Contract analysis

I. Executive Summary This memorandum analyzes the compliance obligations arising under the New York Department of Financial Services ("DFS") Cybersecurity Regulation, 23 NYCRR Part 500 (the "Regulation"), as they apply to Quorum Insurance Holdings Corp. ("Quorum" or the "Company") in connection with the proposed five-year, $60,000,000 Master Data License Agreement ("MDLA") with Meridian Credit intelligence, Inc. ("Me

II. Background on the Transaction and Data Flows A. Transaction Overview Quorum proposes to enter into a five-year MDLA with Meridian pursuant to which Quorum will license three data products from Meridian for use across its property and casualty ("P&C"), life, and specialty insurance lines. The licensed data will serve three primary business purposes: (i) enhancing Quorum's automated underwriting models, including t

III. Applicability of 23 NYCRR 500 to Quorum A. Quorum as a "Covered Entity" The threshold question in any analysis under 23 NYCRR 500 is whether the entity at issue qualifies as a "Covered Entity" subject to the Regulation's requirements. Section 500.01(e) of the Regulation defines "Covered Entity" as "any Person operating under or required to operate under a license, registration, charter, certificate, permit, accr

IV. Key 23 NYCRR 500 Requirements Applicable to the Meridian Data License This Section identifies and analyzes each provision of 23 NYCRR 500 that is material to the proposed transaction, explains its application to the Meridian data license, and sets forth our specific recommendations for contractual provisions to be included in the MDLA and DSA. A. Cybersecurity Program (Section 500.02)

Section 500.02 of the Regulation requires each Covered Entity to "maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the Covered Entity's Information Systems." The cybersecurity program must be based on the Covered Entity's risk assessment and must be designed to perform the following core functions: (a) identify and assess internal and external cybersecurity risks

Section 500.03 requires each Covered Entity to "implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity's board of directors (or an appropriate committee thereof) or equivalent governing body," setting forth the Covered Entity's policies and procedures for the protection of its Information Systems and Nonpublic Information. The cybersecurity policy must address, at a mi

Section 500.04 requires each Covered Entity to "designate a qualified individual responsible for overseeing and implementing the Covered Entity's cybersecurity program and enforcing its cybersecurity policy." This individual serves as the Covered Entity's Chief Information Security Officer ("CISO"). The CISO must report in writing at least annually to the Covered Entity's board of directors or equivalent governing bo

Section 500.05 requires each Covered Entity's cybersecurity program to include "monitoring and testing, developed in accordance with the Covered Entity's Risk Assessment, designed to assess the effectiveness of the Covered Entity's cybersecurity program." At a minimum, the Regulation requires: (a) annual penetration testing of the Covered Entity's Information Systems; and (b) bi-annual vulnerability assessments, incl

Section 500.06 requires each Covered Entity to implement audit trail systems that serve two distinct purposes: (a) Track and maintain data that allows for the complete and accurate reconstruction of all financial transactions and accounting sufficient to detect and respond to a Cybersecurity Event; these records must be maintained for not less than five years; and (b) Include audit trails designed to detect and respo

Section 500.07 requires each Covered Entity, as part of its cybersecurity program, to "limit user access privileges to Information Systems that provide access to Nonpublic Information" and to "periodically review such access privileges." Access privileges must be limited to those individuals who require such access for legitimate business purposes, consistent with the principle of least privilege. Application. The Me

Section 500.08 requires each Covered Entity's cybersecurity program to include "written procedures, guidelines and standards designed to ensure the use of secure development practices for in-house developed applications utilized by the Covered Entity," as well as procedures for "evaluating, assessing or testing the security of externally developed applications utilized by the Covered Entity within the context of the

Section 500.09 requires each Covered Entity to "conduct a periodic risk assessment of the Covered Entity's Information Systems sufficient to inform the design of the cybersecurity program as required by this Part." The risk assessment must be "carried out in accordance with written policies and procedures" and must allow for "revision of controls to respond to technological developments and evolving threats." The ris

I. Third-Party Service Provider Security Policy (Section 500.11) — Critical Provision

Section 500.11 is the most directly applicable provision of the Regulation to the proposed transaction. It addresses the cybersecurity risks arising from a Covered Entity's relationships with Third-Party Service Providers and imposes specific obligations regarding the management of those risks.

1. Classification of Meridian as a Third-Party Service Provider

Section 500.01(n) of the Regulation defines "Third-Party Service Provider" as: "a Person that (i) is not an Affiliate of the Covered Entity, (ii) provides services to the Covered Entity, and (iii) maintains, processes or otherwise is permitted access to Nonpublic Information through its provision of services to the Covered Entity." Analysis. Each element of this definition is satisfied with respect to Meridian: (i) N

2. Required Elements of the Third-Party Service Provider Policy

Section 500.11 requires each Covered Entity to implement "written policies and procedures designed to ensure the security of Information Systems and Nonpublic Information that are accessible to, or held by, Third-Party Service Providers." These policies and procedures must be based on the Covered Entity's risk assessment and must address, at a minimum, the following elements: (a) Identification and risk assessment of

3. Specific Contractual Requirements DFS has indicated, through published guidance and enforcement actions, that the contractual provisions required under Section 500.11 should address, at a minimum, the following elements: (a) Use of multi-factor authentication ("MFA") or reasonably equivalent or more secure access controls for any individual accessing the Covered Entity's Information Systems or Nonpublic Informatio

4. Recommended Contractual Provisions for the MDLA and DSA Based on the foregoing analysis, we recommend that the MDLA and DSA include the following provisions to satisfy Quorum's obligations under Section 500.11: Certification and Audit Requirements: • Require Meridian to maintain and annually renew its SOC 2 Type II certification and ISO 27001 certification throughout the entire five-year term of the MDLA, with no

Section 500.15 of the Regulation establishes specific encryption requirements for Nonpublic Information. These requirements apply both to data in transit and data at rest, and represent one of the more prescriptive provisions of the Regulation.

Section 500.15(a) requires each Covered Entity to implement controls, including encryption, to protect Nonpublic Information "held or transmitted by the Covered Entity both in transit over external networks and at rest." For Nonpublic Information in transit, each Covered Entity must "utilize effective encryption based on the Covered Entity's Risk Assessment." Application to Meridian Data Feeds. All Nonpublic Informat

Section 500.15(a) also requires encryption of Nonpublic Information at rest. All Nonpublic Information held or maintained by Quorum — including ingested Meridian data stored in data warehouses, analytical platforms, backup systems, and disaster recovery environments, as well as Derived Data that contains or is traceable to Nonpublic Information — must be encrypted at rest using industry-standard cryptographic algorit

Section 500.15(b) provides that to the extent a Covered Entity determines that encryption of Nonpublic Information in transit or at rest is infeasible, the Covered Entity may instead "secure such Nonpublic Information using effective alternative compensating controls reviewed and approved by the Covered Entity's CISO." Any such compensating controls must be "reviewed by the CISO at least annually." Recommendation. We

4. Recommended DSA Provisions The DSA should impose mutual encryption obligations on both parties: • Meridian: Encryption of all Nonpublic Information in its systems prior to delivery and during transmission to Quorum, using the standards specified above. • Quorum: Encryption of all Nonpublic Information upon receipt and while stored in Quorum's systems, including primary storage, backup storage, disaster recovery en

Section 500.16 requires each Covered Entity to "establish a written incident response plan designed to promptly respond to, and recover from, any Cybersecurity Event materially affecting the confidentiality, integrity or availability of the Covered Entity's Information Systems or the continuing functionality of any aspect of the Covered Entity's business or operations." The incident response plan must address, at a m

Section 500.17(a) of the Regulation requires each Covered Entity to "notify the superintendent as promptly as possible but in no event later than 72 hours from a determination that a Cybersecurity Event has occurred" that meets either of two criteria: (i) the Cybersecurity Event is of a nature that the Covered Entity is required to provide notice to any government body, self-regulatory agency, or any other supervisor

Section 500.13 requires each Covered Entity to "include policies and procedures for the secure disposal on a periodic basis of any Nonpublic Information identified in [Section 500.01(g)] that is no longer necessary for business operations or for other legitimate business purposes," subject to applicable legal record retention requirements. Application. Under the current draft of the MDLA, Quorum must return or destro