Contract analysis

1. GENERAL SECURITY OBLIGATIONS 1.1 Security Program. Clearpoint shall establish, implement, and maintain a comprehensive written information security program (the "Security Program") designed to protect Customer Data (as defined in the Agreement and in Exhibit C — Data Processing Addendum) against unauthorized access, use, disclosure, alteration, or destruction. The Security Program shall be commensurate with the na

2. ENCRYPTION STANDARDS 2.1 Encryption at Rest. All Customer Data stored by Clearpoint or its subprocessors, whether on primary storage systems, backup media, or any other storage medium, shall be encrypted at rest using the Advanced Encryption Standard with a minimum key length of 256 bits ("AES-256") or an equivalent or stronger encryption algorithm approved by the National Institute of Standards and Technology ("N

3. ACCESS CONTROLS 3.1 Authentication. Clearpoint shall implement multi-factor authentication ("MFA") for all administrative and privileged access to systems hosting or processing Customer Data. MFA shall require at least two distinct authentication factors (e.g., something the user knows and something the user possesses). User authentication for the ClaimsIQ™ platform shall support integration with Quorum's enterpri

4. NETWORK AND INFRASTRUCTURE SECURITY 4.1 Firewalls and Intrusion Detection. Clearpoint shall deploy and maintain firewalls, intrusion detection systems ("IDS"), and intrusion prevention systems ("IPS") to protect the network perimeter and internal network segments hosting the ClaimsIQ™ platform and processing Customer Data. Firewall rules and IDS/IPS signatures shall be reviewed and updated on a regular basis and i

5. SECURITY AUDITS AND ASSESSMENTS 5.1 SOC 2 Type II Audit Clearpoint shall engage an independent, nationally recognized certified public accounting firm to conduct an annual SOC 2 Type II audit of the ClaimsIQ™ platform and related systems. The audit shall cover the AICPA Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy. As of the Effective Date, Clearpoint's cur

6. SECURITY INCIDENT RESPONSE AND NOTIFICATION 6.1 Incident Response Plan. Clearpoint shall maintain a written security incident response plan (the "Incident Response Plan") that defines roles and responsibilities, escalation procedures, communication protocols, evidence preservation procedures, and remediation processes. The Incident Response Plan shall be tested at least annually through tabletop exercises, simulat

7. BUSINESS CONTINUITY AND DISASTER RECOVERY 7.1 BCP/DR Plan. Clearpoint shall maintain documented business continuity and disaster recovery plans (collectively, the "BCP/DR Plans") for the ClaimsIQ™ platform that are designed to ensure the continued availability and integrity of Customer Data and the platform in the event of a disruption, including without limitation natural disasters, infrastructure failures, cyber

8. PERSONNEL SECURITY AND TRAINING 8.1 Security Awareness Training. Clearpoint shall provide annual security awareness training to all employees and contractors with access to Customer Data. Training shall cover, at a minimum, the following topics: (a) proper handling and protection of sensitive data, including PII and PHI; (b) recognition and reporting of phishing, social engineering, and other cyber threats; (c) in

9. INSURANCE REQUIREMENTS 9.1 Required Coverages. Throughout the Term of the Agreement, Clearpoint shall obtain and maintain the following insurance coverages with financially sound and reputable insurers rated no lower than "A-" (Excellent) by A.M. Best Company: (a) Commercial General Liability ("CGL") Insurance: Not less than Five Million Dollars ($5,000,000) per occurrence and Ten Million Dollars ($10,000,000) in

10. PHYSICAL SECURITY 10.1 Data Center Controls. Clearpoint shall ensure that data center facilities operated by Cobalt Cloud Infrastructure, Inc. or any other hosting subprocessor engaged in connection with the ClaimsIQ™ platform maintain physical security controls that are no less protective than the following minimum requirements: (a) On-Site Security: 24/7 on-site security personnel, security patrols, or continuo

11. SECURE DEVELOPMENT PRACTICES 11.1 Secure Software Development Lifecycle. Clearpoint shall maintain a documented secure software development lifecycle ("SDLC") for the ClaimsIQ™ platform that incorporates security at each phase of the development process. The SDLC shall include, at a minimum: (a) Security Requirements Analysis: Identification and documentation of security requirements during the design phase of ea

12. DATA DISPOSAL 12.1 Secure Disposal. Upon expiration or termination of the Agreement, and following the completion of the data export obligations set forth in Exhibit C (Data Processing Addendum) — specifically, the full export of Customer Data in ACORD XML and CSV formats within sixty (60) days of the effective date of expiration or termination — Clearpoint shall securely destroy all copies of Customer Data in it

13. COMPLIANCE WITH APPLICABLE LAWS 13.1 Clearpoint shall comply with all applicable federal, state, and local laws, rules, and regulations relating to data security and privacy in connection with its performance under the Agreement, including without limitation: (a) the Connecticut Data Privacy Act, Conn. Gen. Stat. § 42-515 et seq. (the "CTDPA"); (b) the Health Insurance Portability and Accountability Act of 1996 (

14. MODIFICATIONS AND UPDATES 14.1 Updates to Security Requirements. Quorum may propose reasonable updates to the security requirements set forth in this Exhibit D from time to time to reflect changes in applicable law, regulatory guidance, industry standards, or the evolving threat landscape. Any such proposed updates shall be submitted to Clearpoint in writing. The parties shall negotiate any such updates in good f

15. SURVIVAL 15.1 The obligations set forth in this Exhibit D relating to the protection, disposal, and certification of destruction of Customer Data (including, without limitation, Sections 2, 6, 10, 12, and 13), and Quorum's audit rights under Section 5.3, shall survive any expiration or termination of the Agreement for a period of two (2) years or until Clearpoint has provided the certification of destruction of a