO (currently David Naranjo) and Quorum's VP, Vendor Risk Management (currently Priya Deshmukh) within fifteen (15) business days of each quarterly scan. The first scan shall be completed within thirty (30) days of execution of A

4. Independent Third-Party Security Assessment Palomar shall engage, at its sole expense, an independent third-party security assessor, mutually agreed upon by the Parties, to conduct an enhanced annual security assessment of Palomar's information security program as it relates to Quorum data. Full assessment reports shall be provided to Quorum's VP, Vendor Risk Management within thirty (30) calendar days of completi

5. Incident Notification The security incident notification window shall be reduced from forty-eight (48) hours to twenty-four (24) hours from Palomar's discovery of any security incident affecting Quorum data. Notification shall be provided simultaneously to: • Quorum's General Counsel (currently Thomas R. Whitfield) • Quorum's Chief Information Security Officer (currently David Naranjo) Notification shall be made b