Contract analysis

ARTICLE 1 — DEFINITIONS 1.1 "Authorized Personnel." "Authorized Personnel" means employees, contractors, and agents of either Party who (a) have been granted access to Licensed Data or Confidential Information in connection with the performance of their duties under the MDLA or this DSA, (b) have undergone the background checks required by Section 5.6 of this DSA, and (c) have completed the security awareness trainin

ARTICLE 2 — SCOPE AND APPLICABILITY 2.1 Scope. This DSA applies to all Licensed Data received, transmitted, stored, processed, accessed, or otherwise handled by either Party or its Sub-processors in connection with the MDLA. Without limiting the generality of the foregoing, this DSA governs the security obligations applicable to Licensed Data delivered via Meridian's SFTP batch transfer systems, Meridian's REST API (

ARTICLE 3 — INFORMATION SECURITY PROGRAM REQUIREMENTS 3.1 General Obligation. Each Party shall establish, implement, and maintain a comprehensive, written Information Security Program that includes designed to: (a) protect the confidentiality, integrity, and availability of Licensed Data; (b) protect against any anticipated threats or hazards to the security or integrity of Licensed Data; (c) protect against unauthor

ARTICLE 4 — SECURITY CERTIFICATIONS AND AUDIT REPORTS 4.1 Meridian Certifications. Meridian shall obtain and maintain, at a minimum, the following certifications and reports throughout the term of the MDLA: (a) SOC 2 Type II Report. A SOC 2 Type II report prepared by an independent certified public accounting firm in accordance with AICPA attestation standards. Meridian's most recent SOC 2 Type II report was issued b

ARTICLE 5 — ACCESS CONTROLS 5.1 Principle of Least Privilege. Each Party shall restrict access to Licensed Data to Authorized Personnel on a need-to-know, least-privilege basis. Access to Licensed Data shall be limited to the minimum level of access necessary for each individual to perform his or her assigned duties in connection with the MDLA. No individual shall be granted access to Licensed Data in excess of what

ARTICLE 6 — ENCRYPTION REQUIREMENTS 6.1 Data in Transit. All Licensed Data transmitted between the Parties — whether via SFTP batch transfer, REST API, or any other electronic delivery method — shall be encrypted using Transport Layer Security ("TLS") version 1.2 or higher, or an equivalent or successor cryptographic protocol providing an equivalent or greater level of security, with a minimum key length of 256 bits.

ARTICLE 7 — NETWORK SECURITY AND SYSTEM HARDENING 7.1 Network Segmentation. Each Party shall implement network segmentation to isolate systems, applications, and environments that store, process, or transmit Licensed Data from other network segments, including general corporate networks, development and testing environments, and guest or public-facing networks. Segmentation shall be enforced using firewalls, virtual

ARTICLE 8 — PENETRATION TESTING 8.1 Annual Testing. Each Party shall engage a qualified, independent third-party security firm to conduct penetration testing of the systems, applications, and infrastructure that store, process, or transmit Licensed Data at least once per calendar year. The third-party security firm shall possess recognized certifications (e.g., CREST, OSCP, GPEN) and shall have no material business r

ARTICLE 9 — DATA BREACH NOTIFICATION AND INCIDENT RESPONSE 9.1 Notification Obligation — 48 Hours. In the event either Party discovers or reasonably suspects a Data Breach or Security Incident affecting Licensed Data, that Party (the "Notifying Party") shall notify the other Party (the "Receiving Party") in writing within forty-eight (48) hours of the Notifying Party's discovery of the Data Breach or Security Inciden

ARTICLE 10 — SUB-PROCESSOR MANAGEMENT 10.1 Pre-Approval Requirement. Neither Party shall engage, appoint, or authorize a Sub-processor that will have access to, receive, process, store, or transmit Licensed Data without the prior written consent of the other Party. Such consent shall not be unreasonably withheld, conditioned, or delayed. A request for consent shall include the identity of the proposed Sub-processor,

ARTICLE 11 — PHYSICAL SECURITY 11.1 Data Center Security. All data centers, server rooms, co-location facilities, and other physical facilities where Licensed Data is stored, processed, or from which Licensed Data is accessed (collectively, "Secured Facilities") shall be secured with, at a minimum, the following physical security controls: (a) Restricted Access — Entry to Secured Facilities shall be restricted to Aut

ARTICLE 12 — DATA RETENTION AND RETURN/DESTRUCTION 12.1 Retention During Term. Each Party may retain Licensed Data only for so long as reasonably necessary to fulfill the purposes set forth in the MDLA and this DSA, and subject to applicable legal and regulatory retention requirements. Each Party shall implement and maintain data retention schedules that specify retention periods for Licensed Data and shall ensure th

ARTICLE 13 — AUDIT RIGHTS 13.1 Right to Audit. Each Party (the "Auditing Party") shall have the right, upon not less than thirty (30) days' prior written notice, to audit the other Party's (the "Audited Party's") compliance with this DSA. Audits may include review and examination of: (a) information security policies, procedures, and controls; (b) SOC 2 Type II reports, ISO 27001 certifications, and other security as

ARTICLE 14 — BUSINESS CONTINUITY AND DISASTER RECOVERY 14.1 BC/DR Plans. Each Party shall develop, implement, and maintain comprehensive written business continuity and disaster recovery plans ("BC/DR Plans") that address the recovery and restoration of all systems, applications, and infrastructure that store, process, or transmit Licensed Data. BC/DR Plans shall be designed to ensure the continued availability and i

ARTICLE 15 — INSURANCE REQUIREMENTS 15.1 Meridian Insurance Minimums. Throughout the term of the MDLA, including any renewal periods, Meridian shall procure and maintain the following insurance coverages with financially sound and reputable insurance carriers reasonably acceptable to Quorum (maintaining an A.M. Best rating of A- (Excellent) VII or better): (a) Commercial General Liability Insurance: With limits of no