1022-00008 · Northgate Telecommunications PLC · Transaction Documents

exhibit-e-data-security-privacy.docx DOCUMENT M&A / Corporate

33 / 38 ← → ✕

Contract analysis Extract to table

EXHIBIT E

DATA SECURITY AND PRIVACY REQUIREMENTS

Exhibit E to the Master Services Agreement dated June 9, 2023 (the "Agreement")

Parties:

Northgate Americas, Inc., a Delaware corporation ("Customer")

and

Cedarpoint Systems Integration, Inc., a Delaware corporation ("Service Provider")

This Exhibit E is attached to and incorporated by reference into the Master Services Agreement dated June 9, 2023 between Customer and Service Provider (the "Agreement"). This Exhibit E sets forth the data security and privacy requirements applicable to Service Provider's performance of the Services under the Agreement and all Statements of Work issued thereunder. Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement.

Section 1 — Definitions

1.1 "Customer Data" means all data, information, content, records, and files provided by or on behalf of Customer, transmitted over the managed network, processed through the ArcMesh platform (version 4.2), or otherwise accessed by Service Provider in connection with the Services, including but not limited to network traffic data, configuration data, user credentials, device identifiers, performance metrics, routing tables, firewall rules, and any personally identifiable information. Customer Data shall include data in all forms, whether structured or unstructured, and regardless of the medium in which it is stored or transmitted.

1.2 "Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable data protection laws, including any information that alone or in combination with other information can be used to identify, contact, or locate a natural person. For the avoidance of doubt, Personal Data includes names, addresses, telephone numbers, email addresses, employee identification numbers, social insurance numbers, social security numbers, IP addresses, device identifiers, and any other information classified as "personal information," "personally identifiable information," or an equivalent term under Applicable Data Protection Laws.

1.3 "Security Incident" means any unauthorized access to, acquisition of, use of, disclosure of, or loss of Customer Data, including any compromise of Service Provider's systems, networks, or the ArcMesh platform that results in or reasonably could result in the exposure of Customer Data. A Security Incident also includes any event that constitutes a "security breach," "data breach," or equivalent term under Applicable Data Protection Laws, as well as any unauthorized intrusion into Service Provider Systems, whether or not Customer Data is confirmed to have been accessed or exfiltrated.

1.4 "Applicable Data Protection Laws" means all federal, state, provincial, and international laws, regulations, and regulatory guidance applicable to the processing, storage, and transmission of Customer Data, including without limitation: (a) applicable United States state data breach notification laws and state data privacy statutes; (b) the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) and any applicable provincial privacy legislation, including the Freedom of Information and Protection of Privacy Act (Manitoba), the Personal Information Protection Act (Alberta), and the Act Respecting the Protection of Personal Information in the Private Sector (Québec), to the extent applicable; (c) any applicable regulations, orders, or guidance issued by the Federal Communications Commission ("FCC"); (d) any applicable regulations, orders, or guidance issued by the Canadian Radio-television and Telecommunications Commission ("CRTC"); and (e) any other applicable law, regulation, or binding guidance relating to the security, privacy, or protection of data.

1.5 "Authorized Personnel" means Service Provider employees, contractors, and agents who (a) have a documented need to access Customer Data in order to perform the Services, and (b) have undergone the vetting, background checks, and training required under Section 5 of this Exhibit E. For the avoidance of doubt, no individual who has not satisfied the requirements of Section 5 shall be deemed Authorized Personnel.

1.6 "Service Provider Systems" means all hardware, software, networks, facilities, and infrastructure used by Service Provider in connection with the performance of the Services, including without limitation the Network Operations Centers located at 11400 Commerce Park Drive, Suite 600, Reston, VA 20191, United States (the "Reston NOC" or "primary NOC") and 200 Portage Avenue, Suite 1500, Winnipeg, MB R3C 3X2, Canada (the "Winnipeg NOC" or "secondary NOC"), as well as all servers, storage devices, management consoles, monitoring platforms, and networking equipment operated by Service Provider or its approved subcontractors in connection with the Services.

Section 2 — Data Handling Standards

2.1 General Obligation. Service Provider shall implement and maintain administrative, technical, and physical safeguards designed to protect Customer Data against unauthorized access, use, disclosure, alteration, or destruction, consistent with industry best practices applicable to managed network services and software-defined wide area network ("SD-WAN") platforms. Such safeguards shall be no less protective than the safeguards Service Provider applies to its own confidential information of a similar nature and sensitivity. Service Provider acknowledges that Customer Data is among the most sensitive categories of information entrusted to Service Provider and that the unauthorized disclosure or compromise of Customer Data could cause significant harm to Customer's business operations, regulatory standing, and reputation.

2.2 Information Security Program. Service Provider shall establish and maintain a comprehensive written information security program ("ISP") that is reasonably designed to protect the confidentiality, integrity, and availability of Customer Data. The ISP shall include, at a minimum, the following components:

(a) Risk assessments conducted at least annually, and more frequently as warranted by material changes to Service Provider Systems or the threat landscape, to identify and evaluate internal and external risks to the security of Customer Data;

(b) Documented security policies and procedures addressing, without limitation, data classification, access control, encryption, vulnerability management, patch management, change management, physical security, incident response, and acceptable use;

(c) A documented incident response plan that defines roles and responsibilities, escalation procedures, communication protocols, and forensic investigation procedures in the event of a Security Incident;

(d) Business continuity and disaster recovery plans, as further described in Section 12 of this Exhibit E, covering Service Provider Systems and the Services; and

(e) A process for periodic review and update of the ISP to address evolving threats, technological changes, and changes in Applicable Data Protection Laws.

2.3 Minimum Framework Standards. Service Provider's information security program shall be aligned with ISO/IEC 27001:2022, or a substantially equivalent internationally recognized framework, such as the AICPA SOC 2 Type II trust services criteria or the NIST Cybersecurity Framework (version 1.1 or later). Service Provider shall be prepared to demonstrate such alignment through third-party certifications, independent audit reports, or other verifiable evidence upon Customer's request. In the event that Service Provider transitions from one framework to another, Service Provider shall provide Customer with at least sixty (60) days' prior written notice and shall ensure that the replacement framework provides a level of protection no less protective than the framework being replaced.

2.4 Data Classification. Service Provider shall classify Customer Data according to sensitivity levels (e.g., "Restricted," "Confidential," "Internal") and shall apply commensurate administrative, technical, and physical protections to each classification level. At a minimum, all network traffic data, configuration data, user credentials, and routing information shall be classified and treated as "Confidential" or higher. Personal Data shall be classified as "Restricted" and shall receive the highest level of protection afforded under Service Provider's data classification scheme.

2.5 Segregation. Customer Data shall be logically segregated from the data of Service Provider's other clients at all times. Service Provider shall not commingle Customer Data with third-party data in shared databases, shared storage environments, or shared processing environments in a manner that would permit unauthorized cross-access. Service Provider shall implement and maintain appropriate technical controls, including access control lists, tenant isolation mechanisms, and network segmentation, to enforce such logical segregation within the ArcMesh platform and all Service Provider Systems.

2.6 Scope. The obligations set forth in this Exhibit E apply to the full scope of the Services, including the management, monitoring, and support of all three hundred forty (340) managed nodes located across twenty-eight (28) United States states and three (3) Canadian provinces as serviced under the Agreement, as well as all activities performed through or in connection with the ArcMesh platform (version 4.2). Service Provider acknowledges the geographically distributed nature of the managed network and shall ensure that its data security practices are consistently applied across all managed node locations and all Service Provider facilities.

Section 3 — Encryption Requirements

3.1 Data in Transit. All Customer Data transmitted over the managed network, between managed nodes, between Customer premises and Service Provider Systems, and between the Reston NOC and Winnipeg NOC shall be encrypted using Transport Layer Security ("TLS") version 1.2 or higher, or Internet Protocol Security ("IPsec") with Advanced Encryption Standard ("AES") 256-bit encryption. Service Provider shall not use deprecated or known-vulnerable cryptographic protocols (including, without limitation, SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1) for the transmission of Customer Data. Service Provider shall ensure that all cipher suites employed meet or exceed the minimum key lengths and algorithms recommended by NIST Special Publication 800-52 (as revised from time to time).

3.2 Data at Rest. All Customer Data stored on Service Provider Systems, including without limitation backups, logs, configuration files, database records, and archived data, shall be encrypted using AES-256 encryption or an equivalent encryption standard recognized by NIST. Encryption at rest shall be applied at the storage volume level or database level, as appropriate, and shall encompass all media on which Customer Data resides, including hard drives, solid-state drives, removable media, and backup tapes.

3.3 Key Management. Service Provider shall maintain a documented encryption key management program that addresses the full lifecycle of cryptographic keys, including the following:

(a) Secure key generation using cryptographically secure random number generators;

(b) Secure storage of encryption keys in dedicated key management systems or hardware security modules ("HSMs"), with access restricted to designated key custodians;

(c) Key rotation at least annually, and more frequently as warranted by changes in the threat environment or as required by Applicable Data Protection Laws;

(d) Key revocation and destruction procedures that ensure retired keys are rendered permanently unrecoverable; and

(e) Separation of encryption keys from the encrypted data they protect, such that encryption keys are not stored on the same systems, storage volumes, or media as the Customer Data they encrypt.

3.4 ArcMesh Platform. The ArcMesh platform (version 4.2) SD-WAN tunnels shall employ end-to-end encryption meeting or exceeding the standards set forth in Sections 3.1 and 3.2 above. Service Provider shall ensure that the ArcMesh platform's encryption capabilities are properly configured, actively enforced, and not subject to bypass or override except in accordance with documented change management procedures approved by Customer in writing. All ArcMesh overlay tunnels between managed nodes shall use IPsec with AES-256 encryption or an equivalent standard.

3.5 Certificate Management. Service Provider shall use digital certificates issued by recognized and trusted certificate authorities for all TLS and IPsec communications involving Customer Data. Service Provider shall monitor certificate expiration dates and shall replace certificates sufficiently in advance of expiration to prevent any lapse in encryption coverage. Service Provider shall maintain a certificate inventory and shall promptly revoke and replace any certificate that is compromised or suspected of being compromised.

Section 4 — Access Controls

4.1 Principle of Least Privilege. Access to Customer Data shall be granted on a strict need-to-know basis and shall be limited to Authorized Personnel who require such access to perform specific duties in connection with the Services. Service Provider shall not grant blanket or default access to Customer Data to any employee, contractor, or agent. Access privileges shall be commensurate with each individual's role and responsibilities, and Service Provider shall implement role-based access control ("RBAC") mechanisms to enforce the principle of least privilege.

4.2 Authentication. Multi-factor authentication ("MFA") shall be required for: (a) all remote access to Service Provider Systems containing or processing Customer Data; (b) all administrative access to the ArcMesh platform (version 4.2), including the management portal and configuration interfaces; and (c) all access to NOC management consoles at the Reston, VA and Winnipeg, MB facilities. MFA shall consist of at least two independent authentication factors selected from the following categories: something the user knows (e.g., password), something the user has (e.g., hardware token or authenticator application), and something the user is (e.g., biometric). Service Provider shall enforce password complexity requirements consistent with NIST Special Publication 800-63B or equivalent guidance.

4.3 Access Reviews. Service Provider shall conduct formal access reviews at least quarterly to verify that only Authorized Personnel retain access to Customer Data and that access privileges remain appropriate for each individual's current role. Access shall be revoked promptly—and in no event later than twenty-four (24) hours—upon personnel termination, completion of assignment, or change in role that no longer requires access to Customer Data. Service Provider shall maintain documentation of all access reviews, including the date of review, the reviewer, and any remedial actions taken.

4.4 Privileged Accounts. Service Provider shall maintain a current inventory of all privileged accounts (including, without limitation, system administrator accounts, root accounts, and database administrator accounts) with access to Service Provider Systems that process or store Customer Data. All privileged account activity shall be logged and monitored in real time. Shared or generic privileged accounts shall not be used; each privileged user shall have a unique, individually assigned account. Privileged access management ("PAM") tools shall be deployed to control, monitor, and audit all privileged access sessions.

4.5 Customer Administrative Access. Customer's VP of Network Operations (currently Katrina Bosch) and such additional Customer personnel as Customer may designate from time to time in writing shall have read-only access to the following through the ArcMesh platform portal: (a) security dashboards displaying real-time and historical security posture information; (b) audit logs and access logs relating to Customer Data; and (c) incident reports and Security Incident records. Service Provider shall provision such access within five (5) business days of Customer's written request and shall ensure that Customer's access does not compromise the security of Service Provider Systems.

Section 5 — Personnel Security

5.1 Background Checks. Service Provider shall conduct comprehensive background checks on all Authorized Personnel prior to granting such individuals access to Customer Data. Background checks shall include, at a minimum, verification of identity, criminal history checks, and employment history verification, to the extent permitted by applicable law. For Authorized Personnel located in Canada, background checks shall comply with applicable provincial and federal requirements. Service Provider shall not grant access to Customer Data to any individual who has been convicted of a felony involving dishonesty, fraud, or unauthorized access to computer systems, unless Customer provides written consent.

5.2 Security Awareness Training. All Authorized Personnel shall complete comprehensive information security awareness training upon hire or assignment to the Northgate account and at least annually thereafter. Training shall cover, at a minimum, the following topics: (a) data handling and classification procedures; (b) phishing and social engineering awareness; (c) password hygiene and multi-factor authentication; (d) physical security protocols; (e) incident reporting and escalation procedures; and (f) Service Provider's obligations under this Exhibit E and under Applicable Data Protection Laws. Service Provider shall maintain records of training completion and shall make such records available to Customer upon request during audits conducted under Section 7.

5.3 Confidentiality Obligations. All Authorized Personnel shall be bound by written confidentiality obligations that are no less protective than those set forth in Section 12 (Confidentiality) of the Agreement and the Mutual Non-Disclosure Agreement dated February 22, 2023, between Customer and Service Provider. Service Provider shall ensure that such confidentiality obligations are incorporated into the employment agreements or consulting agreements of all Authorized Personnel and that violations of such obligations are subject to disciplinary action, up to and including termination of employment or engagement.

5.4 Dedicated Service Delivery Manager. The dedicated Cedarpoint service delivery manager assigned to the Northgate account shall meet all personnel security requirements set forth in this Section 5, including background checks, security awareness training, and written confidentiality obligations. Service Provider shall notify Customer in writing at least fifteen (15) business days prior to any change in the assigned service delivery manager and shall ensure that any replacement service delivery manager satisfies all requirements of this Section 5 prior to assuming responsibilities on the Northgate account.

Section 6 — Security Incident and Breach Notification Procedures

6.1 Notification Timeline. Service Provider shall notify Customer of any Security Incident without unreasonable delay and in no event later than seventy-two (72) hours after Service Provider becomes aware of the Security Incident. For purposes of this Section 6.1, Service Provider shall be deemed to be "aware" of a Security Incident at the time any employee, contractor, or agent of Service Provider with responsibility for information security or incident response has a reasonable basis for concluding that a Security Incident has occurred. Notification shall be provided by telephone and confirmed in writing by email to the Customer contacts identified in Section 14.3 of this Exhibit E.

6.2 Initial Notification Content. The initial notification shall include, to the extent then known:

(a) A description of the nature and scope of the Security Incident, including the systems and facilities affected;

(b) The categories and approximate number of records affected or potentially affected;

(c) The date and time the Security Incident was discovered and, if known, the date and time the Security Incident is believed to have commenced;

(d) A description of the Customer Data involved or potentially involved, including the types and sensitivity classification of such data;

(e) A description of the measures taken or proposed to be taken to contain and remediate the Security Incident, including any immediate containment actions already implemented; and

(f) The name, title, telephone number, and email address of a designated point of contact at Service Provider who is knowledgeable about the Security Incident and authorized to coordinate with Customer.

6.3 Supplemental Notifications. Service Provider shall provide supplemental written notifications to Customer as additional information becomes available regarding the Security Incident. Service Provider shall provide Customer with a comprehensive root cause analysis within thirty (30) days of the date of discovery of the Security Incident. The root cause analysis shall identify the underlying cause of the Security Incident, the full scope and impact of the Security Incident, the timeline of events, and the corrective measures implemented or planned to prevent recurrence.

6.4 Coordination. Service Provider shall cooperate fully with Customer in investigating, remediating, and responding to any Security Incident, including without limitation: (a) preserving all evidence related to the Security Incident, including logs, system images, and forensic artifacts; (b) supporting forensic investigations conducted by Customer or its designated third-party forensic investigators; (c) coordinating with law enforcement authorities as required or as directed by Customer; (d) participating in joint incident response calls and meetings as reasonably requested by Customer; and (e) providing all information and assistance reasonably necessary for Customer to assess the impact of the Security Incident on its operations, regulatory obligations, and contractual commitments.

6.5 Regulatory Notifications. Service Provider shall assist Customer in complying with all applicable data breach notification obligations under Applicable Data Protection Laws, including by providing all information necessary for Customer to prepare and submit required notifications to regulatory authorities and affected individuals in a timely manner. Service Provider shall not independently notify any regulatory authority, affected individual, or third party regarding a Security Incident without Customer's prior written consent, except where Service Provider is independently required by applicable law to make such notification and where the delay necessary to obtain Customer's consent would result in a violation of such law. In the latter event, Service Provider shall provide Customer with as much advance notice as is reasonably practicable prior to making such notification and shall consult with Customer regarding the content and timing of the notification to the extent feasible.

6.6 Remediation. Service Provider shall promptly implement corrective measures to contain, remediate, and prevent the recurrence of any Security Incident. Service Provider shall provide Customer with a written remediation plan within fifteen (15) business days of the date of discovery of the Security Incident. The remediation plan shall describe the specific corrective actions to be taken, the responsible parties, the timeline for implementation, and the metrics by which the effectiveness of the corrective actions will be measured. Service Provider shall implement the remediation plan in accordance with the stated timeline and shall provide Customer with periodic status updates until all corrective actions have been completed.

6.7 Indemnification Tie-In. Security Incidents constituting data breaches caused by Service Provider's negligence or willful misconduct shall trigger Service Provider's indemnification obligations under Section 8 of the Agreement. Without limiting the foregoing, Service Provider shall indemnify, defend, and hold harmless Customer and its affiliates, officers, directors, employees, and agents from and against all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and costs of litigation) arising out of or relating to any such data breach, including without limitation:

(a) Customer's costs of notifying affected individuals and regulatory authorities as required by Applicable Data Protection Laws;

(b) Costs of providing credit monitoring or identity theft protection services to affected individuals;

(d) Costs of forensic investigation and remediation;

(e) Litigation costs and settlement amounts arising from third-party claims; and

(f) Costs of public relations and crisis management.

Such indemnification obligations are uncapped pursuant to the carve-outs from Service Provider's aggregate indemnification cap set forth in Section 8 of the Agreement. For the avoidance of doubt, the indemnification obligations arising under this Section 6.7 are carved out from and are not subject to the aggregate indemnification cap of two hundred percent (200%) of the trailing twelve (12) month fees paid or payable under the Agreement, as expressly provided in Section 8 of the Agreement (i.e., the carve-outs applicable to data breaches and willful misconduct).

6.8 Insurance Coverage. Service Provider shall maintain in force at all times during the term of the Agreement, and for a period of three (3) years following termination or expiration of the Agreement, the following insurance coverages:

(a) Cyber Liability Insurance: Not less than Twenty-Five Million Dollars ($25,000,000) per occurrence and Fifty Million Dollars ($50,000,000) in the aggregate, covering claims arising from data breaches, Security Incidents, unauthorized access, network security failures, and privacy violations;

(b) Technology Errors and Omissions Insurance: Not less than Twenty Million Dollars ($20,000,000) per occurrence and Forty Million Dollars ($40,000,000) in the aggregate, covering claims arising from acts, errors, or omissions in the performance of the Services;

as further specified in Exhibit F (Insurance Requirements) to the Agreement. Service Provider's current carrier for both policies is Braeburn Mutual Insurance Company, 280 Farmington Avenue, Hartford, CT 06105. Service Provider shall promptly notify Customer of any material change in its insurance coverage, including any reduction in limits, cancellation, or non-renewal, and shall provide Customer with certificates of insurance upon request.

Section 7 — Audit Rights

7.1 Customer Audit Right. Customer and its designated representatives, including its external auditors, Dunmore & Pratt LLP, shall have the right, upon thirty (30) days' prior written notice to Service Provider, to audit Service Provider's compliance with the terms and conditions of this Exhibit E. Such audits may be conducted no more than once per calendar year under ordinary circumstances; provided, however, that Customer may conduct additional audits at any time following any Security Incident or upon a reasonable, good-faith belief that Service Provider is not in compliance with this Exhibit E. Service Provider shall cooperate fully with any such audit and shall provide reasonable access to Service Provider Systems, facilities, personnel, and records as necessary to conduct the audit.

7.2 Scope of Audit. Audits conducted under Section 7.1 may include, without limitation, a review and examination of the following:

(a) Service Provider's information security policies, procedures, and standards;

(b) Access control logs and records, including privileged account activity logs;

(d) Personnel security records, including records of background checks and training completion (redacted as required by applicable law to protect personally identifiable information of Service Provider's personnel);

(e) Incident response records, including Security Incident reports, root cause analyses, and remediation plans;

(f) SOC 2 Type II reports or equivalent third-party audit reports;

(g) Vulnerability scan results and penetration testing reports;

(h) Business continuity and disaster recovery plans and test results; and

(i) Physical inspection of the Reston, VA NOC facility (11400 Commerce Park Drive, Suite 600, Reston, VA 20191) and the Winnipeg, MB NOC facility (200 Portage Avenue, Suite 1500, Winnipeg, MB R3C 3X2, Canada), subject to Service Provider's reasonable physical security and visitor management protocols.

7.3 Cost Allocation. Routine annual audits conducted under Section 7.1 shall be conducted at Customer's cost, including the fees and expenses of Customer's auditors and representatives. Audits triggered by a confirmed Security Incident that was caused by Service Provider's negligence or willful misconduct shall be conducted at Service Provider's cost, including reimbursement of Customer's reasonable fees and expenses for auditors and forensic investigators.

7.4 Third-Party Certifications. Service Provider shall, at Service Provider's own cost, obtain and maintain an annual SOC 2 Type II report (or equivalent third-party certification) covering the Service Provider Systems used to deliver the Services, including the Reston NOC and Winnipeg NOC facilities and the ArcMesh platform. The SOC 2 Type II report shall cover the security, availability, and confidentiality trust services criteria. Service Provider shall provide a copy of the most recent SOC 2 Type II report to Customer within thirty (30) days of Customer's written request. Service Provider shall promptly notify Customer of any qualified opinion, material exceptions, or material deficiencies identified in any SOC 2 Type II report.

7.5 Remediation of Findings. Service Provider shall develop and implement a corrective action plan to address any material deficiencies identified during an audit conducted under this Section 7 within thirty (30) days of receipt of the written audit findings from Customer. The corrective action plan shall describe the specific remedial actions to be taken, the responsible parties, and the timeline for completion. Customer shall have the right to verify the implementation and effectiveness of the corrective actions through follow-up review or inspection, at Service Provider's cost if the original deficiency resulted from Service Provider's negligence or willful misconduct.

Section 8 — Data Localization

8.1 Primary Processing Locations. Customer Data shall be processed, stored, and accessed only at the following approved locations:

(a) Service Provider's Reston NOC facility, located at 11400 Commerce Park Drive, Suite 600, Reston, VA 20191, United States;

(b) Service Provider's Winnipeg NOC facility, located at 200 Portage Avenue, Suite 1500, Winnipeg, MB R3C 3X2, Canada;

(d) The three hundred forty (340) managed node locations listed in Schedule 1 to the Agreement, distributed across twenty-eight (28) United States states and three (3) Canadian provinces.

Service Provider shall not process, store, or access Customer Data at any location other than those listed above without Customer's prior written consent.

8.2 No Offshore Processing. Service Provider shall not process, store, transmit, or access Customer Data from any location outside of the United States and Canada without Customer's prior written consent. This restriction applies to all forms of access, including remote access by Service Provider's personnel, contractors, or agents, and to all forms of processing, including disaster recovery and backup operations. Service Provider represents and warrants that, as of the effective date of the Agreement, no Customer Data is processed, stored, or accessed from any location outside the United States and Canada.

8.3 Subcontractors. Service Provider shall not engage any subcontractor, sub-processor, or other third party to process, store, access, or handle Customer Data without Customer's prior written approval. Any request for such approval shall be submitted in writing at least thirty (30) days prior to the proposed engagement and shall include the identity of the proposed subcontractor, the services to be performed, the locations from which Customer Data will be accessed or processed, and a description of the subcontractor's data security practices. Any approved subcontractor shall be bound by written data security and privacy obligations no less protective than those set forth in this Exhibit E, as further specified in Section 13.

8.4 Cross-Border Transfers. To the extent Customer Data includes Personal Data of Canadian residents, Service Provider shall comply with PIPEDA and any applicable provincial privacy legislation governing cross-border transfers of Personal Data between Canada and the United States. Service Provider shall implement appropriate contractual safeguards, as required by applicable Canadian privacy law, to ensure that Personal Data transferred from Canada to the United States receives a level of protection substantially equivalent to that provided under Canadian law. Service Provider shall cooperate with Customer in responding to any inquiries from the Office of the Privacy Commissioner of Canada or any provincial privacy commissioner regarding cross-border transfers of Personal Data.

Section 9 — Data Retention and Destruction

9.1 Retention During Term. Service Provider shall retain Customer Data only for so long as necessary to perform the Services and as required by the Agreement and any applicable Statement of Work (Exhibit A). Service Provider shall not retain copies of Customer Data, including backup copies, cached copies, or archived copies, beyond the retention periods specified in the Agreement or the applicable Statement of Work, unless such retention is required under Section 9.4 below. Service Provider shall implement automated processes, where practicable, to enforce data retention policies and to identify and securely dispose of Customer Data that has exceeded its applicable retention period.

9.2 Return of Data Upon Termination or Expiration. Upon termination or expiration of the Agreement, including termination upon a change of control event under Schedule 2 to the Agreement or termination for cause under Section 7 of the Agreement, Service Provider shall, at Customer's election and written direction:

(a) Return all Customer Data to Customer in a mutually agreed machine-readable format (e.g., standard database export formats, CSV, JSON, or XML) within thirty (30) days of Customer's written request; or

(b) Securely destroy all Customer Data, including all copies, backups, and archived instances, in accordance with the destruction standards set forth in Section 9.3 below, and certify such destruction in writing, signed by an authorized officer of Service Provider, within forty-five (45) days of Customer's written request.

If Customer does not make an election within thirty (30) days following termination or expiration, Service Provider shall securely destroy all Customer Data in accordance with Section 9.3 and provide the written certification described in Section 9.2(b) above.

9.3 Destruction Standards. Destruction of Customer Data shall be performed in accordance with NIST Special Publication 800-88, Revision 1 (Guidelines for Media Sanitization), or an equivalent standard recognized by NIST. Destruction shall render Customer Data permanently and irreversibly unrecoverable, regardless of the media on which it is stored. For electronic media, destruction methods shall include, as appropriate, cryptographic erasure, secure overwriting, degaussing, or physical destruction. Service Provider shall maintain records of all Customer Data destruction activities, including the date of destruction, the method employed, the media destroyed, and the identity of the individual who performed or supervised the destruction.

9.4 Exceptions for Legal Holds. Notwithstanding the foregoing, Service Provider may retain Customer Data beyond the periods specified in Section 9.2 solely to the extent required by applicable law, regulation, or a legal hold imposed by a court, regulatory authority, or law enforcement agency. In such event, Service Provider shall: (a) promptly notify Customer in writing of the nature and scope of the retention requirement; (b) limit the retention to the minimum amount of Customer Data necessary to comply with the applicable requirement; and (c) continue to protect the retained Customer Data in accordance with all applicable provisions of this Exhibit E for so long as such data remains in Service Provider's possession or control.

9.5 Transition and Wind-Down. During any transition or wind-down period associated with the termination or expiration of the Agreement, including without limitation the one hundred eighty (180) day termination notice period following a change of control election under Schedule 2 to the Agreement, and during the migration from Greystone Halcyon Software legacy MPLS infrastructure to the ArcMesh platform, Service Provider shall continue to comply in full with all data security and privacy obligations set forth in this Exhibit E. Service Provider shall cooperate with Customer and any successor service provider designated by Customer in the orderly transition of Customer Data, including providing reasonable technical assistance to facilitate data migration, ensuring continued access to Customer Data during the transition period, and coordinating with Customer's team to minimize disruption to the managed network operations.

Section 10 — Compliance with Applicable Data Protection Laws

10.1 General Compliance. Service Provider shall comply with all Applicable Data Protection Laws in its performance of the Services, including without limitation:

(a) All applicable United States state data privacy and data breach notification statutes across the twenty-eight (28) US states in which managed nodes are located;

(b) PIPEDA and applicable provincial privacy legislation in the three (3) Canadian provinces in which managed nodes are located;

(c) Any applicable telecommunications regulations issued by the FCC or the CRTC, to the extent such regulations impose data security or privacy requirements on the processing, transmission, or storage of Customer Data over the managed network; and

(d) Any other Applicable Data Protection Laws that may apply to Service Provider's activities in connection with the Services.

Service Provider shall maintain sufficient knowledge and expertise regarding Applicable Data Protection Laws to ensure ongoing compliance and shall designate an internal privacy officer or equivalent role with responsibility for overseeing compliance with Applicable Data Protection Laws.

10.2 Regulatory Changes. Service Provider shall monitor changes in Applicable Data Protection Laws on an ongoing basis and shall notify Customer in writing within thirty (30) days of becoming aware of any enacted or proposed change that materially affects Service Provider's obligations under this Exhibit E or the Agreement. The parties shall cooperate in good faith to assess the impact of any such change and to implement any necessary modifications to the Services, Service Provider's information security program, or this Exhibit E to ensure continued compliance. Any amendments to this Exhibit E required by changes in Applicable Data Protection Laws shall be documented in writing and signed by both parties in accordance with Section 16.3.

10.3 Regulatory Penalties. Service Provider's failure to comply with Applicable Data Protection Laws in connection with the performance of the Services that results in regulatory penalties, fines, assessments, or enforcement actions imposed on Customer shall trigger Service Provider's indemnification obligations under Section 8(d) of the Agreement, which provides for indemnification of Customer against regulatory penalties arising from Service Provider's failure to comply with applicable telecommunications regulations and data protection requirements. Service Provider acknowledges that such indemnification obligations are in addition to, and not in lieu of, any other indemnification obligations set forth in the Agreement or this Exhibit E.

10.4 Data Protection Impact Assessments. Service Provider shall cooperate with Customer in conducting data protection impact assessments ("DPIAs") where required by Applicable Data Protection Laws or where Customer reasonably determines that a DPIA is appropriate in connection with the Services. Such cooperation shall include providing Customer with information regarding Service Provider's data processing activities, security controls, and risk assessments, as well as implementing any additional safeguards identified through the DPIA process.

10.5 Records of Processing. Service Provider shall maintain accurate and up-to-date records of processing activities involving Customer Data. Such records shall be sufficient to demonstrate compliance with Applicable Data Protection Laws and to support Customer's own compliance obligations, including any obligations to maintain records of processing activities under applicable Canadian privacy law. Records of processing shall include, at a minimum: (a) the categories of Customer Data processed; (b) the purposes of processing; (c) the categories of recipients to whom Customer Data has been or may be disclosed; (d) a description of the technical and organizational security measures applied to Customer Data; and (e) the locations at which Customer Data is processed and stored. Service Provider shall make such records available to Customer upon request.

Section 11 — Network Security and Monitoring

11.1 Cybersecurity Monitoring. Service Provider shall provide twenty-four hours per day, seven days per week (24×7) cybersecurity monitoring, threat detection, and incident response for the managed network perimeter and all Service Provider Systems processing or transmitting Customer Data, as further described in Exhibit A (Statement of Work) to the Agreement. Cybersecurity monitoring shall include real-time analysis of network traffic, security event correlation, alerting on suspicious or anomalous activity, and escalation of potential Security Incidents in accordance with Section 6 of this Exhibit E.

11.2 Vulnerability Management. Service Provider shall conduct automated vulnerability scans of all Service Provider Systems that process, store, or transmit Customer Data at least quarterly. In addition, Service Provider shall conduct external penetration testing of Service Provider Systems at least annually, utilizing qualified third-party penetration testing firms. Results of vulnerability scans and penetration tests shall be made available to Customer within fifteen (15) business days of completion. Service Provider shall prioritize and remediate identified vulnerabilities in accordance with a risk-based approach, with critical and high-severity vulnerabilities remediated within the timeframes specified in Section 11.3 below.

11.3 Patch Management. Service Provider shall apply critical security patches to all Service Provider Systems, including the ArcMesh platform (version 4.2), within seventy-two (72) hours of the vendor's release of the patch. Non-critical security patches shall be applied within thirty (30) calendar days of release. Service Provider shall maintain a documented patch management process that includes testing, approval, deployment, and verification procedures. In the event that a critical patch cannot be applied within the seventy-two (72) hour window due to compatibility or operational constraints, Service Provider shall implement compensating controls to mitigate the associated risk and shall notify Customer in writing of the delay and the compensating controls implemented.

11.4 Logging and Monitoring. Service Provider shall maintain security event logs for all Service Provider Systems processing, storing, or transmitting Customer Data. Logs shall include, at a minimum, records of user authentication events, administrative access events, configuration changes, data access events, and security alerts. Security event logs shall be retained for a minimum of twelve (12) months and shall be available to Customer for review upon request and during audits conducted under Section 7 of this Exhibit E. Logs shall be protected against unauthorized modification or deletion through the use of write-once storage, integrity monitoring, or equivalent controls.

11.5 Intrusion Detection/Prevention. Service Provider shall deploy and maintain network-based intrusion detection systems ("IDS") and intrusion prevention systems ("IPS") at each NOC facility, specifically the Reston, VA primary NOC and the Winnipeg, MB secondary NOC. IDS/IPS systems shall be configured to detect and, where appropriate, automatically block known attack patterns, malicious traffic, and unauthorized access attempts. IDS/IPS signatures and rules shall be updated on a regular basis to address emerging threats. Service Provider shall monitor IDS/IPS alerts on a 24×7 basis and shall escalate and respond to confirmed intrusion events in accordance with the incident response procedures set forth in Section 6.

Section 12 — Business Continuity and Disaster Recovery

12.1 BCP/DR Plans. Service Provider shall maintain comprehensive, documented business continuity plans ("BCP") and disaster recovery plans ("DRP") covering all Service Provider Systems and the Services. BCP/DRP plans shall address, at a minimum, the following scenarios: natural disasters, power outages, network failures, hardware failures, cyberattacks, pandemic events, and other events that could disrupt the continuity of the Services. BCP/DRP plans shall be reviewed and updated at least annually and shall be tested through tabletop exercises, simulation exercises, or full failover tests at least annually. Service Provider shall provide Customer with a summary of BCP/DRP test results within thirty (30) days of each test.

12.2 Recovery Objectives. Service Provider's disaster recovery plans shall target a recovery time objective ("RTO") and recovery point objective ("RPO") consistent with the service level agreement requirements set forth in Exhibit B to the Agreement, including the commitment to maintain ninety-nine and ninety-five hundredths percent (99.95%) monthly uptime per managed node. Service Provider shall design and maintain its disaster recovery infrastructure to achieve the RTO and RPO targets and shall provide Customer with documentation of the specific RTO and RPO targets applicable to each critical component of the Services.

12.3 Redundancy. Service Provider shall maintain geographic redundancy between its Reston, VA primary NOC facility and its Winnipeg, MB secondary NOC facility to ensure continuity of the 24×7 monitoring, management, and incident response services provided under the Agreement. Geographic redundancy shall include, at a minimum, redundant monitoring systems, redundant management consoles, replicated configuration data, and failover capabilities that allow the secondary NOC to assume full operational responsibility for the managed network in the event of a failure or unavailability of the primary NOC. Service Provider shall test failover procedures between the two NOC facilities at least annually.

12.4 Customer Notification. Service Provider shall notify Customer promptly, and in no event later than one (1) hour after the initiation of any disaster recovery activation, of any disaster recovery event affecting the Services. Service Provider shall provide Customer with regular status updates at intervals of no less than every four (4) hours until normal operations are fully restored. Notifications shall include a description of the event, the systems and Services affected, the estimated time to recovery, and any actions required of Customer.

Section 13 — Subcontractor and Third-Party Management

13.1 Approval Requirement. As set forth in Section 8.3 of this Exhibit E, no subcontractor or sub-processor may access, process, store, or handle Customer Data without Customer's prior written consent. Service Provider shall submit requests for subcontractor approval in writing, providing sufficient detail for Customer to evaluate the proposed subcontractor's qualifications, data security practices, and compliance posture.

13.2 Flow-Down Obligations. All approved subcontractors shall be contractually bound by data security and privacy obligations that are at least as protective as those set forth in this Exhibit E. Service Provider shall ensure that subcontractor agreements include, at a minimum, obligations regarding data handling standards, encryption, access controls, personnel security, Security Incident notification, data localization, data retention and destruction, compliance with Applicable Data Protection Laws, and audit rights. Service Provider shall provide Customer with copies of the data security provisions of subcontractor agreements upon Customer's request.

13.3 Liability. Service Provider shall remain fully liable for the acts and omissions of its subcontractors and sub-processors as if they were Service Provider's own acts and omissions. The engagement of a subcontractor or sub-processor shall not relieve Service Provider of any obligation under this Exhibit E or the Agreement. Service Provider shall be responsible for ensuring that all subcontractors comply with the terms of this Exhibit E and shall be liable for any failure by a subcontractor to do so.

13.4 Inventory. Service Provider shall maintain and provide to Customer a current, complete list of all subcontractors and sub-processors with access to Customer Data, including the name, address, and description of services performed by each subcontractor. Such list shall be updated at least annually and shall be provided to Customer within ten (10) business days of Customer's written request. Service Provider shall notify Customer in writing at least thirty (30) days prior to engaging any new subcontractor or sub-processor or materially changing the scope of any existing subcontractor's engagement.

Section 14 — Cooperation and Reporting

14.1 Quarterly Security Reports. Service Provider shall provide Customer with written quarterly reports summarizing Service Provider's security posture and compliance with this Exhibit E. Quarterly reports shall include, at a minimum: (a) a summary of any Security Incidents during the reporting period, including status and resolution; (b) vulnerability scan results and remediation status; (c) patch management status, including any outstanding critical patches; (d) access review results and any remedial actions taken; (e) key compliance metrics; and (f) any material changes to Service Provider's information security program. Quarterly reports shall be delivered to Customer within fifteen (15) business days of the end of each calendar quarter, and shall be timed to coincide with the quarterly network performance reviews described in Exhibit A to the Agreement.

14.2 Annual Certification. Service Provider shall provide an annual written certification, signed by an officer of Service Provider with appropriate authority and knowledge, confirming Service Provider's compliance with the terms and conditions of this Exhibit E during the preceding twelve (12) month period. The annual certification shall be delivered to Customer within sixty (60) days of the end of each calendar year and shall identify any known instances of non-compliance and the corrective actions taken or planned.

14.3 Customer Contacts. All notices, reports, and communications regarding data security and privacy matters under this Exhibit E shall be directed to the following Customer representatives:

VP of Network Operations: Katrina Bosch Northgate Americas, Inc. 1700 Market Street, Suite 2400 Philadelphia, PA 19103 United States

Chief Technology Officer: Alistair Pemberton Northgate Telecommunications PLC 45 Threadneedle Court London EC2R 8AH United Kingdom

Customer may update the above contact information by written notice to Service Provider in accordance with the notice provisions of the Agreement.

14.4 Service Provider Contacts. All notices, reports, and communications regarding data security and privacy matters under this Exhibit E shall be directed to the following Service Provider representative:

General Counsel: Nadia Okafor Cedarpoint Systems Integration, Inc. 11400 Commerce Park Drive, Suite 600 Reston, VA 20191 United States

Service Provider may update the above contact information by written notice to Customer in accordance with the notice provisions of the Agreement.

Section 15 — Remedies

15.1 Material Breach. A material or persistent failure by Service Provider to comply with the obligations set forth in this Exhibit E shall constitute a material breach of the Agreement, entitling Customer to exercise its termination rights under the Agreement, including without limitation the right to terminate the Agreement for cause under Section 7 of the Agreement. Service Provider acknowledges that Customer's decision to enter into the Agreement was made in material reliance upon Service Provider's commitment to comply with the data security and privacy requirements set forth herein.

15.2 Indemnification. Without limiting the generality of Section 8 of the Agreement, Service Provider's indemnification obligations for data breaches caused by Service Provider's negligence or willful misconduct are uncapped and are carved out from the aggregate indemnification cap of two hundred percent (200%) of the trailing twelve (12) month fees paid or payable under the Agreement, as expressly provided in Section 8 of the Agreement. For reference purposes, Customer's aggregate indemnification obligations under the Agreement remain capped at one hundred percent (100%) of the trailing twelve (12) month fees, which based on the current annual fee structure is approximately Fifteen Million Dollars ($15,000,000) per year. The parties acknowledge that the asymmetric indemnification structure reflects the allocation of risk appropriate to Service Provider's role as custodian and processor of Customer Data.

15.3 Equitable Relief. Customer shall be entitled to seek injunctive relief, specific performance, or other equitable relief in the event of any actual or threatened breach of this Exhibit E by Service Provider, without the necessity of proving actual damages or posting a bond or other security. Service Provider acknowledges that a breach of the data security and privacy obligations set forth in this Exhibit E could cause irreparable harm to Customer for which monetary damages would be an inadequate remedy.

15.4 Survival. The obligations of this Exhibit E relating to data retention, destruction, and return of Customer Data (Section 9), confidentiality of Customer Data, indemnification (Sections 6.7, 10.3, and 15.2), and the post-termination audit and cooperation rights of Customer shall survive the termination or expiration of the Agreement and shall continue in full force and effect for so long as Service Provider retains any Customer Data and, with respect to indemnification obligations, for the applicable statute of limitations period.

Section 16 — Miscellaneous

16.1 Governing Law. This Exhibit E shall be governed by and construed in accordance with the laws of the State of New York, without giving effect to any choice or conflict of law provision or rule that would cause the application of the laws of any other jurisdiction, consistent with the governing law provision set forth in the Agreement.

16.2 Conflict. In the event of any conflict or inconsistency between the terms of this Exhibit E and the body of the Agreement, the terms of this Exhibit E shall control with respect to data security and privacy matters. In the event of any conflict or inconsistency between the terms of this Exhibit E and any Statement of Work or other Exhibit to the Agreement, the terms of this Exhibit E shall control with respect to data security and privacy matters, unless the Statement of Work or other Exhibit expressly states that it is intended to override a specific provision of this Exhibit E and is signed by both parties.

16.3 Amendments. This Exhibit E may be amended, modified, or supplemented only by a written instrument duly executed by authorized representatives of both parties. No oral agreement, course of dealing, or course of performance shall be deemed to amend or modify this Exhibit E.

16.4 Entire Agreement. This Exhibit E, together with the Agreement and all other Exhibits, Schedules, and Statements of Work attached thereto or incorporated therein by reference, constitutes the entire agreement of the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, understandings, negotiations, and discussions, whether oral or written, between the parties relating to the data security and privacy requirements applicable to the Services.

INCORPORATION

This Exhibit E is incorporated into and forms part of the Master Services Agreement dated June 9, 2023 between Northgate Americas, Inc. and Cedarpoint Systems Integration, Inc. This Exhibit E does not require a separate signature block and is effective upon execution of the Agreement. The signature pages of Warren Liang, on behalf of Northgate Americas, Inc., and Rajiv Sundaram, on behalf of Cedarpoint Systems Integration, Inc., affixed to the Agreement shall govern this Exhibit E.

Exhibit E — Data Security and Privacy Requirements — Page 1 of Exhibit E to the Master Services Agreement dated June 9, 2023 between Northgate Americas, Inc. and Cedarpoint Systems Integration, Inc.

EXHIBIT E
DATA SECURITY AND PRIVACY REQUIREMENTS
Exhibit E to the Master Services Agreement dated June 9, 2023 (the "Agreement")
Parties:
Northgate Americas, Inc., a Delaware corporation ("Customer")
and
Cedarpoint Systems Integration, Inc., a Delaware corporation ("Service Provider")
This Exhibit E is attached to and incorporated by reference into the Master Services Agreement dated June 9, 2023 between Customer and Service Provider (the "Agreement"). This Exhibit E sets forth the data security and privacy requirements applicable to Service Provider's performance of the Services under the Agreement and all Statements of Work issued thereunder. Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement.
Section 1 — Definitions
1.1 "Customer Data" means all data, information, content, records, and files provided by or on behalf of Customer, transmitted over the managed network, processed through the ArcMesh platform (version 4.2), or otherwise accessed by Service Provider in connection with the Services, including but not limited to network traffic data, configuration data, user credentials, device identifiers, performance metrics, routing tables, firewall rules, and any personally identifiable information. Customer Data shall include data in all forms, whether structured or unstructured, and regardless of the medium in which it is stored or transmitted.
1.2 "Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable data protection laws, including any information that alone or in combination with other information can be used to identify, contact, or locate a natural person. For the avoidance of doubt, Personal Data includes names, addresses, telephone numbers, email addresses, employee identification numbers, social insurance numbers, social security numbers, IP addresses, device identifiers, and any other information classified as "personal information," "personally identifiable information," or an equivalent term under Applicable Data Protection Laws.
1.3 "Security Incident" means any unauthorized access to, acquisition of, use of, disclosure of, or loss of Customer Data, including any compromise of Service Provider's systems, networks, or the ArcMesh platform that results in or reasonably could result in the exposure of Customer Data. A Security Incident also includes any event that constitutes a "security breach," "data breach," or equivalent term under Applicable Data Protection Laws, as well as any unauthorized intrusion into Service Provider Systems, whether or not Customer Data is confirmed to have been accessed or exfiltrated.
1.4 "Applicable Data Protection Laws" means all federal, state, provincial, and international laws, regulations, and regulatory guidance applicable to the processing, storage, and transmission of Customer Data, including without limitation: (a) applicable United States state data breach notification laws and state data privacy statutes; (b) the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) and any applicable provincial privacy legislation, including the Freedom of Information and Protection of Privacy Act (Manitoba), the Personal Information Protection Act (Alberta), and the Act Respecting the Protection of Personal Information in the Private Sector (Québec), to the extent applicable; (c) any applicable regulations, orders, or guidance issued by the Federal Communications Commission ("FCC"); (d) any applicable regulations, orders, or guidance issued by the Canadian Radio-television and Telecommunications Commission ("CRTC"); and (e) any other applicable law, regulation, or binding guidance relating to the security, privacy, or protection of data.
1.5 "Authorized Personnel" means Service Provider employees, contractors, and agents who (a) have a documented need to access Customer Data in order to perform the Services, and (b) have undergone the vetting, background checks, and training required under Section 5 of this Exhibit E. For the avoidance of doubt, no individual who has not satisfied the requirements of Section 5 shall be deemed Authorized Personnel.
1.6 "Service Provider Systems" means all hardware, software, networks, facilities, and infrastructure used by Service Provider in connection with the performance of the Services, including without limitation the Network Operations Centers located at 11400 Commerce Park Drive, Suite 600, Reston, VA 20191, United States (the "Reston NOC" or "primary NOC") and 200 Portage Avenue, Suite 1500, Winnipeg, MB R3C 3X2, Canada (the "Winnipeg NOC" or "secondary NOC"), as well as all servers, storage devices, management consoles, monitoring platforms, and networking equipment operated by Service Provider or its approved subcontractors in connection with the Services.
Section 2 — Data Handling Standards
2.1 General Obligation. Service Provider shall implement and maintain administrative, technical, and physical safeguards designed to protect Customer Data against unauthorized access, use, disclosure, alteration, or destruction, consistent with industry best practices applicable to managed network services and software-defined wide area network ("SD-WAN") platforms. Such safeguards shall be no less protective than the safeguards Service Provider applies to its own confidential information of a similar nature and sensitivity. Service Provider acknowledges that Customer Data is among the most sensitive categories of information entrusted to Service Provider and that the unauthorized disclosure or compromise of Customer Data could cause significant harm to Customer's business operations, regulatory standing, and reputation.
2.2 Information Security Program. Service Provider shall establish and maintain a comprehensive written information security program ("ISP") that is reasonably designed to protect the confidentiality, integrity, and availability of Customer Data. The ISP shall include, at a minimum, the following components:
(a) Risk assessments conducted at least annually, and more frequently as warranted by material changes to Service Provider Systems or the threat landscape, to identify and evaluate internal and external risks to the security of Customer Data;
(b) Documented security policies and procedures addressing, without limitation, data classification, access control, encryption, vulnerability management, patch management, change management, physical security, incident response, and acceptable use;
(c) A documented incident response plan that defines roles and responsibilities, escalation procedures, communication protocols, and forensic investigation procedures in the event of a Security Incident;
(d) Business continuity and disaster recovery plans, as further described in Section 12 of this Exhibit E, covering Service Provider Systems and the Services; and
(e) A process for periodic review and update of the ISP to address evolving threats, technological changes, and changes in Applicable Data Protection Laws.
2.3 Minimum Framework Standards. Service Provider's information security program shall be aligned with ISO/IEC 27001:2022, or a substantially equivalent internationally recognized framework, such as the AICPA SOC 2 Type II trust services criteria or the NIST Cybersecurity Framework (version 1.1 or later). Service Provider shall be prepared to demonstrate such alignment through third-party certifications, independent audit reports, or other verifiable evidence upon Customer's request. In the event that Service Provider transitions from one framework to another, Service Provider shall provide Customer with at least sixty (60) days' prior written notice and shall ensure that the replacement framework provides a level of protection no less protective than the framework being replaced.
2.4 Data Classification. Service Provider shall classify Customer Data according to sensitivity levels (e.g., "Restricted," "Confidential," "Internal") and shall apply commensurate administrative, technical, and physical protections to each classification level. At a minimum, all network traffic data, configuration data, user credentials, and routing information shall be classified and treated as "Confidential" or higher. Personal Data shall be classified as "Restricted" and shall receive the highest level of protection afforded under Service Provider's data classification scheme.
2.5 Segregation. Customer Data shall be logically segregated from the data of Service Provider's other clients at all times. Service Provider shall not commingle Customer Data with third-party data in shared databases, shared storage environments, or shared processing environments in a manner that would permit unauthorized cross-access. Service Provider shall implement and maintain appropriate technical controls, including access control lists, tenant isolation mechanisms, and network segmentation, to enforce such logical segregation within the ArcMesh platform and all Service Provider Systems.
2.6 Scope. The obligations set forth in this Exhibit E apply to the full scope of the Services, including the management, monitoring, and support of all three hundred forty (340) managed nodes located across twenty-eight (28) United States states and three (3) Canadian provinces as serviced under the Agreement, as well as all activities performed through or in connection with the ArcMesh platform (version 4.2). Service Provider acknowledges the geographically distributed nature of the managed network and shall ensure that its data security practices are consistently applied across all managed node locations and all Service Provider facilities.
Section 3 — Encryption Requirements
3.1 Data in Transit. All Customer Data transmitted over the managed network, between managed nodes, between Customer premises and Service Provider Systems, and between the Reston NOC and Winnipeg NOC shall be encrypted using Transport Layer Security ("TLS") version 1.2 or higher, or Internet Protocol Security ("IPsec") with Advanced Encryption Standard ("AES") 256-bit encryption. Service Provider shall not use deprecated or known-vulnerable cryptographic protocols (including, without limitation, SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1) for the transmission of Customer Data. Service Provider shall ensure that all cipher suites employed meet or exceed the minimum key lengths and algorithms recommended by NIST Special Publication 800-52 (as revised from time to time).
3.2 Data at Rest. All Customer Data stored on Service Provider Systems, including without limitation backups, logs, configuration files, database records, and archived data, shall be encrypted using AES-256 encryption or an equivalent encryption standard recognized by NIST. Encryption at rest shall be applied at the storage volume level or database level, as appropriate, and shall encompass all media on which Customer Data resides, including hard drives, solid-state drives, removable media, and backup tapes.
3.3 Key Management. Service Provider shall maintain a documented encryption key management program that addresses the full lifecycle of cryptographic keys, including the following:
(a) Secure key generation using cryptographically secure random number generators;
(b) Secure storage of encryption keys in dedicated key management systems or hardware security modules ("HSMs"), with access restricted to designated key custodians;
(c) Key rotation at least annually, and more frequently as warranted by changes in the threat environment or as required by Applicable Data Protection Laws;
(d) Key revocation and destruction procedures that ensure retired keys are rendered permanently unrecoverable; and
(e) Separation of encryption keys from the encrypted data they protect, such that encryption keys are not stored on the same systems, storage volumes, or media as the Customer Data they encrypt.
3.4 ArcMesh Platform. The ArcMesh platform (version 4.2) SD-WAN tunnels shall employ end-to-end encryption meeting or exceeding the standards set forth in Sections 3.1 and 3.2 above. Service Provider shall ensure that the ArcMesh platform's encryption capabilities are properly configured, actively enforced, and not subject to bypass or override except in accordance with documented change management procedures approved by Customer in writing. All ArcMesh overlay tunnels between managed nodes shall use IPsec with AES-256 encryption or an equivalent standard.
3.5 Certificate Management. Service Provider shall use digital certificates issued by recognized and trusted certificate authorities for all TLS and IPsec communications involving Customer Data. Service Provider shall monitor certificate expiration dates and shall replace certificates sufficiently in advance of expiration to prevent any lapse in encryption coverage. Service Provider shall maintain a certificate inventory and shall promptly revoke and replace any certificate that is compromised or suspected of being compromised.
Section 4 — Access Controls
4.1 Principle of Least Privilege. Access to Customer Data shall be granted on a strict need-to-know basis and shall be limited to Authorized Personnel who require such access to perform specific duties in connection with the Services. Service Provider shall not grant blanket or default access to Customer Data to any employee, contractor, or agent. Access privileges shall be commensurate with each individual's role and responsibilities, and Service Provider shall implement role-based access control ("RBAC") mechanisms to enforce the principle of least privilege.
4.2 Authentication. Multi-factor authentication ("MFA") shall be required for: (a) all remote access to Service Provider Systems containing or processing Customer Data; (b) all administrative access to the ArcMesh platform (version 4.2), including the management portal and configuration interfaces; and (c) all access to NOC management consoles at the Reston, VA and Winnipeg, MB facilities. MFA shall consist of at least two independent authentication factors selected from the following categories: something the user knows (e.g., password), something the user has (e.g., hardware token or authenticator application), and something the user is (e.g., biometric). Service Provider shall enforce password complexity requirements consistent with NIST Special Publication 800-63B or equivalent guidance.
4.3 Access Reviews. Service Provider shall conduct formal access reviews at least quarterly to verify that only Authorized Personnel retain access to Customer Data and that access privileges remain appropriate for each individual's current role. Access shall be revoked promptly—and in no event later than twenty-four (24) hours—upon personnel termination, completion of assignment, or change in role that no longer requires access to Customer Data. Service Provider shall maintain documentation of all access reviews, including the date of review, the reviewer, and any remedial actions taken.
4.4 Privileged Accounts. Service Provider shall maintain a current inventory of all privileged accounts (including, without limitation, system administrator accounts, root accounts, and database administrator accounts) with access to Service Provider Systems that process or store Customer Data. All privileged account activity shall be logged and monitored in real time. Shared or generic privileged accounts shall not be used; each privileged user shall have a unique, individually assigned account. Privileged access management ("PAM") tools shall be deployed to control, monitor, and audit all privileged access sessions.
4.5 Customer Administrative Access. Customer's VP of Network Operations (currently Katrina Bosch) and such additional Customer personnel as Customer may designate from time to time in writing shall have read-only access to the following through the ArcMesh platform portal: (a) security dashboards displaying real-time and historical security posture information; (b) audit logs and access logs relating to Customer Data; and (c) incident reports and Security Incident records. Service Provider shall provision such access within five (5) business days of Customer's written request and shall ensure that Customer's access does not compromise the security of Service Provider Systems.
Section 5 — Personnel Security
5.1 Background Checks. Service Provider shall conduct comprehensive background checks on all Authorized Personnel prior to granting such individuals access to Customer Data. Background checks shall include, at a minimum, verification of identity, criminal history checks, and employment history verification, to the extent permitted by applicable law. For Authorized Personnel located in Canada, background checks shall comply with applicable provincial and federal requirements. Service Provider shall not grant access to Customer Data to any individual who has been convicted of a felony involving dishonesty, fraud, or unauthorized access to computer systems, unless Customer provides written consent.
5.2 Security Awareness Training. All Authorized Personnel shall complete comprehensive information security awareness training upon hire or assignment to the Northgate account and at least annually thereafter. Training shall cover, at a minimum, the following topics: (a) data handling and classification procedures; (b) phishing and social engineering awareness; (c) password hygiene and multi-factor authentication; (d) physical security protocols; (e) incident reporting and escalation procedures; and (f) Service Provider's obligations under this Exhibit E and under Applicable Data Protection Laws. Service Provider shall maintain records of training completion and shall make such records available to Customer upon request during audits conducted under Section 7.
5.3 Confidentiality Obligations. All Authorized Personnel shall be bound by written confidentiality obligations that are no less protective than those set forth in Section 12 (Confidentiality) of the Agreement and the Mutual Non-Disclosure Agreement dated February 22, 2023, between Customer and Service Provider. Service Provider shall ensure that such confidentiality obligations are incorporated into the employment agreements or consulting agreements of all Authorized Personnel and that violations of such obligations are subject to disciplinary action, up to and including termination of employment or engagement.
5.4 Dedicated Service Delivery Manager. The dedicated Cedarpoint service delivery manager assigned to the Northgate account shall meet all personnel security requirements set forth in this Section 5, including background checks, security awareness training, and written confidentiality obligations. Service Provider shall notify Customer in writing at least fifteen (15) business days prior to any change in the assigned service delivery manager and shall ensure that any replacement service delivery manager satisfies all requirements of this Section 5 prior to assuming responsibilities on the Northgate account.
Section 6 — Security Incident and Breach Notification Procedures
6.1 Notification Timeline. Service Provider shall notify Customer of any Security Incident without unreasonable delay and in no event later than seventy-two (72) hours after Service Provider becomes aware of the Security Incident. For purposes of this Section 6.1, Service Provider shall be deemed to be "aware" of a Security Incident at the time any employee, contractor, or agent of Service Provider with responsibility for information security or incident response has a reasonable basis for concluding that a Security Incident has occurred. Notification shall be provided by telephone and confirmed in writing by email to the Customer contacts identified in Section 14.3 of this Exhibit E.
6.2 Initial Notification Content. The initial notification shall include, to the extent then known:
(a) A description of the nature and scope of the Security Incident, including the systems and facilities affected;
(b) The categories and approximate number of records affected or potentially affected;
(c) The date and time the Security Incident was discovered and, if known, the date and time the Security Incident is believed to have commenced;
(d) A description of the Customer Data involved or potentially involved, including the types and sensitivity classification of such data;
(e) A description of the measures taken or proposed to be taken to contain and remediate the Security Incident, including any immediate containment actions already implemented; and
(f) The name, title, telephone number, and email address of a designated point of contact at Service Provider who is knowledgeable about the Security Incident and authorized to coordinate with Customer.
6.3 Supplemental Notifications. Service Provider shall provide supplemental written notifications to Customer as additional information becomes available regarding the Security Incident. Service Provider shall provide Customer with a comprehensive root cause analysis within thirty (30) days of the date of discovery of the Security Incident. The root cause analysis shall identify the underlying cause of the Security Incident, the full scope and impact of the Security Incident, the timeline of events, and the corrective measures implemented or planned to prevent recurrence.
6.4 Coordination. Service Provider shall cooperate fully with Customer in investigating, remediating, and responding to any Security Incident, including without limitation: (a) preserving all evidence related to the Security Incident, including logs, system images, and forensic artifacts; (b) supporting forensic investigations conducted by Customer or its designated third-party forensic investigators; (c) coordinating with law enforcement authorities as required or as directed by Customer; (d) participating in joint incident response calls and meetings as reasonably requested by Customer; and (e) providing all information and assistance reasonably necessary for Customer to assess the impact of the Security Incident on its operations, regulatory obligations, and contractual commitments.
6.5 Regulatory Notifications. Service Provider shall assist Customer in complying with all applicable data breach notification obligations under Applicable Data Protection Laws, including by providing all information necessary for Customer to prepare and submit required notifications to regulatory authorities and affected individuals in a timely manner. Service Provider shall not independently notify any regulatory authority, affected individual, or third party regarding a Security Incident without Customer's prior written consent, except where Service Provider is independently required by applicable law to make such notification and where the delay necessary to obtain Customer's consent would result in a violation of such law. In the latter event, Service Provider shall provide Customer with as much advance notice as is reasonably practicable prior to making such notification and shall consult with Customer regarding the content and timing of the notification to the extent feasible.
6.6 Remediation. Service Provider shall promptly implement corrective measures to contain, remediate, and prevent the recurrence of any Security Incident. Service Provider shall provide Customer with a written remediation plan within fifteen (15) business days of the date of discovery of the Security Incident. The remediation plan shall describe the specific corrective actions to be taken, the responsible parties, the timeline for implementation, and the metrics by which the effectiveness of the corrective actions will be measured. Service Provider shall implement the remediation plan in accordance with the stated timeline and shall provide Customer with periodic status updates until all corrective actions have been completed.
6.7 Indemnification Tie-In. Security Incidents constituting data breaches caused by Service Provider's negligence or willful misconduct shall trigger Service Provider's indemnification obligations under Section 8 of the Agreement. Without limiting the foregoing, Service Provider shall indemnify, defend, and hold harmless Customer and its affiliates, officers, directors, employees, and agents from and against all losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and costs of litigation) arising out of or relating to any such data breach, including without limitation:
(a) Customer's costs of notifying affected individuals and regulatory authorities as required by Applicable Data Protection Laws;
(b) Costs of providing credit monitoring or identity theft protection services to affected individuals;
(c) Regulatory fines, penalties, and assessments imposed on Customer;
(d) Costs of forensic investigation and remediation;
(e) Litigation costs and settlement amounts arising from third-party claims; and
(f) Costs of public relations and crisis management.
Such indemnification obligations are uncapped pursuant to the carve-outs from Service Provider's aggregate indemnification cap set forth in Section 8 of the Agreement. For the avoidance of doubt, the indemnification obligations arising under this Section 6.7 are carved out from and are not subject to the aggregate indemnification cap of two hundred percent (200%) of the trailing twelve (12) month fees paid or payable under the Agreement, as expressly provided in Section 8 of the Agreement (i.e., the carve-outs applicable to data breaches and willful misconduct).
6.8 Insurance Coverage. Service Provider shall maintain in force at all times during the term of the Agreement, and for a period of three (3) years following termination or expiration of the Agreement, the following insurance coverages:
(a) Cyber Liability Insurance: Not less than Twenty-Five Million Dollars ($25,000,000) per occurrence and Fifty Million Dollars ($50,000,000) in the aggregate, covering claims arising from data breaches, Security Incidents, unauthorized access, network security failures, and privacy violations;
(b) Technology Errors and Omissions Insurance: Not less than Twenty Million Dollars ($20,000,000) per occurrence and Forty Million Dollars ($40,000,000) in the aggregate, covering claims arising from acts, errors, or omissions in the performance of the Services;
as further specified in Exhibit F (Insurance Requirements) to the Agreement. Service Provider's current carrier for both policies is Braeburn Mutual Insurance Company, 280 Farmington Avenue, Hartford, CT 06105. Service Provider shall promptly notify Customer of any material change in its insurance coverage, including any reduction in limits, cancellation, or non-renewal, and shall provide Customer with certificates of insurance upon request.
Section 7 — Audit Rights
7.1 Customer Audit Right. Customer and its designated representatives, including its external auditors, Dunmore & Pratt LLP, shall have the right, upon thirty (30) days' prior written notice to Service Provider, to audit Service Provider's compliance with the terms and conditions of this Exhibit E. Such audits may be conducted no more than once per calendar year under ordinary circumstances; provided, however, that Customer may conduct additional audits at any time following any Security Incident or upon a reasonable, good-faith belief that Service Provider is not in compliance with this Exhibit E. Service Provider shall cooperate fully with any such audit and shall provide reasonable access to Service Provider Systems, facilities, personnel, and records as necessary to conduct the audit.
7.2 Scope of Audit. Audits conducted under Section 7.1 may include, without limitation, a review and examination of the following:
(a) Service Provider's information security policies, procedures, and standards;
(b) Access control logs and records, including privileged account activity logs;
(c) Encryption practices, including key management procedures and certificate inventories;
(d) Personnel security records, including records of background checks and training completion (redacted as required by applicable law to protect personally identifiable information of Service Provider's personnel);
(e) Incident response records, including Security Incident reports, root cause analyses, and remediation plans;
(f) SOC 2 Type II reports or equivalent third-party audit reports;
(g) Vulnerability scan results and penetration testing reports;
(h) Business continuity and disaster recovery plans and test results; and
(i) Physical inspection of the Reston, VA NOC facility (11400 Commerce Park Drive, Suite 600, Reston, VA 20191) and the Winnipeg, MB NOC facility (200 Portage Avenue, Suite 1500, Winnipeg, MB R3C 3X2, Canada), subject to Service Provider's reasonable physical security and visitor management protocols.
7.3 Cost Allocation. Routine annual audits conducted under Section 7.1 shall be conducted at Customer's cost, including the fees and expenses of Customer's auditors and representatives. Audits triggered by a confirmed Security Incident that was caused by Service Provider's negligence or willful misconduct shall be conducted at Service Provider's cost, including reimbursement of Customer's reasonable fees and expenses for auditors and forensic investigators.
7.4 Third-Party Certifications. Service Provider shall, at Service Provider's own cost, obtain and maintain an annual SOC 2 Type II report (or equivalent third-party certification) covering the Service Provider Systems used to deliver the Services, including the Reston NOC and Winnipeg NOC facilities and the ArcMesh platform. The SOC 2 Type II report shall cover the security, availability, and confidentiality trust services criteria. Service Provider shall provide a copy of the most recent SOC 2 Type II report to Customer within thirty (30) days of Customer's written request. Service Provider shall promptly notify Customer of any qualified opinion, material exceptions, or material deficiencies identified in any SOC 2 Type II report.
7.5 Remediation of Findings. Service Provider shall develop and implement a corrective action plan to address any material deficiencies identified during an audit conducted under this Section 7 within thirty (30) days of receipt of the written audit findings from Customer. The corrective action plan shall describe the specific remedial actions to be taken, the responsible parties, and the timeline for completion. Customer shall have the right to verify the implementation and effectiveness of the corrective actions through follow-up review or inspection, at Service Provider's cost if the original deficiency resulted from Service Provider's negligence or willful misconduct.
Section 8 — Data Localization
8.1 Primary Processing Locations. Customer Data shall be processed, stored, and accessed only at the following approved locations:
(a) Service Provider's Reston NOC facility, located at 11400 Commerce Park Drive, Suite 600, Reston, VA 20191, United States;
(b) Service Provider's Winnipeg NOC facility, located at 200 Portage Avenue, Suite 1500, Winnipeg, MB R3C 3X2, Canada;
(c) Customer's principal office, located at 1700 Market Street, Suite 2400, Philadelphia, PA 19103, United States; and
(d) The three hundred forty (340) managed node locations listed in Schedule 1 to the Agreement, distributed across twenty-eight (28) United States states and three (3) Canadian provinces.
Service Provider shall not process, store, or access Customer Data at any location other than those listed above without Customer's prior written consent.
8.2 No Offshore Processing. Service Provider shall not process, store, transmit, or access Customer Data from any location outside of the United States and Canada without Customer's prior written consent. This restriction applies to all forms of access, including remote access by Service Provider's personnel, contractors, or agents, and to all forms of processing, including disaster recovery and backup operations. Service Provider represents and warrants that, as of the effective date of the Agreement, no Customer Data is processed, stored, or accessed from any location outside the United States and Canada.
8.3 Subcontractors. Service Provider shall not engage any subcontractor, sub-processor, or other third party to process, store, access, or handle Customer Data without Customer's prior written approval. Any request for such approval shall be submitted in writing at least thirty (30) days prior to the proposed engagement and shall include the identity of the proposed subcontractor, the services to be performed, the locations from which Customer Data will be accessed or processed, and a description of the subcontractor's data security practices. Any approved subcontractor shall be bound by written data security and privacy obligations no less protective than those set forth in this Exhibit E, as further specified in Section 13.
8.4 Cross-Border Transfers. To the extent Customer Data includes Personal Data of Canadian residents, Service Provider shall comply with PIPEDA and any applicable provincial privacy legislation governing cross-border transfers of Personal Data between Canada and the United States. Service Provider shall implement appropriate contractual safeguards, as required by applicable Canadian privacy law, to ensure that Personal Data transferred from Canada to the United States receives a level of protection substantially equivalent to that provided under Canadian law. Service Provider shall cooperate with Customer in responding to any inquiries from the Office of the Privacy Commissioner of Canada or any provincial privacy commissioner regarding cross-border transfers of Personal Data.
Section 9 — Data Retention and Destruction
9.1 Retention During Term. Service Provider shall retain Customer Data only for so long as necessary to perform the Services and as required by the Agreement and any applicable Statement of Work (Exhibit A). Service Provider shall not retain copies of Customer Data, including backup copies, cached copies, or archived copies, beyond the retention periods specified in the Agreement or the applicable Statement of Work, unless such retention is required under Section 9.4 below. Service Provider shall implement automated processes, where practicable, to enforce data retention policies and to identify and securely dispose of Customer Data that has exceeded its applicable retention period.
9.2 Return of Data Upon Termination or Expiration. Upon termination or expiration of the Agreement, including termination upon a change of control event under Schedule 2 to the Agreement or termination for cause under Section 7 of the Agreement, Service Provider shall, at Customer's election and written direction:
(a) Return all Customer Data to Customer in a mutually agreed machine-readable format (e.g., standard database export formats, CSV, JSON, or XML) within thirty (30) days of Customer's written request; or
(b) Securely destroy all Customer Data, including all copies, backups, and archived instances, in accordance with the destruction standards set forth in Section 9.3 below, and certify such destruction in writing, signed by an authorized officer of Service Provider, within forty-five (45) days of Customer's written request.
If Customer does not make an election within thirty (30) days following termination or expiration, Service Provider shall securely destroy all Customer Data in accordance with Section 9.3 and provide the written certification described in Section 9.2(b) above.
9.3 Destruction Standards. Destruction of Customer Data shall be performed in accordance with NIST Special Publication 800-88, Revision 1 (Guidelines for Media Sanitization), or an equivalent standard recognized by NIST. Destruction shall render Customer Data permanently and irreversibly unrecoverable, regardless of the media on which it is stored. For electronic media, destruction methods shall include, as appropriate, cryptographic erasure, secure overwriting, degaussing, or physical destruction. Service Provider shall maintain records of all Customer Data destruction activities, including the date of destruction, the method employed, the media destroyed, and the identity of the individual who performed or supervised the destruction.
9.4 Exceptions for Legal Holds. Notwithstanding the foregoing, Service Provider may retain Customer Data beyond the periods specified in Section 9.2 solely to the extent required by applicable law, regulation, or a legal hold imposed by a court, regulatory authority, or law enforcement agency. In such event, Service Provider shall: (a) promptly notify Customer in writing of the nature and scope of the retention requirement; (b) limit the retention to the minimum amount of Customer Data necessary to comply with the applicable requirement; and (c) continue to protect the retained Customer Data in accordance with all applicable provisions of this Exhibit E for so long as such data remains in Service Provider's possession or control.
9.5 Transition and Wind-Down. During any transition or wind-down period associated with the termination or expiration of the Agreement, including without limitation the one hundred eighty (180) day termination notice period following a change of control election under Schedule 2 to the Agreement, and during the migration from Greystone Halcyon Software legacy MPLS infrastructure to the ArcMesh platform, Service Provider shall continue to comply in full with all data security and privacy obligations set forth in this Exhibit E. Service Provider shall cooperate with Customer and any successor service provider designated by Customer in the orderly transition of Customer Data, including providing reasonable technical assistance to facilitate data migration, ensuring continued access to Customer Data during the transition period, and coordinating with Customer's team to minimize disruption to the managed network operations.
Section 10 — Compliance with Applicable Data Protection Laws
10.1 General Compliance. Service Provider shall comply with all Applicable Data Protection Laws in its performance of the Services, including without limitation:
(a) All applicable United States state data privacy and data breach notification statutes across the twenty-eight (28) US states in which managed nodes are located;
(b) PIPEDA and applicable provincial privacy legislation in the three (3) Canadian provinces in which managed nodes are located;
(c) Any applicable telecommunications regulations issued by the FCC or the CRTC, to the extent such regulations impose data security or privacy requirements on the processing, transmission, or storage of Customer Data over the managed network; and
(d) Any other Applicable Data Protection Laws that may apply to Service Provider's activities in connection with the Services.
Service Provider shall maintain sufficient knowledge and expertise regarding Applicable Data Protection Laws to ensure ongoing compliance and shall designate an internal privacy officer or equivalent role with responsibility for overseeing compliance with Applicable Data Protection Laws.
10.2 Regulatory Changes. Service Provider shall monitor changes in Applicable Data Protection Laws on an ongoing basis and shall notify Customer in writing within thirty (30) days of becoming aware of any enacted or proposed change that materially affects Service Provider's obligations under this Exhibit E or the Agreement. The parties shall cooperate in good faith to assess the impact of any such change and to implement any necessary modifications to the Services, Service Provider's information security program, or this Exhibit E to ensure continued compliance. Any amendments to this Exhibit E required by changes in Applicable Data Protection Laws shall be documented in writing and signed by both parties in accordance with Section 16.3.
10.3 Regulatory Penalties. Service Provider's failure to comply with Applicable Data Protection Laws in connection with the performance of the Services that results in regulatory penalties, fines, assessments, or enforcement actions imposed on Customer shall trigger Service Provider's indemnification obligations under Section 8(d) of the Agreement, which provides for indemnification of Customer against regulatory penalties arising from Service Provider's failure to comply with applicable telecommunications regulations and data protection requirements. Service Provider acknowledges that such indemnification obligations are in addition to, and not in lieu of, any other indemnification obligations set forth in the Agreement or this Exhibit E.
10.4 Data Protection Impact Assessments. Service Provider shall cooperate with Customer in conducting data protection impact assessments ("DPIAs") where required by Applicable Data Protection Laws or where Customer reasonably determines that a DPIA is appropriate in connection with the Services. Such cooperation shall include providing Customer with information regarding Service Provider's data processing activities, security controls, and risk assessments, as well as implementing any additional safeguards identified through the DPIA process.
10.5 Records of Processing. Service Provider shall maintain accurate and up-to-date records of processing activities involving Customer Data. Such records shall be sufficient to demonstrate compliance with Applicable Data Protection Laws and to support Customer's own compliance obligations, including any obligations to maintain records of processing activities under applicable Canadian privacy law. Records of processing shall include, at a minimum: (a) the categories of Customer Data processed; (b) the purposes of processing; (c) the categories of recipients to whom Customer Data has been or may be disclosed; (d) a description of the technical and organizational security measures applied to Customer Data; and (e) the locations at which Customer Data is processed and stored. Service Provider shall make such records available to Customer upon request.
Section 11 — Network Security and Monitoring
11.1 Cybersecurity Monitoring. Service Provider shall provide twenty-four hours per day, seven days per week (24×7) cybersecurity monitoring, threat detection, and incident response for the managed network perimeter and all Service Provider Systems processing or transmitting Customer Data, as further described in Exhibit A (Statement of Work) to the Agreement. Cybersecurity monitoring shall include real-time analysis of network traffic, security event correlation, alerting on suspicious or anomalous activity, and escalation of potential Security Incidents in accordance with Section 6 of this Exhibit E.
11.2 Vulnerability Management. Service Provider shall conduct automated vulnerability scans of all Service Provider Systems that process, store, or transmit Customer Data at least quarterly. In addition, Service Provider shall conduct external penetration testing of Service Provider Systems at least annually, utilizing qualified third-party penetration testing firms. Results of vulnerability scans and penetration tests shall be made available to Customer within fifteen (15) business days of completion. Service Provider shall prioritize and remediate identified vulnerabilities in accordance with a risk-based approach, with critical and high-severity vulnerabilities remediated within the timeframes specified in Section 11.3 below.
11.3 Patch Management. Service Provider shall apply critical security patches to all Service Provider Systems, including the ArcMesh platform (version 4.2), within seventy-two (72) hours of the vendor's release of the patch. Non-critical security patches shall be applied within thirty (30) calendar days of release. Service Provider shall maintain a documented patch management process that includes testing, approval, deployment, and verification procedures. In the event that a critical patch cannot be applied within the seventy-two (72) hour window due to compatibility or operational constraints, Service Provider shall implement compensating controls to mitigate the associated risk and shall notify Customer in writing of the delay and the compensating controls implemented.
11.4 Logging and Monitoring. Service Provider shall maintain security event logs for all Service Provider Systems processing, storing, or transmitting Customer Data. Logs shall include, at a minimum, records of user authentication events, administrative access events, configuration changes, data access events, and security alerts. Security event logs shall be retained for a minimum of twelve (12) months and shall be available to Customer for review upon request and during audits conducted under Section 7 of this Exhibit E. Logs shall be protected against unauthorized modification or deletion through the use of write-once storage, integrity monitoring, or equivalent controls.
11.5 Intrusion Detection/Prevention. Service Provider shall deploy and maintain network-based intrusion detection systems ("IDS") and intrusion prevention systems ("IPS") at each NOC facility, specifically the Reston, VA primary NOC and the Winnipeg, MB secondary NOC. IDS/IPS systems shall be configured to detect and, where appropriate, automatically block known attack patterns, malicious traffic, and unauthorized access attempts. IDS/IPS signatures and rules shall be updated on a regular basis to address emerging threats. Service Provider shall monitor IDS/IPS alerts on a 24×7 basis and shall escalate and respond to confirmed intrusion events in accordance with the incident response procedures set forth in Section 6.
Section 12 — Business Continuity and Disaster Recovery
12.1 BCP/DR Plans. Service Provider shall maintain comprehensive, documented business continuity plans ("BCP") and disaster recovery plans ("DRP") covering all Service Provider Systems and the Services. BCP/DRP plans shall address, at a minimum, the following scenarios: natural disasters, power outages, network failures, hardware failures, cyberattacks, pandemic events, and other events that could disrupt the continuity of the Services. BCP/DRP plans shall be reviewed and updated at least annually and shall be tested through tabletop exercises, simulation exercises, or full failover tests at least annually. Service Provider shall provide Customer with a summary of BCP/DRP test results within thirty (30) days of each test.
12.2 Recovery Objectives. Service Provider's disaster recovery plans shall target a recovery time objective ("RTO") and recovery point objective ("RPO") consistent with the service level agreement requirements set forth in Exhibit B to the Agreement, including the commitment to maintain ninety-nine and ninety-five hundredths percent (99.95%) monthly uptime per managed node. Service Provider shall design and maintain its disaster recovery infrastructure to achieve the RTO and RPO targets and shall provide Customer with documentation of the specific RTO and RPO targets applicable to each critical component of the Services.
12.3 Redundancy. Service Provider shall maintain geographic redundancy between its Reston, VA primary NOC facility and its Winnipeg, MB secondary NOC facility to ensure continuity of the 24×7 monitoring, management, and incident response services provided under the Agreement. Geographic redundancy shall include, at a minimum, redundant monitoring systems, redundant management consoles, replicated configuration data, and failover capabilities that allow the secondary NOC to assume full operational responsibility for the managed network in the event of a failure or unavailability of the primary NOC. Service Provider shall test failover procedures between the two NOC facilities at least annually.
12.4 Customer Notification. Service Provider shall notify Customer promptly, and in no event later than one (1) hour after the initiation of any disaster recovery activation, of any disaster recovery event affecting the Services. Service Provider shall provide Customer with regular status updates at intervals of no less than every four (4) hours until normal operations are fully restored. Notifications shall include a description of the event, the systems and Services affected, the estimated time to recovery, and any actions required of Customer.
Section 13 — Subcontractor and Third-Party Management
13.1 Approval Requirement. As set forth in Section 8.3 of this Exhibit E, no subcontractor or sub-processor may access, process, store, or handle Customer Data without Customer's prior written consent. Service Provider shall submit requests for subcontractor approval in writing, providing sufficient detail for Customer to evaluate the proposed subcontractor's qualifications, data security practices, and compliance posture.
13.2 Flow-Down Obligations. All approved subcontractors shall be contractually bound by data security and privacy obligations that are at least as protective as those set forth in this Exhibit E. Service Provider shall ensure that subcontractor agreements include, at a minimum, obligations regarding data handling standards, encryption, access controls, personnel security, Security Incident notification, data localization, data retention and destruction, compliance with Applicable Data Protection Laws, and audit rights. Service Provider shall provide Customer with copies of the data security provisions of subcontractor agreements upon Customer's request.
13.3 Liability. Service Provider shall remain fully liable for the acts and omissions of its subcontractors and sub-processors as if they were Service Provider's own acts and omissions. The engagement of a subcontractor or sub-processor shall not relieve Service Provider of any obligation under this Exhibit E or the Agreement. Service Provider shall be responsible for ensuring that all subcontractors comply with the terms of this Exhibit E and shall be liable for any failure by a subcontractor to do so.
13.4 Inventory. Service Provider shall maintain and provide to Customer a current, complete list of all subcontractors and sub-processors with access to Customer Data, including the name, address, and description of services performed by each subcontractor. Such list shall be updated at least annually and shall be provided to Customer within ten (10) business days of Customer's written request. Service Provider shall notify Customer in writing at least thirty (30) days prior to engaging any new subcontractor or sub-processor or materially changing the scope of any existing subcontractor's engagement.
Section 14 — Cooperation and Reporting
14.1 Quarterly Security Reports. Service Provider shall provide Customer with written quarterly reports summarizing Service Provider's security posture and compliance with this Exhibit E. Quarterly reports shall include, at a minimum: (a) a summary of any Security Incidents during the reporting period, including status and resolution; (b) vulnerability scan results and remediation status; (c) patch management status, including any outstanding critical patches; (d) access review results and any remedial actions taken; (e) key compliance metrics; and (f) any material changes to Service Provider's information security program. Quarterly reports shall be delivered to Customer within fifteen (15) business days of the end of each calendar quarter, and shall be timed to coincide with the quarterly network performance reviews described in Exhibit A to the Agreement.
14.2 Annual Certification. Service Provider shall provide an annual written certification, signed by an officer of Service Provider with appropriate authority and knowledge, confirming Service Provider's compliance with the terms and conditions of this Exhibit E during the preceding twelve (12) month period. The annual certification shall be delivered to Customer within sixty (60) days of the end of each calendar year and shall identify any known instances of non-compliance and the corrective actions taken or planned.
14.3 Customer Contacts. All notices, reports, and communications regarding data security and privacy matters under this Exhibit E shall be directed to the following Customer representatives:
VP of Network Operations: Katrina Bosch Northgate Americas, Inc. 1700 Market Street, Suite 2400 Philadelphia, PA 19103 United States
Chief Technology Officer: Alistair Pemberton Northgate Telecommunications PLC 45 Threadneedle Court London EC2R 8AH United Kingdom
Customer may update the above contact information by written notice to Service Provider in accordance with the notice provisions of the Agreement.
14.4 Service Provider Contacts. All notices, reports, and communications regarding data security and privacy matters under this Exhibit E shall be directed to the following Service Provider representative:
General Counsel: Nadia Okafor Cedarpoint Systems Integration, Inc. 11400 Commerce Park Drive, Suite 600 Reston, VA 20191 United States
Service Provider may update the above contact information by written notice to Customer in accordance with the notice provisions of the Agreement.
Section 15 — Remedies
15.1 Material Breach. A material or persistent failure by Service Provider to comply with the obligations set forth in this Exhibit E shall constitute a material breach of the Agreement, entitling Customer to exercise its termination rights under the Agreement, including without limitation the right to terminate the Agreement for cause under Section 7 of the Agreement. Service Provider acknowledges that Customer's decision to enter into the Agreement was made in material reliance upon Service Provider's commitment to comply with the data security and privacy requirements set forth herein.
15.2 Indemnification. Without limiting the generality of Section 8 of the Agreement, Service Provider's indemnification obligations for data breaches caused by Service Provider's negligence or willful misconduct are uncapped and are carved out from the aggregate indemnification cap of two hundred percent (200%) of the trailing twelve (12) month fees paid or payable under the Agreement, as expressly provided in Section 8 of the Agreement. For reference purposes, Customer's aggregate indemnification obligations under the Agreement remain capped at one hundred percent (100%) of the trailing twelve (12) month fees, which based on the current annual fee structure is approximately Fifteen Million Dollars ($15,000,000) per year. The parties acknowledge that the asymmetric indemnification structure reflects the allocation of risk appropriate to Service Provider's role as custodian and processor of Customer Data.
15.3 Equitable Relief. Customer shall be entitled to seek injunctive relief, specific performance, or other equitable relief in the event of any actual or threatened breach of this Exhibit E by Service Provider, without the necessity of proving actual damages or posting a bond or other security. Service Provider acknowledges that a breach of the data security and privacy obligations set forth in this Exhibit E could cause irreparable harm to Customer for which monetary damages would be an inadequate remedy.
15.4 Survival. The obligations of this Exhibit E relating to data retention, destruction, and return of Customer Data (Section 9), confidentiality of Customer Data, indemnification (Sections 6.7, 10.3, and 15.2), and the post-termination audit and cooperation rights of Customer shall survive the termination or expiration of the Agreement and shall continue in full force and effect for so long as Service Provider retains any Customer Data and, with respect to indemnification obligations, for the applicable statute of limitations period.
Section 16 — Miscellaneous
16.1 Governing Law. This Exhibit E shall be governed by and construed in accordance with the laws of the State of New York, without giving effect to any choice or conflict of law provision or rule that would cause the application of the laws of any other jurisdiction, consistent with the governing law provision set forth in the Agreement.
16.2 Conflict. In the event of any conflict or inconsistency between the terms of this Exhibit E and the body of the Agreement, the terms of this Exhibit E shall control with respect to data security and privacy matters. In the event of any conflict or inconsistency between the terms of this Exhibit E and any Statement of Work or other Exhibit to the Agreement, the terms of this Exhibit E shall control with respect to data security and privacy matters, unless the Statement of Work or other Exhibit expressly states that it is intended to override a specific provision of this Exhibit E and is signed by both parties.
16.3 Amendments. This Exhibit E may be amended, modified, or supplemented only by a written instrument duly executed by authorized representatives of both parties. No oral agreement, course of dealing, or course of performance shall be deemed to amend or modify this Exhibit E.
16.4 Entire Agreement. This Exhibit E, together with the Agreement and all other Exhibits, Schedules, and Statements of Work attached thereto or incorporated therein by reference, constitutes the entire agreement of the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, understandings, negotiations, and discussions, whether oral or written, between the parties relating to the data security and privacy requirements applicable to the Services.
INCORPORATION
This Exhibit E is incorporated into and forms part of the Master Services Agreement dated June 9, 2023 between Northgate Americas, Inc. and Cedarpoint Systems Integration, Inc. This Exhibit E does not require a separate signature block and is effective upon execution of the Agreement. The signature pages of Warren Liang, on behalf of Northgate Americas, Inc., and Rajiv Sundaram, on behalf of Cedarpoint Systems Integration, Inc., affixed to the Agreement shall govern this Exhibit E.
Exhibit E — Data Security and Privacy Requirements — Page 1 of Exhibit E to the Master Services Agreement dated June 9, 2023 between Northgate Americas, Inc. and Cedarpoint Systems Integration, Inc.

EXHIBIT E

DATA SECURITY AND PRIVACY REQUIREMENTS

INCORPORATION

Record

Parties

Dates

Amounts