1025-00003 · Delaware corp · Charters/Execution Versions

charter-tech-cybersecurity-committee.docx DOCUMENT Capital Markets

12 / 35 ← → ✕

CHARTER OF THE TECHNOLOGY & CYBERSECURITY OVERSIGHT COMMITTEE OF THE BOARD OF DIRECTORS OF QUORUM INSURANCE HOLDINGS CORP.

Adopted by the Board of Directors on December 11, 2025

This Charter establishes the Technology & Cybersecurity Oversight Committee as the sixth standing committee of the Board of Directors of Quorum Insurance Holdings Corp., a Delaware corporation (NYSE: QIHC).

Right-click to update Table of Contents

ARTICLE I — PURPOSE

The Board of Directors (the "Board") of Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), a Delaware corporation incorporated under the Delaware General Corporation Law (the "DGCL"), hereby creates the Technology & Cybersecurity Oversight Committee (the "Committee") as a standing committee of the Board, established pursuant to Section 141(c) of the DGCL and Article III, Section 3.3 of the Company's Second Amended and Restated Bylaws (as further amended, the "Bylaws").

The Committee's overarching purpose is to assist the Board in fulfilling its oversight responsibilities with respect to the Company's technology strategy, cybersecurity program, data privacy compliance, artificial intelligence governance, insurtech initiatives, third-party technology risk management, and incident response preparedness. In establishing this Committee, the Board recognizes that technology and cybersecurity matters are integral to the Company's ability to conduct its multi-line insurance and financial technology operations in a manner that protects the interests of the Company's shareholders, policyholders, customers, employees, and other stakeholders.

The creation of the Committee reflects the Company's recognition of the growing significance of technology and cybersecurity risks to its multi-line insurance and fintech operations, including its regulated insurance subsidiaries — Quorum Property & Casualty Insurance Company ("Quorum P&C"), Lone Star Specialty Insurance Company ("Lone Star Specialty"), and Great Lakes Surety & Indemnity Co. ("Great Lakes Surety") — and its financial technology subsidiary, Vantage Digital Insurance Solutions, Inc. ("Vantage Digital"). The Company's operations are increasingly dependent upon digital platforms, data-intensive underwriting processes, cloud-based infrastructure, and customer-facing technology tools, each of which introduces technology and cybersecurity risks that warrant dedicated Board-level oversight.

The establishment of this Committee is further informed by governance benchmarking conducted by Apex Proxy Advisors, Inc., as set forth in its report dated June 30, 2025 (the "Apex Benchmarking Report"), which found that eleven (11) of fourteen (14) peer publicly traded insurance holding companies had adopted either a standalone technology and cybersecurity committee of their boards of directors or had added explicit cybersecurity oversight responsibilities to the charters of existing board committees. The Apex Benchmarking Report noted that the creation of a dedicated committee structure reflects emerging best practices in insurance industry governance and is responsive to heightened regulatory expectations, investor scrutiny, and the evolving threat landscape.

Notwithstanding the foregoing, the Committee's role is one of oversight. Management is responsible for the design, implementation, and day-to-day operation of the Company's technology and cybersecurity programs. The Committee shall not assume or displace management's operational responsibilities, but rather shall provide informed and constructive oversight to ensure that management's technology and cybersecurity efforts are adequate, appropriately resourced, and aligned with the Company's strategic objectives and risk appetite.

ARTICLE II — COMPOSITION

Section 2.1 — Number of Members

The Committee shall consist of no fewer than three (3) members of the Board of Directors. The Board may, from time to time, increase the size of the Committee as the Board deems appropriate, provided that the Committee shall at all times maintain a minimum of three (3) voting members.

All voting members of the Committee shall be "independent directors" as defined by the New York Stock Exchange ("NYSE") Listed Company Manual Section 303A and applicable rules and regulations of the U.S. Securities and Exchange Commission (the "SEC"). Each voting member shall satisfy such independence requirements at the time of appointment and throughout such member's service on the Committee. In the event that a voting member ceases to meet the applicable independence requirements, such member shall promptly notify the Chairperson and the Corporate Secretary, and the Board shall take appropriate action to address the matter, which may include removal and replacement of the affected member.

The Board may, in its discretion, appoint one or more non-voting advisory members from among the Company's management directors to serve on the Committee at the pleasure of the Board. Non-voting advisory members shall be entitled to attend meetings, participate in discussions, and receive all materials distributed to Committee members, but shall not have the right to vote on any matter before the Committee. Non-voting advisory members shall not count toward the minimum membership requirement set forth in this Section 2.1 or toward the quorum requirements set forth in Section 3.2 of this Charter.

Section 2.2 — Qualifications

At least one (1) voting member of the Committee shall possess cybersecurity expertise or technology expertise, as defined in Section 2.3 below. The Board shall identify such member or members in the Company's annual proxy statement, to the extent required or recommended by applicable rules, regulations, or governance best practices.

Members of the Committee should collectively possess a mix of competencies relevant to the Committee's oversight responsibilities, including, without limitation, experience in information technology, cybersecurity, data privacy, digital transformation, financial technology, artificial intelligence, enterprise risk management related to technology, and insurance or financial services operations. The Nominating & Corporate Governance Committee shall consider the desired mix of technology-related competencies when evaluating candidates for service on this Committee.

Section 2.3 — Definition of Cybersecurity or Technology Expertise

For purposes of this Charter, a member of the Committee shall be deemed to possess "cybersecurity or technology expertise" if, through education, professional experience (including service as a chief information officer, chief technology officer, chief information security officer, or in an equivalent executive role), or other relevant background, such member has acquired:

(a) an understanding of cybersecurity threats, vulnerabilities, and risk mitigation frameworks, including familiarity with recognized cybersecurity standards and best practices;

(b) experience overseeing or managing technology strategy, digital platforms, information security programs, or technology-driven business operations at a significant organization; or

(c) professional certifications (such as CISSP, CISM, CISA, or equivalent designations), academic credentials (such as advanced degrees in computer science, information security, or related disciplines), or board-level experience related to technology governance or cybersecurity oversight at a publicly traded company or other significant enterprise.

The determination of whether a member possesses cybersecurity or technology expertise shall be made by the Board in its business judgment, considering the totality of such member's qualifications and experience. Nothing in this Section 2.3 shall be construed to impose upon any member of the Committee any duties or obligations greater than those imposed by applicable law on directors generally.

Section 2.4 — Appointment and Removal

Members of the Committee shall be appointed annually by the Board upon the recommendation of the Nominating & Corporate Governance Committee (currently chaired by Arthur J. Pennington, Lead Independent Director) at the first regular meeting of the Board following the annual meeting of shareholders, and shall serve until their successors are duly appointed or until their earlier resignation, removal from the Committee, or cessation of service as a director of the Company. A member's service on the Committee shall automatically terminate upon such member's departure from the Board for any reason.

The Board may remove or replace any member of the Committee at any time, with or without cause, by the affirmative vote of a majority of the directors then in office. In the event of a vacancy on the Committee, the Board may appoint a successor member at any regular or special meeting of the Board, upon the recommendation of the Nominating & Corporate Governance Committee.

Section 2.5 — Chairperson

The Board shall designate one voting member of the Committee as Chairperson. The Chairperson shall preside at all meetings of the Committee, set the agenda for each meeting in consultation with management and other committee chairs, and serve as the primary liaison between the Committee and the full Board. The Chairperson shall report to the full Board on the Committee's activities, findings, and recommendations as set forth in Article VI of this Charter.

In the absence of the Chairperson at any meeting, the voting members of the Committee present at such meeting shall designate an acting chairperson from among themselves to preside at such meeting.

Section 2.6 — Initial Members

The initial members of the Committee, effective upon adoption of this Charter by the Board on December 11, 2025, shall be:

Priya Narasimhan — Chairperson. Ms. Narasimhan is an independent director of the Company and serves as Chief Executive Officer of Tessera Fintech Corp. She has served as a director of the Company since 2023. Ms. Narasimhan possesses technology expertise within the meaning of Section 2.3 of this Charter, based on her extensive experience leading technology-driven financial services businesses.

Victor L. Andrade — Voting Member. Mr. Andrade is an independent director of the Company and previously served as Executive Vice President of Federated Mutual Insurance Holdings, where he oversaw enterprise risk management and technology modernization initiatives. He has served as a director of the Company since 2018.

Camille R. DuPont — Non-Voting Advisory Member. Ms. DuPont is a management director of the Company and serves as President of Vantage Digital Insurance Solutions, Inc., the Company's financial technology subsidiary. Ms. DuPont is not independent within the meaning of NYSE Listed Company Manual Section 303A and accordingly serves as a non-voting advisory member. Her participation on the Committee provides valuable operational insight into the Company's technology platforms and digital strategy.

The Board anticipates that, following the 2026 annual meeting of shareholders, a third independent director with relevant technology or cybersecurity experience may be added as a voting member of the Committee, and the Board has directed the Nominating & Corporate Governance Committee to include technology and cybersecurity expertise in the director recruitment profile for the 2026 Board refreshment cycle.

ARTICLE III — MEETINGS

Section 3.1 — Frequency

The Committee shall meet at least four (4) times per calendar year on a quarterly basis, with meetings generally scheduled to occur in advance of regularly scheduled meetings of the full Board. The Committee may meet more frequently as circumstances require, including in response to significant cybersecurity incidents, material technology developments, or emerging regulatory matters.

Additional special meetings of the Committee may be called at any time by the Chairperson, by any two (2) voting members of the Committee, or at the request of any of the following officers of the Company: the Chair of the Board and Chief Executive Officer (Margaret A. Calloway), the General Counsel and Corporate Secretary (Dennis R. Okonkwo), or the Chief Compliance Officer (Ivan D. Pruett). Notice of special meetings shall be given to all members of the Committee in accordance with the notice provisions of the Bylaws applicable to committees of the Board.

Meetings of the Committee may be held in person or by means of telephone, video conference, or other communications equipment by means of which all persons participating in the meeting can hear one another, in accordance with DGCL § 141(i).

Section 3.2 — Quorum

A majority of the voting members of the Committee shall constitute a quorum for the transaction of business at any meeting of the Committee. Non-voting advisory members shall not be counted for purposes of determining whether a quorum is present. If a quorum is not present at any meeting, the members present may adjourn the meeting to another time and place without further notice, except as may be required by the Bylaws.

Section 3.3 — Voting

All actions of the Committee shall be taken by a majority vote of the voting members present at a meeting at which a quorum is present. Each voting member shall have one vote. In the event of a tie, the matter shall be referred to the full Board for resolution.

The Committee may also act by unanimous written consent in lieu of a meeting, in accordance with Section 141(f) of the DGCL and the applicable provisions of the Bylaws. Any action taken by unanimous written consent shall have the same force and effect as if taken at a duly convened meeting of the Committee.

Section 3.4 — Attendance of Non-Members

The Committee may invite members of management, including the Chief Information Officer, Chief Information Security Officer, Chief Technology Officer, or equivalent officers, to attend meetings of the Committee as the Committee deems appropriate. The Committee may also invite the Chief Audit Executive (Renata M. Vásquez), external advisors, legal counsel, and other persons to attend meetings to provide information, expertise, or reports relevant to the Committee's agenda.

The Committee shall meet in executive session (without any members of management present) at least once per calendar year. During executive sessions, the Committee may discuss matters that, in the judgment of the Chairperson, are best addressed without management participation, including the effectiveness of management's cybersecurity and technology leadership, the adequacy of management's reporting to the Committee, and any concerns raised by Committee members regarding the Company's technology or cybersecurity posture.

Section 3.5 — Agenda and Minutes

The Chairperson, in consultation with the Corporate Secretary's office, shall be responsible for establishing the agenda for each meeting of the Committee. The agenda shall be distributed to Committee members, together with any supporting materials, in advance of each meeting, with the goal of providing materials at least five (5) business days prior to each regularly scheduled meeting, to the extent practicable.

Minutes of each meeting of the Committee shall be prepared and maintained by the Corporate Secretary or his or her designee. The minutes shall accurately reflect the matters discussed, the actions taken, and the votes cast at each meeting. The minutes shall be submitted to the Committee for approval and, following approval, shall be made available to the full Board of Directors. All minutes and supporting materials shall be retained in accordance with the Company's document retention policy.

ARTICLE IV — AUTHORITY AND RESPONSIBILITIES

The Committee shall have the following authority and responsibilities, in addition to any other duties that may be assigned to the Committee by the Board from time to time. In discharging its responsibilities, the Committee shall have full access to all books, records, facilities, and personnel of the Company and its subsidiaries, and shall have the authority to direct any officer or employee of the Company to provide such information and assistance as the Committee may require.

Section 4.1 — Cybersecurity Program Oversight

The Committee shall oversee the Company's enterprise cybersecurity program, including the adequacy and effectiveness of the Company's cybersecurity policies, procedures, and controls. The Committee's cybersecurity oversight responsibilities shall include, without limitation, the following:

(a) Risk Profile Assessment. Review and assess the Company's cybersecurity risk profile, including the identification and evaluation of threats, vulnerabilities, and mitigation strategies across the holding company and all subsidiaries, including Quorum P&C, Lone Star Specialty, Great Lakes Surety, Quorum MGA Services, LLC ("Quorum MGA"), and Vantage Digital. The Committee shall consider the cybersecurity risk profile in the context of the Company's overall risk appetite and tolerance, as established by the Board and the Risk Committee.

(b) Regular Reporting. Receive and review regular reports from the Chief Information Security Officer (or equivalent officer) on the state of the cybersecurity program, including key risk indicators, vulnerability assessments, penetration testing results, threat intelligence, security operations metrics, and the status of remediation efforts. Such reports shall be provided at each regularly scheduled meeting of the Committee, or more frequently as the Committee may request.

(c) Framework Oversight. Oversee management's implementation and maintenance of recognized cybersecurity frameworks (including, as applicable, the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, ISO/IEC 27001, and the Center for Internet Security ("CIS") Controls) and evaluate the maturity and effectiveness of such frameworks on a periodic basis, including through the review of independent assessments and audit findings.

(d) Cybersecurity Insurance. Review, in coordination with the Risk Committee, the Company's cybersecurity insurance coverage, including the adequacy of coverage limits, policy terms, and exclusions.

Section 4.2 — Information Technology Strategy

The Committee shall review and provide oversight of the Company's information technology ("IT") strategic plan, including investments in technology infrastructure, digital transformation initiatives, and technology modernization programs. In fulfilling this responsibility, the Committee shall:

(a) Strategic Plan Review. Review the Company's multi-year IT strategic plan, including the prioritization of technology initiatives, anticipated capital and operating expenditures, and expected business outcomes. The Committee shall assess the alignment of the IT strategic plan with the Company's overall business strategy, financial objectives, and competitive positioning.

(b) Major Projects and Expenditures. Review major technology projects and expenditures in coordination with the Company's Delegation of Authority Matrix (the "DOA Matrix"). Under the revised DOA Matrix adopted concurrently with this Charter, technology and IT spending of three million dollars ($3,000,000) or less per project falls within the authority of the Chief Executive Officer, a category that has been separated from general capital expenditures, which were previously bundled together in a single authorization tier. Technology projects and expenditures exceeding $3,000,000 per project shall require the approval of the Committee or the Board, as specified in the DOA Matrix.

(c) Subsidiary Alignment. Assess the alignment of IT strategy with the operations and strategic objectives of the Company's managing general agent subsidiary (Quorum MGA Services, LLC) and its fintech subsidiary (Vantage Digital Insurance Solutions, Inc.), ensuring that technology investments support the operating platforms and growth strategies of these businesses.

Section 4.3 — Data Privacy

The Committee shall oversee the Company's data privacy program, including compliance with applicable federal and state data privacy laws and regulations, such as the California Consumer Privacy Act (as amended by the California Privacy Rights Act), the Connecticut Data Privacy Act, the Texas Data Privacy and Security Act, and other applicable data privacy statutes and regulations. In fulfilling this responsibility, the Committee shall:

(a) Data Governance. Review the Company's data governance policies, data classification standards, and data retention and disposal practices, including the policies governing the handling of personally identifiable information of policyholders, claimants, employees, and other individuals.

(b) Breach Notification. Review the Company's data breach notification procedures, including the adequacy of procedures for notifying affected individuals, state insurance regulators, and other governmental authorities in the event of a data breach.

(c) Regulatory Monitoring. Monitor regulatory developments in data privacy that may affect the Company's insurance operations and fintech platforms, and assess the Company's readiness to comply with new or amended data privacy requirements.

Section 4.4 — Insurtech Initiatives

The Committee shall oversee technology-driven insurance initiatives, including digital distribution platforms, automated underwriting systems, telematics-based insurance products, usage-based insurance models, and other insurtech innovations deployed by or through the Company's subsidiaries. The Committee shall:

(a) Innovation Oversight. Review and evaluate the Company's insurtech initiatives, including the strategic rationale, expected benefits, implementation timelines, and technology risk profiles of such initiatives.

(b) Risk Assessment. Evaluate the technology risk profile of insurtech products and services, including the risks associated with the integration of new technology platforms with the Company's existing regulated insurance operations, and the potential for unintended consequences, including regulatory, reputational, and operational risks.

(c) Competitive Landscape. Consider the competitive landscape for insurtech in the Company's lines of business and assess whether the Company's insurtech strategy is appropriately responsive to market developments and customer expectations.

Section 4.5 — Artificial intelligence Governance

The Committee shall oversee the Company's use of artificial intelligence ("AI") and machine learning ("ML") technologies, including underwriting algorithms, claims processing automation, fraud detection systems, customer-facing AI tools (including chatbots and virtual assistants), and predictive analytics models. In fulfilling this responsibility, the Committee shall:

(a) AI Governance Framework. Review the Company's AI governance framework, including policies and procedures addressing algorithmic fairness, bias testing and mitigation, transparency, explainability, model validation, and regulatory compliance.

(b) Ethical Use. Evaluate the Company's policies and practices regarding the ethical use of AI and ML technologies, including the potential for discriminatory outcomes, the use of protected-class data, and the Company's adherence to applicable fair lending and unfair discrimination standards in insurance underwriting and rating.

(c) Regulatory Monitoring. Monitor emerging regulatory requirements related to AI in insurance and financial services, including guidance and model legislation issued by the National Association of Insurance Commissioners ("NAIC"), state insurance regulators, and federal agencies, and assess the Company's readiness to comply with such requirements.

Section 4.6 — Third-Party Technology Risk

The Committee shall oversee the Company's management of third-party technology risks, including risks arising from outsourced IT services, cloud computing providers, software vendors, managed service providers, and other technology-related third parties. In fulfilling this responsibility, the Committee shall:

(a) Vendor Risk Management. Review the Company's vendor risk management program as it relates to technology and cybersecurity, including critical vendor assessments, due diligence processes, contractual safeguards (such as security requirements, audit rights, and data protection provisions), and ongoing monitoring of vendor performance and risk posture.

(b) Concentration Risk. Assess the Company's concentration risk with respect to critical technology vendors and service providers, including the potential impact of a vendor's failure, security breach, or service disruption on the Company's operations.

(c) Coordination with Risk Committee. Coordinate with the Risk Committee (chaired by Raymond T. Huerta) on enterprise-wide third-party risk management matters that extend beyond the technology domain, ensuring a comprehensive and integrated approach to third-party risk oversight.

Section 4.7 — Incident Response

The Committee shall oversee the Company's incident response and business continuity plans as they relate to cybersecurity incidents, technology failures, and data breaches. In fulfilling this responsibility, the Committee shall:

(a) Incident Response Plans. Review and assess the adequacy of the Company's incident response plans, including the roles and responsibilities of the incident response team, escalation procedures, communication protocols, and remediation processes.

(b) Prompt Reporting. Receive prompt reports from management regarding material cybersecurity incidents and the Company's response thereto, including the scope and impact of the incident, the actions taken to contain and remediate the incident, and the potential implications for the Company's operations, regulatory compliance, and financial condition.

(c) Testing and Drills. Periodically review the results of tabletop exercises, incident response drills, and post-incident analyses conducted by management, and assess whether the Company's incident response capabilities are adequate and continuously improving.

(d) Board and Committee Notification. In the event of a material cybersecurity incident, the Committee (through its Chairperson) shall promptly inform the full Board of Directors and shall coordinate with the Audit Committee (chaired by Dr. Lilian Fong-Archer) regarding any disclosure obligations under SEC rules, including the requirements of Item 1.05 of Form 8-K (as amended by SEC Release No. 33-11216, adopted July 26, 2023), and with the General Counsel regarding legal implications, including potential litigation exposure, regulatory enforcement actions, and contractual notification obligations.

Section 4.8 — Insurance Regulatory Technology Requirements

The Committee shall monitor technology-related regulatory requirements applicable to the Company's regulated insurance subsidiaries, including requirements imposed by the relevant state departments of insurance and any other regulatory authorities with jurisdiction over the Company's insurance operations. Such regulatory requirements include, without limitation:

(a) Requirements imposed by the Connecticut Department of Insurance with respect to Quorum Property & Casualty Insurance Company (NAIC Code 38472), including requirements arising under the Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-38, et seq.).

(b) Requirements imposed by the Texas Department of Insurance with respect to Lone Star Specialty Insurance Company (NAIC Code 41359), including requirements arising under the Texas Insurance Code and applicable data security regulations.

(c) Requirements imposed by the Ohio Department of Insurance with respect to Great Lakes Surety & Indemnity Co. (NAIC Code 29814), including requirements arising under the Ohio Data Protection Act and applicable insurance cybersecurity standards.

(d) Requirements arising under the NAIC Insurance Data Security Model Law (Model 668) and any state-level adoptions thereof.

The Committee shall coordinate with the Chief Compliance Officer (Ivan D. Pruett) and the Company's external insurance regulatory consultants, Broadleaf Insurance Regulatory Consultants, LLC (Harold J. Emmerich, Managing Director), as needed regarding state insurance regulatory expectations for cybersecurity and technology governance, examination preparedness, and regulatory examination findings.

Section 4.9 — Budget and Resources

The Committee shall review and recommend to the Board the annual technology and cybersecurity budget, including expenditures for staffing, tools, training, third-party services, and external assessments. In fulfilling this responsibility, the Committee shall:

(a) Assess whether the Company's technology and cybersecurity functions have adequate resources, personnel, and organizational stature to effectively discharge their responsibilities and to address the Company's technology and cybersecurity risk profile.

(b) Review management's proposals for material changes to the technology and cybersecurity budget, and provide its recommendation to the Board regarding such proposals.

(c) Consider benchmarking data and industry surveys regarding technology and cybersecurity spending relative to the Company's peers and best practices.

Section 4.10 — Talent and Organizational Structure

The Committee shall review the qualifications, organizational positioning, and effectiveness of the Company's senior technology and cybersecurity leadership, including the Chief Information Officer, Chief Information Security Officer, Chief Technology Officer, and other senior technology officers. The Committee shall:

(a) Assess the experience, qualifications, and performance of the Company's senior technology and cybersecurity leaders, and provide input to the Chief Executive Officer regarding the hiring, retention, and succession planning for such positions.

(b) Coordinate with the Compensation & Human Capital Committee (chaired by Claudia M. Severin) as appropriate regarding the attraction, retention, and compensation of technology and cybersecurity talent, including the competitiveness of compensation packages and the availability of equity-based incentives for critical technology and cybersecurity personnel.

(c) Review the organizational structure of the Company's technology and cybersecurity functions, including reporting lines, staffing levels, and the integration of technology leadership into the Company's senior management team.

ARTICLE V — INTER-COMMITTEE COORDINATION

Section 5.1 — Coordination with the Risk Committee

The Committee shall maintain a coordination protocol with the Risk Committee (chaired by Raymond T. Huerta) to avoid duplication of effort and to ensure comprehensive oversight of technology and cybersecurity risks within the broader enterprise risk management framework. Specifically:

(a) The Chairpersons of the Committee and the Risk Committee shall confer at least quarterly to coordinate agendas, share relevant risk information, and identify matters that may benefit from joint review or discussion.

(b) Technology and cybersecurity risks that constitute enterprise-level risks — including, without limitation, catastrophe exposure arising from systemic cyber events, aggregated cyber liability exposure across the Company's insurance portfolio, and technology-related operational risks — shall be jointly reviewed by the Committee and the Risk Committee as appropriate.

(c) The Risk Committee's charter (as restated concurrently with the adoption of this Charter, chaired by Raymond T. Huerta) includes insurance-specific risk categories — including reserving risk, reinsurance risk, catastrophe exposure, and underwriting risk — that may intersect with technology risks. The coordination protocol shall address the allocation of oversight responsibilities for risks that span both committees' mandates.

(d) The Chairpersons may establish joint meetings of the two committees as they deem appropriate, and members of each committee may attend meetings of the other committee as observers with the consent of the applicable Chairperson.

Section 5.2 — Coordination with the Audit Committee

The Committee shall maintain a coordination protocol with the Audit Committee (chaired by Dr. Lilian Fong-Archer) to ensure alignment on matters of mutual interest. Such matters include, without limitation:

(a) Internal audit findings related to IT controls, cybersecurity, and data integrity, as reported by the Chief Audit Executive (Renata M. Vásquez) and the Company's internal audit function.

(b) Observations from the Company's independent registered public accounting firm, Garrett & Whitfield LLP (Lead Engagement Partner: Roland S. Brewer), regarding IT-related internal controls over financial reporting, including any material weaknesses or significant deficiencies related to information technology.

(c) Disclosure obligations arising from cybersecurity incidents, including the requirements of Item 1.05 of Form 8-K and the annual cybersecurity risk management disclosures required by Item 106 of Regulation S-K.

(d) The Audit Committee's enterprise risk management oversight role, as set forth in the Audit Committee's restated charter, to the extent that such role encompasses technology and cybersecurity risks.

The Chairpersons of the Committee and the Audit Committee shall confer at least semi-annually, and more frequently as circumstances require, to ensure effective coordination on overlapping matters.

Section 5.3 — Coordination with the Investment Committee

The Committee shall coordinate with the Investment Committee (chaired by Jonathan K. Whitmore) on technology risks that may affect the Company's invested assets portfolio, which had total invested assets of approximately sixteen billion four hundred million dollars ($16.4 billion) as of December 31, 2024 (fiscal year 2024). Such technology risks include, without limitation, technology risks within the Company's investment management platforms, trading systems, custodial arrangements, and electronic trading interfaces, as well as cybersecurity risks that may affect the integrity, availability, or confidentiality of the Company's investment data and systems.

Section 5.4 — Coordination with the Nominating & Corporate Governance Committee

The Committee shall coordinate with the Nominating & Corporate Governance Committee (chaired by Arthur J. Pennington, Lead Independent Director) regarding director skills and qualifications related to technology and cybersecurity oversight. The Committee shall provide input to the Nominating & Corporate Governance Committee to inform the annual director skills-matrix assessment process, including the identification of technology and cybersecurity competencies that are important for the Board's effective oversight of the Company. The Committee shall also assist the Nominating & Corporate Governance Committee in evaluating director candidates who may possess technology or cybersecurity expertise relevant to service on the Committee.

ARTICLE VI — REPORTING

Section 6.1 — Reports to the Board

The Chairperson shall report to the full Board of Directors on the Committee's activities, findings, and recommendations at least quarterly, at each regularly scheduled meeting of the Board. Such reports shall include a summary of the matters discussed at the most recent Committee meeting, any significant actions taken by the Committee, and any matters requiring Board attention or action.

The Committee shall provide the Board with a written summary of significant matters reviewed at each Committee meeting, which summary shall be included in the materials distributed to the Board in advance of the applicable Board meeting. The Chairperson shall be available to respond to questions from directors regarding the Committee's activities and findings.

Section 6.2 — Annual Report

The Committee shall prepare and present to the Board an annual report summarizing the Committee's activities and findings for the preceding calendar year. The annual report shall include, at a minimum:

(a) An assessment of the state of the Company's cybersecurity program and IT strategy, including the Committee's evaluation of the program's effectiveness, maturity, and alignment with the Company's risk appetite.

(b) A summary of key risk trends and emerging threats identified during the year, and the Company's preparedness to address such risks and threats.

(c) An assessment of the adequacy of resources and personnel devoted to the Company's technology and cybersecurity functions.

(d) Any recommendations for Board consideration, including recommended changes to the Company's technology or cybersecurity strategy, budget, organizational structure, or governance practices.

(e) A summary of the Committee's coordination activities with the other standing committees of the Board, as described in Article V.

The annual report shall be presented to the Board at the first regularly scheduled Board meeting of each calendar year, covering the activities and findings of the preceding calendar year.

ARTICLE VII — DELEGATION AND ADVISORS

Section 7.1 — Delegation to Subcommittees

The Committee may, in its discretion, delegate specific responsibilities to one or more subcommittees, each consisting of one or more members of the Committee, to the extent permitted under Section 141(c) of the DGCL and the Company's Bylaws. Any such delegation shall be made by a majority vote of the voting members of the Committee. The Committee shall retain oversight of any responsibilities delegated to a subcommittee and shall receive reports from any subcommittee regarding the exercise of delegated authority.

Section 7.2 — Retention of Advisors

The Committee shall have the sole authority to retain and terminate independent outside advisors, including technology consultants, cybersecurity experts, forensic investigators, legal counsel, and other specialists, as the Committee deems necessary or appropriate to fulfill its responsibilities under this Charter. The Committee may retain such advisors without obtaining further Board approval, consistent with the authority granted to other standing committees of the Board under their respective charters.

The Company shall provide appropriate funding, as determined by the Committee in its sole discretion, for:

(a) the compensation of any independent outside advisors retained by the Committee;

(b) the payment of ordinary administrative expenses of the Committee that are necessary or appropriate in carrying out its duties; and

The Committee's authority to retain independent outside advisors is in addition to, and does not limit, the authority of the Company's management to retain technology consultants, cybersecurity experts, and other advisors in the ordinary course of business.

ARTICLE VIII — ANNUAL SELF-EVALUATION

The Committee shall conduct an annual self-evaluation of its own performance, including a review of the adequacy of this Charter. The self-evaluation shall assess the Committee's effectiveness in fulfilling the responsibilities set forth in this Charter, the quality and timeliness of information received from management, the Committee's working relationship with management and with other standing committees of the Board, and any areas for improvement.

The results of the self-evaluation shall be reported to the Nominating & Corporate Governance Committee and the full Board. The Committee may, as part of its self-evaluation, recommend amendments to this Charter, which amendments shall be submitted to the Board for approval in accordance with Article X.

This self-evaluation requirement is consistent with the annual self-evaluation requirements adopted in the restated charters of all other standing committees of the Board — the Audit Committee, the Compensation & Human Capital Committee, the Nominating & Corporate Governance Committee, the Risk Committee, and the Investment Committee — reflecting the Board's commitment to continuous improvement in its governance practices.

ARTICLE IX — LIMITATIONS

While the Committee has the responsibilities and powers set forth in this Charter, it is not the duty of the Committee to design, implement, or operate the Company's technology systems, cybersecurity program, data privacy compliance program, or any other operational function. These are the responsibilities of the Company's management. The Committee's function is one of oversight, and the members of the Committee are not full-time employees of the Company and may not be experts in all areas within the scope of the Committee's oversight responsibilities.

Nothing in this Charter is intended to alter or impair the authority of any other committee of the Board as set forth in its respective charter, or to limit the authority of the full Board. To the extent that any responsibility assigned to the Committee under this Charter overlaps with a responsibility assigned to another standing committee under such committee's charter, the applicable committees shall coordinate their oversight activities as contemplated by Article V of this Charter and as the Board may otherwise direct.

The Committee's authority is subject to the limitations on committee powers under Section 141(c) of the DGCL, including that the Committee may not take actions reserved to the full Board under the DGCL, such as amending the Company's Certificate of Incorporation or Bylaws, declaring dividends, approving mergers or consolidations, recommending the dissolution of the Company, or authorizing the issuance of stock, except to the extent expressly permitted by law.

The Committee acknowledges that management and the Company's independent outside advisors have more extensive time, knowledge, and detailed information regarding the Company's technology and cybersecurity operations than do the members of the Committee. Accordingly, in carrying out its oversight responsibilities, the Committee is entitled to rely upon the expertise and knowledge of management and such advisors, and the accuracy of the information provided to the Committee by such persons, absent actual knowledge to the contrary.

ARTICLE X — AMENDMENT

This Charter may be amended, modified, or repealed by the Board of Directors at any time, by the affirmative vote of a majority of the directors then in office at any regular or special meeting of the Board.

The Committee shall review this Charter at least annually and shall recommend any proposed changes to the Board through the Nominating & Corporate Governance Committee. The Committee's annual review of the Charter shall take into account developments in governance best practices, regulatory requirements, the Company's business and risk profile, and the Committee's experience in fulfilling its responsibilities under the Charter.

No amendment to this Charter shall be effective unless and until approved by the Board. Any such amendment shall be promptly reflected in the version of this Charter posted on the Company's investor relations website, in accordance with applicable NYSE requirements.

ADOPTION AND EFFECTIVE DATE

This Charter was duly adopted by the Board of Directors of Quorum Insurance Holdings Corp. by resolution at the regular meeting of the Board of Directors held on December 11, 2025, at which a quorum of the Board was present and acting throughout.

The adoption of this Charter was authorized as part of the Omnibus Board Resolution (Resolution No. 2025-12-001) adopted at the December 11, 2025 Board meeting, which authorized the following governance actions:

(a) Adoption of this Charter establishing the Technology & Cybersecurity Oversight Committee as the sixth standing committee of the Board;

(b) Restatement of the charters of the five existing standing committees of the Board (the Audit Committee, the Compensation & Human Capital Committee, the Nominating & Corporate Governance Committee, the Risk Committee, and the Investment Committee) to reflect conforming amendments and inter-committee coordination protocols;

(c) Adoption of the revised Delegation of Authority Matrix, including the creation of a separate authorization tier for technology and IT expenditures;

(d) Adoption of the Amended & Restated Corporate Governance Guidelines of the Company; and

(e) Approval of conforming amendments to the Company's Second Amended and Restated Bylaws, including: Article III, Section 3.3, updated to reference six standing committees of the Board; Article III, Section 3.4, revised to update committee-appointment mechanics; and Article IV, Section 4.2, revised to update officer authority provisions with cross-references to the DOA Matrix.

This Charter shall become effective immediately upon its adoption by the Board and shall be posted on the Company's investor relations website (www.quoruminsuranceholdings.com/investors/governance) within five (5) business days of adoption, consistent with the requirements of the NYSE Listed Company Manual. The adoption of this Charter and the other governance actions authorized by the Omnibus Board Resolution will be disclosed in a Current Report on Form 8-K to be filed by the Company with the SEC on or about December 15, 2025.

Certified as a true and correct copy of the Charter as adopted by the Board of Directors on December 11, 2025.

QUORUM INSURANCE HOLDINGS CORP.

By: ________

Name: Dennis R. Okonkwo

Title: General Counsel & Corporate Secretary

Date: ________

Address:

280 Asylum Street, Suite 2200 Hartford, CT 06103

CHARTER OF THE TECHNOLOGY & CYBERSECURITY OVERSIGHT COMMITTEE OF THE BOARD OF DIRECTORS OF QUORUM INSURANCE HOLDINGS CORP.
Adopted by the Board of Directors on December 11, 2025
This Charter establishes the Technology & Cybersecurity Oversight Committee as the sixth standing committee of the Board of Directors of Quorum Insurance Holdings Corp., a Delaware corporation (NYSE: QIHC).
Right-click to update Table of Contents
ARTICLE I — PURPOSE
The Board of Directors (the "Board") of Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), a Delaware corporation incorporated under the Delaware General Corporation Law (the "DGCL"), hereby creates the Technology & Cybersecurity Oversight Committee (the "Committee") as a standing committee of the Board, established pursuant to Section 141(c) of the DGCL and Article III, Section 3.3 of the Company's Second Amended and Restated Bylaws (as further amended, the "Bylaws").
The Committee's overarching purpose is to assist the Board in fulfilling its oversight responsibilities with respect to the Company's technology strategy, cybersecurity program, data privacy compliance, artificial intelligence governance, insurtech initiatives, third-party technology risk management, and incident response preparedness. In establishing this Committee, the Board recognizes that technology and cybersecurity matters are integral to the Company's ability to conduct its multi-line insurance and financial technology operations in a manner that protects the interests of the Company's shareholders, policyholders, customers, employees, and other stakeholders.
The creation of the Committee reflects the Company's recognition of the growing significance of technology and cybersecurity risks to its multi-line insurance and fintech operations, including its regulated insurance subsidiaries — Quorum Property & Casualty Insurance Company ("Quorum P&C"), Lone Star Specialty Insurance Company ("Lone Star Specialty"), and Great Lakes Surety & Indemnity Co. ("Great Lakes Surety") — and its financial technology subsidiary, Vantage Digital Insurance Solutions, Inc. ("Vantage Digital"). The Company's operations are increasingly dependent upon digital platforms, data-intensive underwriting processes, cloud-based infrastructure, and customer-facing technology tools, each of which introduces technology and cybersecurity risks that warrant dedicated Board-level oversight.
The establishment of this Committee is further informed by governance benchmarking conducted by Apex Proxy Advisors, Inc., as set forth in its report dated June 30, 2025 (the "Apex Benchmarking Report"), which found that eleven (11) of fourteen (14) peer publicly traded insurance holding companies had adopted either a standalone technology and cybersecurity committee of their boards of directors or had added explicit cybersecurity oversight responsibilities to the charters of existing board committees. The Apex Benchmarking Report noted that the creation of a dedicated committee structure reflects emerging best practices in insurance industry governance and is responsive to heightened regulatory expectations, investor scrutiny, and the evolving threat landscape.
Notwithstanding the foregoing, the Committee's role is one of oversight. Management is responsible for the design, implementation, and day-to-day operation of the Company's technology and cybersecurity programs. The Committee shall not assume or displace management's operational responsibilities, but rather shall provide informed and constructive oversight to ensure that management's technology and cybersecurity efforts are adequate, appropriately resourced, and aligned with the Company's strategic objectives and risk appetite.
ARTICLE II — COMPOSITION
Section 2.1 — Number of Members
The Committee shall consist of no fewer than three (3) members of the Board of Directors. The Board may, from time to time, increase the size of the Committee as the Board deems appropriate, provided that the Committee shall at all times maintain a minimum of three (3) voting members.
All voting members of the Committee shall be "independent directors" as defined by the New York Stock Exchange ("NYSE") Listed Company Manual Section 303A and applicable rules and regulations of the U.S. Securities and Exchange Commission (the "SEC"). Each voting member shall satisfy such independence requirements at the time of appointment and throughout such member's service on the Committee. In the event that a voting member ceases to meet the applicable independence requirements, such member shall promptly notify the Chairperson and the Corporate Secretary, and the Board shall take appropriate action to address the matter, which may include removal and replacement of the affected member.
The Board may, in its discretion, appoint one or more non-voting advisory members from among the Company's management directors to serve on the Committee at the pleasure of the Board. Non-voting advisory members shall be entitled to attend meetings, participate in discussions, and receive all materials distributed to Committee members, but shall not have the right to vote on any matter before the Committee. Non-voting advisory members shall not count toward the minimum membership requirement set forth in this Section 2.1 or toward the quorum requirements set forth in Section 3.2 of this Charter.
Section 2.2 — Qualifications
At least one (1) voting member of the Committee shall possess cybersecurity expertise or technology expertise, as defined in Section 2.3 below. The Board shall identify such member or members in the Company's annual proxy statement, to the extent required or recommended by applicable rules, regulations, or governance best practices.
Members of the Committee should collectively possess a mix of competencies relevant to the Committee's oversight responsibilities, including, without limitation, experience in information technology, cybersecurity, data privacy, digital transformation, financial technology, artificial intelligence, enterprise risk management related to technology, and insurance or financial services operations. The Nominating & Corporate Governance Committee shall consider the desired mix of technology-related competencies when evaluating candidates for service on this Committee.
Section 2.3 — Definition of Cybersecurity or Technology Expertise
For purposes of this Charter, a member of the Committee shall be deemed to possess "cybersecurity or technology expertise" if, through education, professional experience (including service as a chief information officer, chief technology officer, chief information security officer, or in an equivalent executive role), or other relevant background, such member has acquired:
(a) an understanding of cybersecurity threats, vulnerabilities, and risk mitigation frameworks, including familiarity with recognized cybersecurity standards and best practices;
(b) experience overseeing or managing technology strategy, digital platforms, information security programs, or technology-driven business operations at a significant organization; or
(c) professional certifications (such as CISSP, CISM, CISA, or equivalent designations), academic credentials (such as advanced degrees in computer science, information security, or related disciplines), or board-level experience related to technology governance or cybersecurity oversight at a publicly traded company or other significant enterprise.
The determination of whether a member possesses cybersecurity or technology expertise shall be made by the Board in its business judgment, considering the totality of such member's qualifications and experience. Nothing in this Section 2.3 shall be construed to impose upon any member of the Committee any duties or obligations greater than those imposed by applicable law on directors generally.
Section 2.4 — Appointment and Removal
Members of the Committee shall be appointed annually by the Board upon the recommendation of the Nominating & Corporate Governance Committee (currently chaired by Arthur J. Pennington, Lead Independent Director) at the first regular meeting of the Board following the annual meeting of shareholders, and shall serve until their successors are duly appointed or until their earlier resignation, removal from the Committee, or cessation of service as a director of the Company. A member's service on the Committee shall automatically terminate upon such member's departure from the Board for any reason.
The Board may remove or replace any member of the Committee at any time, with or without cause, by the affirmative vote of a majority of the directors then in office. In the event of a vacancy on the Committee, the Board may appoint a successor member at any regular or special meeting of the Board, upon the recommendation of the Nominating & Corporate Governance Committee.
Section 2.5 — Chairperson
The Board shall designate one voting member of the Committee as Chairperson. The Chairperson shall preside at all meetings of the Committee, set the agenda for each meeting in consultation with management and other committee chairs, and serve as the primary liaison between the Committee and the full Board. The Chairperson shall report to the full Board on the Committee's activities, findings, and recommendations as set forth in Article VI of this Charter.
In the absence of the Chairperson at any meeting, the voting members of the Committee present at such meeting shall designate an acting chairperson from among themselves to preside at such meeting.
Section 2.6 — Initial Members
The initial members of the Committee, effective upon adoption of this Charter by the Board on December 11, 2025, shall be:
Priya Narasimhan — Chairperson. Ms. Narasimhan is an independent director of the Company and serves as Chief Executive Officer of Tessera Fintech Corp. She has served as a director of the Company since 2023. Ms. Narasimhan possesses technology expertise within the meaning of Section 2.3 of this Charter, based on her extensive experience leading technology-driven financial services businesses.
Victor L. Andrade — Voting Member. Mr. Andrade is an independent director of the Company and previously served as Executive Vice President of Federated Mutual Insurance Holdings, where he oversaw enterprise risk management and technology modernization initiatives. He has served as a director of the Company since 2018.
Camille R. DuPont — Non-Voting Advisory Member. Ms. DuPont is a management director of the Company and serves as President of Vantage Digital Insurance Solutions, Inc., the Company's financial technology subsidiary. Ms. DuPont is not independent within the meaning of NYSE Listed Company Manual Section 303A and accordingly serves as a non-voting advisory member. Her participation on the Committee provides valuable operational insight into the Company's technology platforms and digital strategy.
The Board anticipates that, following the 2026 annual meeting of shareholders, a third independent director with relevant technology or cybersecurity experience may be added as a voting member of the Committee, and the Board has directed the Nominating & Corporate Governance Committee to include technology and cybersecurity expertise in the director recruitment profile for the 2026 Board refreshment cycle.
ARTICLE III — MEETINGS
Section 3.1 — Frequency
The Committee shall meet at least four (4) times per calendar year on a quarterly basis, with meetings generally scheduled to occur in advance of regularly scheduled meetings of the full Board. The Committee may meet more frequently as circumstances require, including in response to significant cybersecurity incidents, material technology developments, or emerging regulatory matters.
Additional special meetings of the Committee may be called at any time by the Chairperson, by any two (2) voting members of the Committee, or at the request of any of the following officers of the Company: the Chair of the Board and Chief Executive Officer (Margaret A. Calloway), the General Counsel and Corporate Secretary (Dennis R. Okonkwo), or the Chief Compliance Officer (Ivan D. Pruett). Notice of special meetings shall be given to all members of the Committee in accordance with the notice provisions of the Bylaws applicable to committees of the Board.
Meetings of the Committee may be held in person or by means of telephone, video conference, or other communications equipment by means of which all persons participating in the meeting can hear one another, in accordance with DGCL § 141(i).
Section 3.2 — Quorum
A majority of the voting members of the Committee shall constitute a quorum for the transaction of business at any meeting of the Committee. Non-voting advisory members shall not be counted for purposes of determining whether a quorum is present. If a quorum is not present at any meeting, the members present may adjourn the meeting to another time and place without further notice, except as may be required by the Bylaws.
Section 3.3 — Voting
All actions of the Committee shall be taken by a majority vote of the voting members present at a meeting at which a quorum is present. Each voting member shall have one vote. In the event of a tie, the matter shall be referred to the full Board for resolution.
The Committee may also act by unanimous written consent in lieu of a meeting, in accordance with Section 141(f) of the DGCL and the applicable provisions of the Bylaws. Any action taken by unanimous written consent shall have the same force and effect as if taken at a duly convened meeting of the Committee.
Section 3.4 — Attendance of Non-Members
The Committee may invite members of management, including the Chief Information Officer, Chief Information Security Officer, Chief Technology Officer, or equivalent officers, to attend meetings of the Committee as the Committee deems appropriate. The Committee may also invite the Chief Audit Executive (Renata M. Vásquez), external advisors, legal counsel, and other persons to attend meetings to provide information, expertise, or reports relevant to the Committee's agenda.
The Committee shall meet in executive session (without any members of management present) at least once per calendar year. During executive sessions, the Committee may discuss matters that, in the judgment of the Chairperson, are best addressed without management participation, including the effectiveness of management's cybersecurity and technology leadership, the adequacy of management's reporting to the Committee, and any concerns raised by Committee members regarding the Company's technology or cybersecurity posture.
Section 3.5 — Agenda and Minutes
The Chairperson, in consultation with the Corporate Secretary's office, shall be responsible for establishing the agenda for each meeting of the Committee. The agenda shall be distributed to Committee members, together with any supporting materials, in advance of each meeting, with the goal of providing materials at least five (5) business days prior to each regularly scheduled meeting, to the extent practicable.
Minutes of each meeting of the Committee shall be prepared and maintained by the Corporate Secretary or his or her designee. The minutes shall accurately reflect the matters discussed, the actions taken, and the votes cast at each meeting. The minutes shall be submitted to the Committee for approval and, following approval, shall be made available to the full Board of Directors. All minutes and supporting materials shall be retained in accordance with the Company's document retention policy.
ARTICLE IV — AUTHORITY AND RESPONSIBILITIES
The Committee shall have the following authority and responsibilities, in addition to any other duties that may be assigned to the Committee by the Board from time to time. In discharging its responsibilities, the Committee shall have full access to all books, records, facilities, and personnel of the Company and its subsidiaries, and shall have the authority to direct any officer or employee of the Company to provide such information and assistance as the Committee may require.
Section 4.1 — Cybersecurity Program Oversight
The Committee shall oversee the Company's enterprise cybersecurity program, including the adequacy and effectiveness of the Company's cybersecurity policies, procedures, and controls. The Committee's cybersecurity oversight responsibilities shall include, without limitation, the following:
(a) Risk Profile Assessment. Review and assess the Company's cybersecurity risk profile, including the identification and evaluation of threats, vulnerabilities, and mitigation strategies across the holding company and all subsidiaries, including Quorum P&C, Lone Star Specialty, Great Lakes Surety, Quorum MGA Services, LLC ("Quorum MGA"), and Vantage Digital. The Committee shall consider the cybersecurity risk profile in the context of the Company's overall risk appetite and tolerance, as established by the Board and the Risk Committee.
(b) Regular Reporting. Receive and review regular reports from the Chief Information Security Officer (or equivalent officer) on the state of the cybersecurity program, including key risk indicators, vulnerability assessments, penetration testing results, threat intelligence, security operations metrics, and the status of remediation efforts. Such reports shall be provided at each regularly scheduled meeting of the Committee, or more frequently as the Committee may request.
(c) Framework Oversight. Oversee management's implementation and maintenance of recognized cybersecurity frameworks (including, as applicable, the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, ISO/IEC 27001, and the Center for Internet Security ("CIS") Controls) and evaluate the maturity and effectiveness of such frameworks on a periodic basis, including through the review of independent assessments and audit findings.
(d) Cybersecurity Insurance. Review, in coordination with the Risk Committee, the Company's cybersecurity insurance coverage, including the adequacy of coverage limits, policy terms, and exclusions.
Section 4.2 — Information Technology Strategy
The Committee shall review and provide oversight of the Company's information technology ("IT") strategic plan, including investments in technology infrastructure, digital transformation initiatives, and technology modernization programs. In fulfilling this responsibility, the Committee shall:
(a) Strategic Plan Review. Review the Company's multi-year IT strategic plan, including the prioritization of technology initiatives, anticipated capital and operating expenditures, and expected business outcomes. The Committee shall assess the alignment of the IT strategic plan with the Company's overall business strategy, financial objectives, and competitive positioning.
(b) Major Projects and Expenditures. Review major technology projects and expenditures in coordination with the Company's Delegation of Authority Matrix (the "DOA Matrix"). Under the revised DOA Matrix adopted concurrently with this Charter, technology and IT spending of three million dollars ($3,000,000) or less per project falls within the authority of the Chief Executive Officer, a category that has been separated from general capital expenditures, which were previously bundled together in a single authorization tier. Technology projects and expenditures exceeding $3,000,000 per project shall require the approval of the Committee or the Board, as specified in the DOA Matrix.
(c) Subsidiary Alignment. Assess the alignment of IT strategy with the operations and strategic objectives of the Company's managing general agent subsidiary (Quorum MGA Services, LLC) and its fintech subsidiary (Vantage Digital Insurance Solutions, Inc.), ensuring that technology investments support the operating platforms and growth strategies of these businesses.
Section 4.3 — Data Privacy
The Committee shall oversee the Company's data privacy program, including compliance with applicable federal and state data privacy laws and regulations, such as the California Consumer Privacy Act (as amended by the California Privacy Rights Act), the Connecticut Data Privacy Act, the Texas Data Privacy and Security Act, and other applicable data privacy statutes and regulations. In fulfilling this responsibility, the Committee shall:
(a) Data Governance. Review the Company's data governance policies, data classification standards, and data retention and disposal practices, including the policies governing the handling of personally identifiable information of policyholders, claimants, employees, and other individuals.
(b) Breach Notification. Review the Company's data breach notification procedures, including the adequacy of procedures for notifying affected individuals, state insurance regulators, and other governmental authorities in the event of a data breach.
(c) Regulatory Monitoring. Monitor regulatory developments in data privacy that may affect the Company's insurance operations and fintech platforms, and assess the Company's readiness to comply with new or amended data privacy requirements.
Section 4.4 — Insurtech Initiatives
The Committee shall oversee technology-driven insurance initiatives, including digital distribution platforms, automated underwriting systems, telematics-based insurance products, usage-based insurance models, and other insurtech innovations deployed by or through the Company's subsidiaries. The Committee shall:
(a) Innovation Oversight. Review and evaluate the Company's insurtech initiatives, including the strategic rationale, expected benefits, implementation timelines, and technology risk profiles of such initiatives.
(b) Risk Assessment. Evaluate the technology risk profile of insurtech products and services, including the risks associated with the integration of new technology platforms with the Company's existing regulated insurance operations, and the potential for unintended consequences, including regulatory, reputational, and operational risks.
(c) Competitive Landscape. Consider the competitive landscape for insurtech in the Company's lines of business and assess whether the Company's insurtech strategy is appropriately responsive to market developments and customer expectations.
Section 4.5 — Artificial intelligence Governance
The Committee shall oversee the Company's use of artificial intelligence ("AI") and machine learning ("ML") technologies, including underwriting algorithms, claims processing automation, fraud detection systems, customer-facing AI tools (including chatbots and virtual assistants), and predictive analytics models. In fulfilling this responsibility, the Committee shall:
(a) AI Governance Framework. Review the Company's AI governance framework, including policies and procedures addressing algorithmic fairness, bias testing and mitigation, transparency, explainability, model validation, and regulatory compliance.
(b) Ethical Use. Evaluate the Company's policies and practices regarding the ethical use of AI and ML technologies, including the potential for discriminatory outcomes, the use of protected-class data, and the Company's adherence to applicable fair lending and unfair discrimination standards in insurance underwriting and rating.
(c) Regulatory Monitoring. Monitor emerging regulatory requirements related to AI in insurance and financial services, including guidance and model legislation issued by the National Association of Insurance Commissioners ("NAIC"), state insurance regulators, and federal agencies, and assess the Company's readiness to comply with such requirements.
Section 4.6 — Third-Party Technology Risk
The Committee shall oversee the Company's management of third-party technology risks, including risks arising from outsourced IT services, cloud computing providers, software vendors, managed service providers, and other technology-related third parties. In fulfilling this responsibility, the Committee shall:
(a) Vendor Risk Management. Review the Company's vendor risk management program as it relates to technology and cybersecurity, including critical vendor assessments, due diligence processes, contractual safeguards (such as security requirements, audit rights, and data protection provisions), and ongoing monitoring of vendor performance and risk posture.
(b) Concentration Risk. Assess the Company's concentration risk with respect to critical technology vendors and service providers, including the potential impact of a vendor's failure, security breach, or service disruption on the Company's operations.
(c) Coordination with Risk Committee. Coordinate with the Risk Committee (chaired by Raymond T. Huerta) on enterprise-wide third-party risk management matters that extend beyond the technology domain, ensuring a comprehensive and integrated approach to third-party risk oversight.
Section 4.7 — Incident Response
The Committee shall oversee the Company's incident response and business continuity plans as they relate to cybersecurity incidents, technology failures, and data breaches. In fulfilling this responsibility, the Committee shall:
(a) Incident Response Plans. Review and assess the adequacy of the Company's incident response plans, including the roles and responsibilities of the incident response team, escalation procedures, communication protocols, and remediation processes.
(b) Prompt Reporting. Receive prompt reports from management regarding material cybersecurity incidents and the Company's response thereto, including the scope and impact of the incident, the actions taken to contain and remediate the incident, and the potential implications for the Company's operations, regulatory compliance, and financial condition.
(c) Testing and Drills. Periodically review the results of tabletop exercises, incident response drills, and post-incident analyses conducted by management, and assess whether the Company's incident response capabilities are adequate and continuously improving.
(d) Board and Committee Notification. In the event of a material cybersecurity incident, the Committee (through its Chairperson) shall promptly inform the full Board of Directors and shall coordinate with the Audit Committee (chaired by Dr. Lilian Fong-Archer) regarding any disclosure obligations under SEC rules, including the requirements of Item 1.05 of Form 8-K (as amended by SEC Release No. 33-11216, adopted July 26, 2023), and with the General Counsel regarding legal implications, including potential litigation exposure, regulatory enforcement actions, and contractual notification obligations.
Section 4.8 — Insurance Regulatory Technology Requirements
The Committee shall monitor technology-related regulatory requirements applicable to the Company's regulated insurance subsidiaries, including requirements imposed by the relevant state departments of insurance and any other regulatory authorities with jurisdiction over the Company's insurance operations. Such regulatory requirements include, without limitation:
(a) Requirements imposed by the Connecticut Department of Insurance with respect to Quorum Property & Casualty Insurance Company (NAIC Code 38472), including requirements arising under the Connecticut Insurance Data Security Law (Conn. Gen. Stat. § 38a-38, et seq.).
(b) Requirements imposed by the Texas Department of Insurance with respect to Lone Star Specialty Insurance Company (NAIC Code 41359), including requirements arising under the Texas Insurance Code and applicable data security regulations.
(c) Requirements imposed by the Ohio Department of Insurance with respect to Great Lakes Surety & Indemnity Co. (NAIC Code 29814), including requirements arising under the Ohio Data Protection Act and applicable insurance cybersecurity standards.
(d) Requirements arising under the NAIC Insurance Data Security Model Law (Model 668) and any state-level adoptions thereof.
The Committee shall coordinate with the Chief Compliance Officer (Ivan D. Pruett) and the Company's external insurance regulatory consultants, Broadleaf Insurance Regulatory Consultants, LLC (Harold J. Emmerich, Managing Director), as needed regarding state insurance regulatory expectations for cybersecurity and technology governance, examination preparedness, and regulatory examination findings.
Section 4.9 — Budget and Resources
The Committee shall review and recommend to the Board the annual technology and cybersecurity budget, including expenditures for staffing, tools, training, third-party services, and external assessments. In fulfilling this responsibility, the Committee shall:
(a) Assess whether the Company's technology and cybersecurity functions have adequate resources, personnel, and organizational stature to effectively discharge their responsibilities and to address the Company's technology and cybersecurity risk profile.
(b) Review management's proposals for material changes to the technology and cybersecurity budget, and provide its recommendation to the Board regarding such proposals.
(c) Consider benchmarking data and industry surveys regarding technology and cybersecurity spending relative to the Company's peers and best practices.
Section 4.10 — Talent and Organizational Structure
The Committee shall review the qualifications, organizational positioning, and effectiveness of the Company's senior technology and cybersecurity leadership, including the Chief Information Officer, Chief Information Security Officer, Chief Technology Officer, and other senior technology officers. The Committee shall:
(a) Assess the experience, qualifications, and performance of the Company's senior technology and cybersecurity leaders, and provide input to the Chief Executive Officer regarding the hiring, retention, and succession planning for such positions.
(b) Coordinate with the Compensation & Human Capital Committee (chaired by Claudia M. Severin) as appropriate regarding the attraction, retention, and compensation of technology and cybersecurity talent, including the competitiveness of compensation packages and the availability of equity-based incentives for critical technology and cybersecurity personnel.
(c) Review the organizational structure of the Company's technology and cybersecurity functions, including reporting lines, staffing levels, and the integration of technology leadership into the Company's senior management team.
ARTICLE V — INTER-COMMITTEE COORDINATION
Section 5.1 — Coordination with the Risk Committee
The Committee shall maintain a coordination protocol with the Risk Committee (chaired by Raymond T. Huerta) to avoid duplication of effort and to ensure comprehensive oversight of technology and cybersecurity risks within the broader enterprise risk management framework. Specifically:
(a) The Chairpersons of the Committee and the Risk Committee shall confer at least quarterly to coordinate agendas, share relevant risk information, and identify matters that may benefit from joint review or discussion.
(b) Technology and cybersecurity risks that constitute enterprise-level risks — including, without limitation, catastrophe exposure arising from systemic cyber events, aggregated cyber liability exposure across the Company's insurance portfolio, and technology-related operational risks — shall be jointly reviewed by the Committee and the Risk Committee as appropriate.
(c) The Risk Committee's charter (as restated concurrently with the adoption of this Charter, chaired by Raymond T. Huerta) includes insurance-specific risk categories — including reserving risk, reinsurance risk, catastrophe exposure, and underwriting risk — that may intersect with technology risks. The coordination protocol shall address the allocation of oversight responsibilities for risks that span both committees' mandates.
(d) The Chairpersons may establish joint meetings of the two committees as they deem appropriate, and members of each committee may attend meetings of the other committee as observers with the consent of the applicable Chairperson.
Section 5.2 — Coordination with the Audit Committee
The Committee shall maintain a coordination protocol with the Audit Committee (chaired by Dr. Lilian Fong-Archer) to ensure alignment on matters of mutual interest. Such matters include, without limitation:
(a) Internal audit findings related to IT controls, cybersecurity, and data integrity, as reported by the Chief Audit Executive (Renata M. Vásquez) and the Company's internal audit function.
(b) Observations from the Company's independent registered public accounting firm, Garrett & Whitfield LLP (Lead Engagement Partner: Roland S. Brewer), regarding IT-related internal controls over financial reporting, including any material weaknesses or significant deficiencies related to information technology.
(c) Disclosure obligations arising from cybersecurity incidents, including the requirements of Item 1.05 of Form 8-K and the annual cybersecurity risk management disclosures required by Item 106 of Regulation S-K.
(d) The Audit Committee's enterprise risk management oversight role, as set forth in the Audit Committee's restated charter, to the extent that such role encompasses technology and cybersecurity risks.
The Chairpersons of the Committee and the Audit Committee shall confer at least semi-annually, and more frequently as circumstances require, to ensure effective coordination on overlapping matters.
Section 5.3 — Coordination with the Investment Committee
The Committee shall coordinate with the Investment Committee (chaired by Jonathan K. Whitmore) on technology risks that may affect the Company's invested assets portfolio, which had total invested assets of approximately sixteen billion four hundred million dollars ($16.4 billion) as of December 31, 2024 (fiscal year 2024). Such technology risks include, without limitation, technology risks within the Company's investment management platforms, trading systems, custodial arrangements, and electronic trading interfaces, as well as cybersecurity risks that may affect the integrity, availability, or confidentiality of the Company's investment data and systems.
Section 5.4 — Coordination with the Nominating & Corporate Governance Committee
The Committee shall coordinate with the Nominating & Corporate Governance Committee (chaired by Arthur J. Pennington, Lead Independent Director) regarding director skills and qualifications related to technology and cybersecurity oversight. The Committee shall provide input to the Nominating & Corporate Governance Committee to inform the annual director skills-matrix assessment process, including the identification of technology and cybersecurity competencies that are important for the Board's effective oversight of the Company. The Committee shall also assist the Nominating & Corporate Governance Committee in evaluating director candidates who may possess technology or cybersecurity expertise relevant to service on the Committee.
ARTICLE VI — REPORTING
Section 6.1 — Reports to the Board
The Chairperson shall report to the full Board of Directors on the Committee's activities, findings, and recommendations at least quarterly, at each regularly scheduled meeting of the Board. Such reports shall include a summary of the matters discussed at the most recent Committee meeting, any significant actions taken by the Committee, and any matters requiring Board attention or action.
The Committee shall provide the Board with a written summary of significant matters reviewed at each Committee meeting, which summary shall be included in the materials distributed to the Board in advance of the applicable Board meeting. The Chairperson shall be available to respond to questions from directors regarding the Committee's activities and findings.
Section 6.2 — Annual Report
The Committee shall prepare and present to the Board an annual report summarizing the Committee's activities and findings for the preceding calendar year. The annual report shall include, at a minimum:
(a) An assessment of the state of the Company's cybersecurity program and IT strategy, including the Committee's evaluation of the program's effectiveness, maturity, and alignment with the Company's risk appetite.
(b) A summary of key risk trends and emerging threats identified during the year, and the Company's preparedness to address such risks and threats.
(c) An assessment of the adequacy of resources and personnel devoted to the Company's technology and cybersecurity functions.
(d) Any recommendations for Board consideration, including recommended changes to the Company's technology or cybersecurity strategy, budget, organizational structure, or governance practices.
(e) A summary of the Committee's coordination activities with the other standing committees of the Board, as described in Article V.
The annual report shall be presented to the Board at the first regularly scheduled Board meeting of each calendar year, covering the activities and findings of the preceding calendar year.
ARTICLE VII — DELEGATION AND ADVISORS
Section 7.1 — Delegation to Subcommittees
The Committee may, in its discretion, delegate specific responsibilities to one or more subcommittees, each consisting of one or more members of the Committee, to the extent permitted under Section 141(c) of the DGCL and the Company's Bylaws. Any such delegation shall be made by a majority vote of the voting members of the Committee. The Committee shall retain oversight of any responsibilities delegated to a subcommittee and shall receive reports from any subcommittee regarding the exercise of delegated authority.
Section 7.2 — Retention of Advisors
The Committee shall have the sole authority to retain and terminate independent outside advisors, including technology consultants, cybersecurity experts, forensic investigators, legal counsel, and other specialists, as the Committee deems necessary or appropriate to fulfill its responsibilities under this Charter. The Committee may retain such advisors without obtaining further Board approval, consistent with the authority granted to other standing committees of the Board under their respective charters.
The Company shall provide appropriate funding, as determined by the Committee in its sole discretion, for:
(a) the compensation of any independent outside advisors retained by the Committee;
(b) the payment of ordinary administrative expenses of the Committee that are necessary or appropriate in carrying out its duties; and
(c) any other expenses the Committee deems necessary to fulfill its responsibilities under this Charter.
The Committee's authority to retain independent outside advisors is in addition to, and does not limit, the authority of the Company's management to retain technology consultants, cybersecurity experts, and other advisors in the ordinary course of business.
ARTICLE VIII — ANNUAL SELF-EVALUATION
The Committee shall conduct an annual self-evaluation of its own performance, including a review of the adequacy of this Charter. The self-evaluation shall assess the Committee's effectiveness in fulfilling the responsibilities set forth in this Charter, the quality and timeliness of information received from management, the Committee's working relationship with management and with other standing committees of the Board, and any areas for improvement.
The results of the self-evaluation shall be reported to the Nominating & Corporate Governance Committee and the full Board. The Committee may, as part of its self-evaluation, recommend amendments to this Charter, which amendments shall be submitted to the Board for approval in accordance with Article X.
This self-evaluation requirement is consistent with the annual self-evaluation requirements adopted in the restated charters of all other standing committees of the Board — the Audit Committee, the Compensation & Human Capital Committee, the Nominating & Corporate Governance Committee, the Risk Committee, and the Investment Committee — reflecting the Board's commitment to continuous improvement in its governance practices.
ARTICLE IX — LIMITATIONS
While the Committee has the responsibilities and powers set forth in this Charter, it is not the duty of the Committee to design, implement, or operate the Company's technology systems, cybersecurity program, data privacy compliance program, or any other operational function. These are the responsibilities of the Company's management. The Committee's function is one of oversight, and the members of the Committee are not full-time employees of the Company and may not be experts in all areas within the scope of the Committee's oversight responsibilities.
Nothing in this Charter is intended to alter or impair the authority of any other committee of the Board as set forth in its respective charter, or to limit the authority of the full Board. To the extent that any responsibility assigned to the Committee under this Charter overlaps with a responsibility assigned to another standing committee under such committee's charter, the applicable committees shall coordinate their oversight activities as contemplated by Article V of this Charter and as the Board may otherwise direct.
The Committee's authority is subject to the limitations on committee powers under Section 141(c) of the DGCL, including that the Committee may not take actions reserved to the full Board under the DGCL, such as amending the Company's Certificate of Incorporation or Bylaws, declaring dividends, approving mergers or consolidations, recommending the dissolution of the Company, or authorizing the issuance of stock, except to the extent expressly permitted by law.
The Committee acknowledges that management and the Company's independent outside advisors have more extensive time, knowledge, and detailed information regarding the Company's technology and cybersecurity operations than do the members of the Committee. Accordingly, in carrying out its oversight responsibilities, the Committee is entitled to rely upon the expertise and knowledge of management and such advisors, and the accuracy of the information provided to the Committee by such persons, absent actual knowledge to the contrary.
ARTICLE X — AMENDMENT
This Charter may be amended, modified, or repealed by the Board of Directors at any time, by the affirmative vote of a majority of the directors then in office at any regular or special meeting of the Board.
The Committee shall review this Charter at least annually and shall recommend any proposed changes to the Board through the Nominating & Corporate Governance Committee. The Committee's annual review of the Charter shall take into account developments in governance best practices, regulatory requirements, the Company's business and risk profile, and the Committee's experience in fulfilling its responsibilities under the Charter.
No amendment to this Charter shall be effective unless and until approved by the Board. Any such amendment shall be promptly reflected in the version of this Charter posted on the Company's investor relations website, in accordance with applicable NYSE requirements.
ADOPTION AND EFFECTIVE DATE
This Charter was duly adopted by the Board of Directors of Quorum Insurance Holdings Corp. by resolution at the regular meeting of the Board of Directors held on December 11, 2025, at which a quorum of the Board was present and acting throughout.
The adoption of this Charter was authorized as part of the Omnibus Board Resolution (Resolution No. 2025-12-001) adopted at the December 11, 2025 Board meeting, which authorized the following governance actions:
(a) Adoption of this Charter establishing the Technology & Cybersecurity Oversight Committee as the sixth standing committee of the Board;
(b) Restatement of the charters of the five existing standing committees of the Board (the Audit Committee, the Compensation & Human Capital Committee, the Nominating & Corporate Governance Committee, the Risk Committee, and the Investment Committee) to reflect conforming amendments and inter-committee coordination protocols;
(c) Adoption of the revised Delegation of Authority Matrix, including the creation of a separate authorization tier for technology and IT expenditures;
(d) Adoption of the Amended & Restated Corporate Governance Guidelines of the Company; and
(e) Approval of conforming amendments to the Company's Second Amended and Restated Bylaws, including: Article III, Section 3.3, updated to reference six standing committees of the Board; Article III, Section 3.4, revised to update committee-appointment mechanics; and Article IV, Section 4.2, revised to update officer authority provisions with cross-references to the DOA Matrix.
This Charter shall become effective immediately upon its adoption by the Board and shall be posted on the Company's investor relations website (www.quoruminsuranceholdings.com/investors/governance) within five (5) business days of adoption, consistent with the requirements of the NYSE Listed Company Manual. The adoption of this Charter and the other governance actions authorized by the Omnibus Board Resolution will be disclosed in a Current Report on Form 8-K to be filed by the Company with the SEC on or about December 15, 2025.
Certified as a true and correct copy of the Charter as adopted by the Board of Directors on December 11, 2025.
QUORUM INSURANCE HOLDINGS CORP.
By: ________
Name: Dennis R. Okonkwo
Title: General Counsel & Corporate Secretary
Date: ________
Address:
280 Asylum Street, Suite 2200 Hartford, CT 06103

CHARTER OF THE TECHNOLOGY & CYBERSECURITY OVERSIGHT COMMITTEE OF THE BOARD OF DIRECTORS OF QUORUM INSURANCE HOLDINGS CORP.

ADOPTION AND EFFECTIVE DATE

QUORUM INSURANCE HOLDINGS CORP.

Record

Parties

Dates

Amounts