1025-00006 · Graystone Forensics LLC · Vendor Accountability

msa-amendment-3-enhanced-security.docx DOCUMENT Data Privacy

83 / 88 ← → ✕

THIRD AMENDMENT TO MASTER SERVICES AGREEMENT

This Third Amendment to the Master Services Agreement (this "Amendment 3") is entered into as of October 27, 2023 (the "Amendment 3 Effective Date"), by and between:

Quorum Insurance Holdings Corp., a Delaware corporation, with its principal place of business at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103 ("Client" or "Quorum"),

and

Palomar Data Solutions, Inc., a Texas corporation, with its principal place of business at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231 ("Service Provider" or "Palomar").

Client and Service Provider are each individually referred to herein as a "Party" and collectively as the "Parties."

RECITALS

WHEREAS, Client and Service Provider entered into that certain Master Services Agreement dated November 12, 2019 (the "Original MSA"), pursuant to which Service Provider provides claims data processing, document management, and analytics services to Client;

WHEREAS, the Original MSA was amended by that certain First Amendment to the Master Services Agreement dated March 3, 2021 ("Amendment 1"), which, among other things, added processing services related to Client's QuorumEdge digital underwriting platform and increased the annual contract value by Two Million One Hundred Thousand Dollars ($2,100,000), from Fourteen Million Two Hundred Thousand Dollars ($14,200,000) to Sixteen Million Three Hundred Thousand Dollars ($16,300,000), effective April 1, 2021;

WHEREAS, the Original MSA was further amended by that certain Second Amendment to the Master Services Agreement dated September 15, 2022 ("Amendment 2"), which updated the Data Security Exhibit (Exhibit D), added a SOC 2 Type II audit requirement, and updated the cyber insurance minimums set forth in Exhibit E (the Original MSA, as amended by Amendment 1 and Amendment 2, collectively, the "MSA");

WHEREAS, on or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability (CVE-2023-0669) in Service Provider's GoAnywhere MFT file transfer appliance to gain unauthorized access to Service Provider's network, resulting in the exfiltration of Client Data over a period of approximately thirty-five (35) days through April 18, 2023 (the "Security Incident");

WHEREAS, the Security Incident resulted in the compromise of personally identifiable information, protected health information, and financial data of approximately 318,247 of Client's policyholders and claimants across twenty-nine (29) states and the District of Columbia;

WHEREAS, the Parties have entered into a separate Settlement Agreement and Mutual Release of even date herewith (the "Settlement Agreement") resolving certain claims arising from or related to the Security Incident;

WHEREAS, in connection with the Settlement Agreement, the Parties desire to amend the MSA to enhance data security requirements, audit provisions, and incident notification obligations, and to implement certain fee adjustments, all as more particularly set forth herein; and

NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

1. DEFINITIONS

1.1 Capitalized terms used but not otherwise defined in this Amendment 3 shall have the meanings ascribed to such terms in the MSA.

1.2 In addition to the defined terms set forth in the MSA, the following terms shall have the meanings set forth below for purposes of this Amendment 3 and the MSA as amended hereby:

(a) "Amendment 3 Effective Date" means October 27, 2023, the date first written above.

(b) "Critical Vulnerability" means any vulnerability rated Critical or High with a Common Vulnerability Scoring System ("CVSS") score of 7.0 or above, as published by the National Institute of Standards and Technology ("NIST") National Vulnerability Database, or as designated Critical or High by the applicable software or hardware vendor in its security advisory or bulletin. For the avoidance of doubt, a vulnerability designated as Critical or High by the applicable vendor shall be treated as a Critical Vulnerability regardless of its CVSS score.

(c) "Endpoint Detection and Response" or "EDR" means a category of cybersecurity tools and solutions that continuously monitor, detect, investigate, and respond to cyber threats at the endpoint level, including but not limited to workstations, laptops, servers, and other networked devices.

(d) "Fee Reduction Period" means the eighteen (18)-month period commencing on November 1, 2023 and ending on April 30, 2025.

(e) "Independent Security Assessor" means a qualified, independent third-party cybersecurity assessment firm mutually agreed upon by the Parties, which firm shall not be an affiliate, subsidiary, or parent company of Service Provider and shall not have provided consulting, implementation, integration, or other non-assessment services to Service Provider within the twelve (12) months preceding any assessment performed hereunder. The initial Independent Security Assessor shall be selected within sixty (60) days of the Amendment 3 Effective Date, subject to Client's prior written approval, which approval shall not be unreasonably withheld, conditioned, or delayed.

(f) "Quarterly Vulnerability Scan" means automated and manual vulnerability scanning of all systems, applications, and network segments that store, process, or transmit Client Data, conducted no less frequently than once per calendar quarter in accordance with Section 2.4 of this Amendment 3.

(g) "Security Incident" shall have the meaning set forth in the Recitals of this Amendment 3, and for purposes of Section 3 and Exhibit D as amended hereby, shall also mean any event constituting a "Security Incident" as defined in the amended and restated Exhibit D attached as Appendix 1 hereto.

2. AMENDMENTS TO EXHIBIT D (DATA SECURITY REQUIREMENTS)

2.1 General. Exhibit D of the MSA, as previously amended by Amendment 2, is hereby amended and restated in its entirety, as set forth in Appendix 1 to this Amendment 3. In the event of any conflict or inconsistency between the prior version of Exhibit D (including as amended by Amendment 2) and Appendix 1 attached hereto, Appendix 1 shall control and supersede the prior version in all respects. All references in the MSA or any Statement of Work to "Exhibit D" shall, from and after the Amendment 3 Effective Date, be deemed to refer to Appendix 1 to this Amendment 3.

2.2 Enhanced Patch Management.

(a) Section D-3 of Exhibit D, as previously in effect, is hereby deleted in its entirety and replaced with the following enhanced patch management requirements. Service Provider shall apply patches, updates, or vendor-recommended remediations for all Critical Vulnerabilities within fourteen (14) calendar days of the date on which the applicable vendor, NIST, or the relevant security community makes a patch, update, or remediation publicly available. For reference, the prior requirement under Exhibit D, as amended by Amendment 2, provided for a thirty (30)-day patching window for critical vulnerabilities; the Parties acknowledge and agree that the fourteen (14)-day requirement set forth herein reflects the heightened security posture necessitated by the circumstances described in the Recitals.

(b) Service Provider shall apply patches, updates, or vendor-recommended remediations for all Medium-severity vulnerabilities, defined as those with a CVSS score of 4.0 through 6.9, within thirty (30) calendar days of the date on which the applicable patch, update, or remediation is made publicly available.

(c) Service Provider shall apply patches, updates, or vendor-recommended remediations for all Low-severity vulnerabilities, defined as those with a CVSS score below 4.0, within sixty (60) calendar days of the date on which the applicable patch, update, or remediation is made publicly available.

(d) In the event that Service Provider determines, in good faith, that a patch for a Critical Vulnerability cannot be applied within fourteen (14) calendar days due to a documented technical limitation, system dependency, or risk of material disruption to Client services, Service Provider shall:

(i) notify Client in writing within seven (7) calendar days of the date the patch or remediation became available, identifying the specific technical limitation or system dependency preventing timely application;

(ii) implement commercially reasonable compensating controls designed to mitigate the risk associated with the unpatched vulnerability within the fourteen (14)-day period referenced in Section 2.2(a);

(iii) apply the full patch or remediation no later than thirty (30) calendar days after the date the patch or remediation became available; and

(iv) document all compensating controls implemented pursuant to this Section 2.2(d) and provide such documentation to Client promptly upon request.

(e) Service Provider shall maintain a comprehensive patch management log documenting all patches applied, the dates of application, any exceptions or delays, compensating controls implemented, and the rationale for any deviation from the timelines set forth in this Section 2.2. Service Provider shall make such patch management log available to Client and the Independent Security Assessor upon reasonable request.

2.3 Mandatory Endpoint Detection and Response (EDR).

(a) Service Provider shall deploy an enterprise-grade Endpoint Detection and Response solution across all endpoints, servers, and systems that store, process, or transmit Client Data, including without limitation workstations, laptops, virtual machines, and physical and cloud-based servers within Service Provider's environment that handle Client Data.

(b) EDR deployment shall be completed no later than ninety (90) calendar days after the Amendment 3 Effective Date (i.e., no later than January 25, 2024). Service Provider acknowledges that this deadline is a material obligation and that failure to meet this deadline may result in the consequences set forth in Section 6.3 of this Amendment 3.

(i) real-time threat detection and alerting;

(ii) automated response capabilities, including the ability to isolate compromised endpoints;

(iii) behavioral analysis using machine learning or heuristic techniques to identify anomalous activity;

(iv) forensic data collection and retention capabilities sufficient to support post-incident investigation; and

(v) centralized management, logging, and alerting through a unified console or dashboard.

(d) Service Provider shall ensure that the EDR solution is actively monitored by trained security operations personnel on a twenty-four (24) hours per day, seven (7) days per week, three hundred sixty-five (365) days per year (24/7/365) basis. Such monitoring may be performed by Service Provider's internal security operations center or by a qualified managed detection and response provider engaged by Service Provider, provided that Service Provider shall remain responsible for all obligations hereunder regardless of any such delegation.

(e) Service Provider shall provide Client with written confirmation of EDR deployment within five (5) business days of completion, which confirmation shall include the identity of the EDR solution vendor, the scope of deployment, and confirmation that 24/7/365 monitoring is operational.

2.4 Quarterly Vulnerability Scanning.

(a) Service Provider shall conduct Quarterly Vulnerability Scans of all systems, network segments, applications, databases, and infrastructure components that store, process, or transmit Client Data. Quarterly Vulnerability Scans shall be conducted no less frequently than once per calendar quarter.

(b) Each Quarterly Vulnerability Scan shall include both internal and external scanning, encompassing all network-accessible systems and services within the scope of the MSA. Scans shall be conducted using industry-standard scanning tools and methodologies consistent with generally accepted information security practices.

(c) Within fifteen (15) business days of the completion of each Quarterly Vulnerability Scan, Service Provider shall deliver to Client a written report (each, a "Quarterly Vulnerability Report") summarizing:

(i) the scope of the scan, including systems, network segments, and applications scanned;

(ii) all identified vulnerabilities, categorized by severity level (Critical, High, Medium, Low, and Informational);

(iii) the remediation status and anticipated timeline for remediation of each identified vulnerability; and

(iv) any compensating controls currently in place to mitigate the risk associated with unpatched or unresolved vulnerabilities.

(d) Quarterly Vulnerability Reports shall be delivered to Client's Chief Information Security Officer (currently David Naranjo) and Vice President, Vendor Risk Management (currently Priya Deshmukh), at the email addresses or mailing addresses designated by Client in writing from time to time. Client may update the designated recipients and contact information upon written notice to Service Provider.

(e) The first Quarterly Vulnerability Scan under this Amendment 3 shall be completed no later than January 31, 2024.

2.5 Annual Independent Security Assessment.

(a) Service Provider shall, at its sole cost and expense, engage the Independent Security Assessor to conduct a comprehensive annual security assessment of Service Provider's systems, controls, policies, procedures, and practices as they relate to the storage, processing, and transmission of Client Data. The scope of the annual security assessment shall encompass all environments, facilities, and personnel involved in the delivery of services to Client under the MSA.

(b) The annual security assessment shall include, at a minimum, the following components:

(i) penetration testing, including both internal and external penetration tests of systems and applications that store, process, or transmit Client Data;

(ii) review and evaluation of access controls, including role-based access controls, multi-factor authentication implementation, and privileged account management;

(iii) evaluation of network segmentation to assess the degree of isolation between Client Data systems and Service Provider's general corporate network and systems processing data of other clients;

(iv) assessment of patch management practices, including compliance with the timelines and processes set forth in Section 2.2 of this Amendment 3;

(v) review of incident response capabilities, including tabletop exercises and evaluation of Service Provider's incident response plan; and

(vi) evaluation of the EDR deployment, including coverage, monitoring effectiveness, and alert response procedures.

(c) The Independent Security Assessor shall deliver a written report of findings and recommendations (the "Annual Security Assessment Report") to both Client and Service Provider no later than thirty (30) calendar days after the completion of the assessment fieldwork. The Annual Security Assessment Report shall include a description of the assessment methodology, detailed findings categorized by severity, specific recommendations for remediation, and an executive summary.

(d) Within thirty (30) calendar days of Service Provider's receipt of the Annual Security Assessment Report, Service Provider shall develop and provide to Client a written remediation plan addressing all findings rated High or Critical in the Annual Security Assessment Report. The remediation plan shall include specific remediation actions, responsible personnel, and target completion dates. Service Provider shall complete remediation of all High and Critical findings within ninety (90) calendar days of the date of the remediation plan.

(e) The first annual security assessment under this Amendment 3 shall be completed no later than April 30, 2024.

(f) The Independent Security Assessor shall be independent of Service Provider and shall not have provided consulting, implementation, integration, managed services, or other non-assessment services to Service Provider within the twelve (12) months preceding the commencement of any assessment. Service Provider shall provide Client with a written attestation of the Independent Security Assessor's independence prior to the commencement of each annual assessment.

(g) For the avoidance of doubt, Service Provider shall continue to maintain and provide to Client an annual SOC 2 Type II report as required by Amendment 2 and the MSA. The annual independent security assessment required by this Section 2.5 is in addition to, and not a replacement for, the SOC 2 Type II audit requirement. Service Provider's current SOC 2 Type II auditor is Kessler, Park & Associates CPA, PLLC. Service Provider shall provide Client with each annual SOC 2 Type II report within thirty (30) days of its issuance.

2.6 Continued Data Security Obligations. All other provisions of Exhibit D not specifically amended by this Section 2 or by Appendix 1 hereto, including without limitation requirements for administrative, technical, and physical safeguards, encryption standards (including AES-256 encryption at rest and TLS 1.2 or higher in transit), access controls, employee security awareness training, network segmentation, data disposal in accordance with NIST SP 800-88, and subcontractor security requirements, shall remain in full force and effect as set forth in Appendix 1 to this Amendment 3.

3. AMENDMENT TO SECTION 9.4 (SECURITY INCIDENT NOTIFICATION)

3.1 Section 9.4 of the MSA is hereby deleted in its entirety and replaced with the following:

(a) Notification Timeline. Service Provider shall notify Client of any Security Incident (as defined in Exhibit D as amended and restated by Appendix 1 hereto) affecting or reasonably believed to affect Client Data within twenty-four (24) hours of Service Provider's discovery of, or the point at which Service Provider reasonably should have discovered or developed a reasonable belief that, such Security Incident has occurred. For reference, this twenty-four (24)-hour notification requirement replaces the prior forty-eight (48)-hour notification requirement set forth in the original Section 9.4 of the MSA.

(b) Notification Recipients. Notification shall be provided simultaneously to the following Client personnel, via both email to designated email addresses and by telephone to designated telephone numbers, as updated by Client from time to time in writing:

(i) Client's General Counsel (currently Thomas R. Whitfield), at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103;

(ii) Client's Chief Information Security Officer (currently David Naranjo); and

(iii) Client's Chief Privacy Officer (currently Jennifer Liang).

(c) Initial Notification Content. The initial notification shall include, to the extent known at the time of notification:

(i) the date and time of discovery of the Security Incident;

(ii) a description of the nature and scope of the Security Incident, including the attack vector and systems affected;

(iii) the types of Client Data believed to be affected or potentially compromised;

(iv) the estimated number of affected individuals, if applicable;

(v) a summary of Service Provider's initial containment and mitigation actions taken or underway; and

(vi) a designated point of contact at Service Provider for ongoing communications regarding the Security Incident, including direct telephone number and email address.

(d) Ongoing Updates. Service Provider shall provide written updates to Client every twenty-four (24) hours following the initial notification until the Security Incident is contained and a preliminary investigation has been completed. Thereafter, Service Provider shall provide updates at such intervals as Client may reasonably request, but no less frequently than weekly, until the investigation is concluded and all remediation activities are complete.

(e) Cooperation. Service Provider shall cooperate fully and in good faith with Client, Client's outside counsel, and any forensic investigators or other consultants retained by or at the direction of Client or Client's counsel in connection with the investigation, remediation, response, and any regulatory notifications arising from or related to any Security Incident. Such cooperation shall include, without limitation, providing timely access to relevant systems, logs, personnel, documentation, and facilities, and preserving all relevant evidence in accordance with applicable law and any litigation hold instructions from Client or Client's counsel.

4. FEE ADJUSTMENT

4.1 Fee Reduction. Effective November 1, 2023, and continuing through April 30, 2025 (the "Fee Reduction Period"), the annual contract value payable by Client to Service Provider under the MSA shall be reduced by eight percent (8%) from the annual contract value then in effect.

4.2 Calculation. The current annual contract value under the MSA is Sixteen Million Three Hundred Thousand Dollars ($16,300,000), as established by Amendment 1 effective April 1, 2021. During the Fee Reduction Period, the annual contract value shall be reduced to Fourteen Million Nine Hundred Ninety-Six Thousand Dollars ($14,996,000), calculated as $16,300,000 multiplied by 0.92.

4.3 Total Fee Reduction. The aggregate fee reduction over the eighteen (18)-month Fee Reduction Period shall be One Million Nine Hundred Fifty-Six Thousand Dollars ($1,956,000), calculated as $16,300,000 multiplied by eight percent (8%) multiplied by 1.5 years.

4.4 Reversion. Effective May 1, 2025, the annual contract value shall automatically revert to Sixteen Million Three Hundred Thousand Dollars ($16,300,000), unless otherwise modified by a separate written agreement executed by both Parties. For the avoidance of doubt, the reversion of the annual contract value to $16,300,000 shall not require any further amendment to the MSA and shall occur automatically upon the expiration of the Fee Reduction Period.

4.5 Settlement Agreement Integration. The fee adjustment set forth in this Section 4 is made in connection with, and as partial consideration for, the settlement of claims described in the Settlement Agreement and Mutual Release of even date herewith. The Parties acknowledge and agree that this fee adjustment shall be in addition to, and not in lieu of, the cash payment of Four Million Two Hundred Thousand Dollars ($4,200,000) from Service Provider to Client as set forth in Section 3.1 of the Settlement Agreement. The aggregate value of the settlement consideration, including both the cash payment and the fee reduction, is Six Million One Hundred Fifty-Six Thousand Dollars ($6,156,000).

4.6 Pro-Ration. Monthly invoices issued by Service Provider during the Fee Reduction Period shall reflect the reduced annual contract value on a pro rata monthly basis. Accordingly, the monthly invoice amount during the Fee Reduction Period shall be One Million Two Hundred Forty-Nine Thousand Six Hundred Sixty-Seven Dollars ($1,249,667), calculated as $14,996,000 divided by twelve (12), rounded to the nearest dollar.

5. REPRESENTATIONS AND WARRANTIES OF SERVICE PROVIDER

5.1 Service Provider represents and warrants to Client that, as of the Amendment 3 Effective Date:

(a) Authority. Service Provider has the corporate power and authority to enter into this Amendment 3 and to perform its obligations hereunder. The execution, delivery, and performance of this Amendment 3 by Service Provider have been duly authorized by all necessary corporate action on the part of Service Provider.

(b) No Conflict. The execution, delivery, and performance of this Amendment 3 by Service Provider does not and will not (i) violate the certificate of incorporation, bylaws, or other organizational documents of Service Provider, (ii) conflict with, result in a breach of, or constitute a default under any agreement, contract, or instrument to which Service Provider is a party or by which Service Provider or its assets are bound, or (iii) violate any applicable law, regulation, order, or judgment.

(c) Insurance. Service Provider currently maintains cyber-liability insurance coverage with a minimum coverage amount of Ten Million Dollars ($10,000,000) per occurrence, as required by Exhibit E of the MSA (as amended by Amendment 2). Service Provider shall provide Client with a certificate of insurance evidencing such coverage within ten (10) business days of the Amendment 3 Effective Date and thereafter upon renewal or upon Client's reasonable request.

(d) Remediation Status. Service Provider is actively engaged in the process of remediating all known vulnerabilities identified during and subsequent to the Security Incident and has committed and allocated resources necessary to complete the implementation of the EDR solution and enhanced patch management processes within the timelines specified in Sections 2 and 6 of this Amendment 3. Service Provider acknowledges that the timely completion of such remediation activities is a material inducement to Client entering into this Amendment 3 and the Settlement Agreement.

6. REMEDIATION MILESTONES AND REPORTING

6.1 Remediation Milestones. Service Provider shall comply with the following remediation milestones:

(a) EDR Deployment. Service Provider shall complete the deployment of an enterprise-grade Endpoint Detection and Response solution across all systems that store, process, or transmit Client Data no later than January 25, 2024 (ninety (90) calendar days from the Amendment 3 Effective Date). Service Provider shall provide Client with written confirmation of completion of EDR deployment within five (5) business days of deployment completion, in the form specified in Section 2.3(e) of this Amendment 3.

(b) Enhanced Patch Management Implementation. Service Provider shall have fully operational enhanced patch management processes consistent with the requirements of Section 2.2 of this Amendment 3 no later than January 25, 2024 (ninety (90) calendar days from the Amendment 3 Effective Date). Full operationalization shall include the establishment of documented procedures, assignment of responsible personnel, deployment of necessary tools, and activation of the patch management log.

(c) First Quarterly Vulnerability Scan. The first Quarterly Vulnerability Scan under this Amendment 3 shall be completed, and the corresponding Quarterly Vulnerability Report delivered to Client, no later than January 31, 2024.

(d) Independent Security Assessor Selection. The Independent Security Assessor shall be mutually agreed upon by the Parties within sixty (60) days of the Amendment 3 Effective Date (i.e., by December 26, 2023), subject to Client's prior written approval as set forth in Section 1.2(e) of this Amendment 3.

(e) First Annual Independent Security Assessment. The first annual independent security assessment shall be completed, and the Annual Security Assessment Report delivered to both Parties, no later than April 30, 2024.

6.2 Monthly Progress Reports. Commencing within thirty (30) days of the Amendment 3 Effective Date and continuing monthly thereafter until all remediation milestones set forth in Section 6.1 have been completed, Service Provider shall provide Client with written progress reports on the status of each remediation milestone. Each monthly progress report shall include: (i) the current status of each milestone; (ii) any risks, issues, or impediments to timely completion; (iii) anticipated completion dates; and (iv) actions being taken to address any identified risks or delays. Monthly progress reports shall be delivered to the Client personnel identified in Section 2.4(d) of this Amendment 3.

6.3 Consequences of Failure. Failure by Service Provider to meet any remediation milestone within the timeframe specified in Section 6.1 shall constitute a material breach of this Amendment 3 and the MSA, and Client shall have the rights and remedies set forth in Section 14.2 of the MSA (Termination for Cause), provided that the cure period applicable to any such breach shall be fifteen (15) calendar days (reduced from the thirty (30)-calendar-day cure period set forth in the original Section 14.2 of the MSA, solely for purposes of breaches of Section 6.1 of this Amendment 3). The reduced cure period reflects the critical nature of the remediation milestones and the heightened security posture required following the Security Incident. For the avoidance of doubt, all other provisions of Section 14.2 of the MSA, including applicable notice requirements, shall continue to apply.

7. AUDIT RIGHTS

7.1 Enhanced Audit Rights. In addition to any audit rights set forth in the MSA (including without limitation Section 12.3 thereof), Client and its designated representatives, including without limitation external counsel, forensic investigators, independent auditors, and the Independent Security Assessor, shall have the right, upon no fewer than ten (10) business days' prior written notice, to audit, inspect, and assess Service Provider's security controls, systems, facilities, policies, procedures, and personnel as they relate to the storage, processing, and transmission of Client Data. Such audits may be conducted no more than twice per calendar year; provided, however, that this limitation shall not apply to (i) the annual independent security assessment conducted pursuant to Section 2.5 of this Amendment 3, or (ii) any audit triggered by a Security Incident as described in Section 7.2 below.

7.2 Audit Rights Following Security Incident. In the event of a Security Incident affecting or reasonably believed to affect Client Data, Client shall have the right to conduct an immediate audit upon reasonable notice (which may be less than ten (10) business days) and without limitation on frequency. Such audit rights shall continue for the duration of the investigation and remediation of the applicable Security Incident.

7.3 Cooperation. Service Provider shall cooperate fully and in good faith with any audit conducted pursuant to this Section 7 and shall provide reasonable access to facilities, personnel, systems, system logs, security records, policies, procedures, and other documentation as reasonably requested by Client or its designated representatives. Service Provider shall designate a knowledgeable point of contact to facilitate each audit and shall respond to audit inquiries and information requests in a timely manner. Service Provider shall not charge Client any fees or costs in connection with Client's exercise of its audit rights under this Section 7.

8. RELATIONSHIP TO SETTLEMENT AGREEMENT

8.1 This Amendment 3 is entered into concurrently with the Settlement Agreement and Mutual Release dated October 27, 2023, between Client and Service Provider (the "Settlement Agreement"). The Settlement Agreement provides for, among other things, a cash payment of Four Million Two Hundred Thousand Dollars ($4,200,000) from Service Provider to Client and the fee reduction set forth in Section 4 of this Amendment 3, as partial consideration for the resolution of certain claims arising from or related to the Security Incident.

8.2 This Amendment 3 is independent of, and shall survive, any termination, rescission, or expiration of the Settlement Agreement. The data security enhancements, audit provisions, incident notification obligations, remediation milestones, and all other obligations and requirements set forth in this Amendment 3 shall remain binding on Service Provider for the remaining term of the MSA and any renewals, extensions, or successor agreements thereto, regardless of the status of the Settlement Agreement.

8.3 Nothing in this Amendment 3 shall be construed as, or deemed to constitute, an admission of liability, fault, wrongdoing, or negligence by either Party with respect to the Security Incident or any claims arising therefrom. Each Party's respective rights, obligations, releases, and waivers with respect to the Security Incident are governed exclusively by the terms and conditions of the Settlement Agreement and Mutual Release, and this Amendment 3 shall not be used as evidence of, or in support of, any claim of liability by either Party.

9. TERM

9.1 The term of the MSA, as previously established, commenced on November 12, 2019 and is scheduled to expire on November 11, 2024 (the initial five (5)-year term from the Original MSA effective date), unless earlier terminated in accordance with the MSA or extended by written agreement of the Parties.

9.2 The amendments set forth in this Amendment 3 shall be effective as of the Amendment 3 Effective Date and shall remain in full force and effect for the remaining term of the MSA and any renewals, extensions, or successor agreements entered into by the Parties.

9.3 For the avoidance of doubt, the Fee Reduction Period commences on November 1, 2023 and extends through April 30, 2025, and shall survive the expiration of the initial term of the MSA if the MSA is renewed or extended beyond November 11, 2024. In the event that the MSA is not renewed or extended beyond November 11, 2024, the fee reduction shall apply through the date of termination or expiration of the MSA, and no fee reduction shall be owed for any period after the MSA has terminated or expired.

10. NO OTHER AMENDMENTS; CONFLICTS

10.1 Except as expressly modified, amended, or supplemented by this Amendment 3, the MSA (including all prior amendments, exhibits, appendices, schedules, and Statements of Work) shall remain in full force and effect and is hereby ratified and confirmed in all respects.

10.2 In the event of any conflict or inconsistency between the terms and conditions of this Amendment 3 and the terms and conditions of the MSA (including Amendment 1, Amendment 2, and all exhibits and schedules thereto), the terms and conditions of this Amendment 3 shall prevail and control to the extent of such conflict or inconsistency.

10.3 This Amendment 3, together with the MSA (including Amendment 1 and Amendment 2), the Settlement Agreement and Mutual Release of even date herewith, and all exhibits, appendices, schedules, and Statements of Work attached to or incorporated by reference in any of the foregoing, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior and contemporaneous negotiations, representations, understandings, and agreements, whether written or oral, relating to such subject matter.

11. GOVERNING LAW; DISPUTE RESOLUTION

11.1 This Amendment 3 shall be governed by and construed in accordance with the laws of the State of Connecticut, without regard to its conflict of laws principles, consistent with the governing law provision set forth in Section 18.1 of the MSA.

11.2 Any dispute, controversy, or claim arising under or in connection with this Amendment 3, or the breach, termination, or validity thereof, shall be resolved in accordance with the dispute resolution provisions set forth in Section 18 of the MSA.

12. COUNTERPARTS; ELECTRONIC SIGNATURES

12.1 This Amendment 3 may be executed in any number of counterparts, each of which shall be deemed an original and all of which, when taken together, shall constitute one and the same instrument. Delivery of an executed counterpart of this Amendment 3 by facsimile, electronic mail (including PDF), or other electronic transmission shall be equally effective as delivery of a manually executed counterpart.

12.2 The Parties agree that electronic or digital signatures affixed to this Amendment 3 shall have the same legal force and effect as original ink signatures to the fullest extent permitted by applicable law, including the Electronic Signatures in Global and National Commerce Act (E-SIGN Act), 15 U.S.C. §§ 7001 et seq., and any applicable state law governing electronic signatures.

13. NOTICES

13.1 All notices, requests, demands, consents, and other communications required or permitted to be given under this Amendment 3 shall be in writing and shall be delivered in accordance with the notice provisions set forth in Section 17 of the MSA, with copies as follows:

If to Client:

Thomas R. Whitfield, General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

With a copy (which shall not constitute notice) to:

Kevin Ostrowski Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

If to Service Provider:

Derek Copeland, General Counsel Palomar Data Solutions, Inc. 7100 Greenville Avenue, Suite 450 Dallas, TX 75231

With a copy (which shall not constitute notice) to:

Catherine Langford Mercer, Haight & Dunlop LLP 2100 Ross Avenue, Suite 3600 Dallas, TX 75201

Either Party may change its notice address or designated recipients by providing written notice to the other Party in accordance with the MSA.

[Remainder of Page Intentionally Left Blank — Signature Page Follows]

IN WITNESS WHEREOF, the Parties have executed this Third Amendment to the Master Services Agreement as of the date first written above.

QUORUM INSURANCE HOLDINGS CORP.

By: ________

Name: Thomas R. Whitfield

Title: General Counsel

Date: October 27, 2023

PALOMAR DATA SOLUTIONS, INC.

By: ________

Name: Derek Copeland

Title: General Counsel

Date: October 27, 2023

APPENDIX 1

AMENDED AND RESTATED EXHIBIT D — DATA SECURITY REQUIREMENTS

This Appendix 1 constitutes the Amended and Restated Exhibit D to the Master Services Agreement, effective as of October 27, 2023 (the Amendment 3 Effective Date). This Appendix 1 supersedes and replaces in its entirety the prior version of Exhibit D, including as amended by Amendment 2.

D-1. General Security Obligations

Service Provider shall implement and maintain commercially reasonable administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Client Data against unauthorized access, acquisition, use, disclosure, modification, destruction, or loss, consistent with (i) industry standards, including ISO/IEC 27001, the NIST Cybersecurity Framework, and the CIS Critical Security Controls; (ii) all applicable federal, state, and local laws, statutes, regulations, and rules, including without limitation the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act (HIPAA), and applicable state data breach notification laws; and (iii) the specific requirements set forth in this Exhibit D. Service Provider shall regularly review and update its information security program to address evolving threats and vulnerabilities and changes in applicable law.

D-2. Access Controls

Service Provider shall implement and maintain the following access control measures with respect to all systems that store, process, or transmit Client Data:

(a) Role-Based Access Controls. Access to Client Data shall be restricted to Service Provider personnel who require such access in order to perform their assigned duties in connection with the services provided under the MSA. Access rights shall be assigned based on the principle of least privilege and shall be commensurate with each individual's job function and responsibilities.

(b) Multi-Factor Authentication. Multi-factor authentication ("MFA") shall be required for (i) all remote access to Service Provider's systems and networks that store, process, or transmit Client Data; (ii) all access to privileged accounts, including administrative accounts, root accounts, and accounts with elevated permissions; and (iii) all access to the EDR management console, vulnerability scanning tools, and patch management systems.

(c) Regular Access Reviews. Service Provider shall conduct reviews of access rights and permissions no less frequently than quarterly to verify that access remains appropriate and consistent with the principle of least privilege. Access rights shall be promptly revoked for personnel who no longer require access due to termination, transfer, or change in job responsibilities.

(d) Unique User Identification. Each individual with access to Client Data shall be assigned a unique user identifier. Shared accounts or generic credentials shall not be used to access Client Data.

D-3. Patch Management (Amended)

Service Provider shall maintain a documented patch management program that ensures the timely identification, evaluation, testing, and application of security patches, updates, and vendor-recommended remediations across all systems, applications, and infrastructure components that store, process, or transmit Client Data. The following timelines shall apply:

(a) Critical Vulnerabilities (CVSS score of 7.0 or above, or as designated Critical or High by the applicable vendor): patches or remediations shall be applied within fourteen (14) calendar days of public availability.

(b) Medium Vulnerabilities (CVSS score of 4.0 through 6.9): patches or remediations shall be applied within thirty (30) calendar days of public availability.

(c) Low Vulnerabilities (CVSS score below 4.0): patches or remediations shall be applied within sixty (60) calendar days of public availability.

(d) Exception Process. In the event that a patch for a Critical Vulnerability cannot be applied within fourteen (14) calendar days due to a documented technical limitation or system dependency, Service Provider shall: (i) notify Client in writing within seven (7) calendar days of patch availability, identifying the specific limitation; (ii) implement compensating controls within the fourteen (14)-day period; (iii) apply the full remediation no later than thirty (30) calendar days after patch availability; and (iv) document all compensating controls and make such documentation available to Client upon request.

(e) Patch Management Log. Service Provider shall maintain a comprehensive patch management log and shall make it available to Client and the Independent Security Assessor upon request.

D-4. Endpoint Detection and Response

Service Provider shall deploy and maintain an enterprise-grade Endpoint Detection and Response (EDR) solution across all endpoints, servers, and systems that store, process, or transmit Client Data. The EDR solution shall include, at a minimum: real-time threat detection and alerting, automated response capabilities (including endpoint isolation), behavioral analysis, forensic data collection and retention, and centralized management and alerting. The EDR solution shall be monitored by trained security operations personnel on a 24/7/365 basis. Initial deployment shall be completed no later than ninety (90) calendar days from the Amendment 3 Effective Date (January 25, 2024). Service Provider shall provide Client with written confirmation of EDR deployment, including the identity of the EDR solution vendor, within five (5) business days of completion.

D-5. Vulnerability Scanning

Service Provider shall conduct Quarterly Vulnerability Scans (both internal and external) of all systems, network segments, applications, and infrastructure components that store, process, or transmit Client Data, using industry-standard scanning tools and methodologies. Within fifteen (15) business days of the completion of each Quarterly Vulnerability Scan, Service Provider shall deliver to Client a written Quarterly Vulnerability Report summarizing: (i) the scope of the scan; (ii) all identified vulnerabilities, categorized by severity; (iii) the remediation status and anticipated timeline for each identified vulnerability; and (iv) any compensating controls in place. Quarterly Vulnerability Reports shall be delivered to Client's Chief Information Security Officer and Vice President, Vendor Risk Management, at the addresses designated by Client in writing. The first Quarterly Vulnerability Scan shall be completed no later than January 31, 2024.

D-6. Annual Security Assessment

Service Provider shall, at its sole cost and expense, engage the Independent Security Assessor (as defined in Amendment 3) to conduct a comprehensive annual security assessment of Service Provider's systems, controls, and practices as they relate to the storage, processing, and transmission of Client Data. The annual assessment shall include, at a minimum: internal and external penetration testing; review of access controls; evaluation of network segmentation; assessment of patch management practices; review of incident response capabilities; and evaluation of the EDR deployment. The Independent Security Assessor shall deliver a written Annual Security Assessment Report to both Client and Service Provider within thirty (30) calendar days of the completion of fieldwork. Service Provider shall develop and deliver to Client a written remediation plan for all High and Critical findings within thirty (30) calendar days of receipt of the report, and shall complete remediation of all High and Critical findings within ninety (90) calendar days of the remediation plan. The first annual assessment shall be completed no later than April 30, 2024.

D-7. SOC 2 Type II Audit

Service Provider shall continue to maintain and provide to Client an annual SOC 2 Type II report, covering the trust services criteria of security, availability, processing integrity, confidentiality, and privacy, as applicable to the services provided under the MSA. The SOC 2 Type II report shall be issued by a qualified, independent certified public accounting firm. Service Provider's current SOC 2 Type II auditor is Kessler, Park & Associates CPA, PLLC. Service Provider shall provide Client with each SOC 2 Type II report within thirty (30) calendar days of its issuance. The annual independent security assessment required by Section D-6 is in addition to, and not a replacement for, the SOC 2 Type II audit requirement.

D-8. Encryption. Service Provider shall encrypt all Client Data as follows:

(a) At Rest. All Client Data stored on Service Provider's systems, databases, storage media, and backup media shall be encrypted using the Advanced Encryption Standard (AES) with a minimum key length of 256 bits (AES-256) or equivalent or stronger encryption standard.

(b) In Transit. All Client Data transmitted over public or untrusted networks, including the internet, shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher, or equivalent or stronger encryption protocol.

(c) Key Management. Service Provider shall implement and maintain encryption key management procedures consistent with industry best practices, including secure key generation, storage, rotation, distribution, and destruction.

D-9. Network Segmentation

Service Provider shall ensure that all systems, network segments, databases, and infrastructure components that store, process, or transmit Client Data are logically and, where practicable, physically segmented from Service Provider's general corporate network and from systems, network segments, and databases that store, process, or transmit data belonging to other Service Provider clients. Network segmentation controls shall be designed to prevent unauthorized lateral movement between network segments and shall be subject to regular review and testing as part of the annual security assessment.

D-10. Employee Training

Service Provider shall provide annual security awareness training to all personnel who have access to Client Data. Such training shall cover, at a minimum, phishing awareness, password hygiene, acceptable use policies, data handling and classification, incident reporting procedures, and applicable privacy and data protection requirements. In addition, Service Provider shall provide specialized training for security operations and incident response personnel, including tabletop exercises and simulated incident response scenarios.

D-11. Data Disposal

Upon termination or expiration of the MSA, or upon Client's prior written request, Service Provider shall securely destroy or return all Client Data in its possession or control, including all copies, backups, and archives, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) or an equivalent or more stringent standard. Service Provider shall provide Client with a written certificate of destruction within thirty (30) calendar days of completing the destruction process.

D-12. Incident Notification

Service Provider's obligations with respect to Security Incident notification are set forth in Section 9.4 of the MSA, as amended by Section 3 of Amendment 3. In summary, Service Provider shall notify Client within twenty-four (24) hours of discovery of any Security Incident affecting Client Data, with simultaneous notification to Client's General Counsel, Chief Information Security Officer, and Chief Privacy Officer. The initial notification shall include, to the extent known: date and time of discovery; nature of the incident; types of Client Data affected; estimated number of affected individuals; initial containment actions; and a designated contact. Service Provider shall provide written updates every twenty-four (24) hours until containment and preliminary investigation are complete, and thereafter as reasonably requested by Client.

D-13. Insurance. Service Provider shall maintain cyber-liability insurance coverage with a minimum coverage amount of Ten Million Dollars ($10,000,000) per occurrence, as further described in Exhibit E of the MSA. Service Provider shall provide Client with certificates of insurance evidencing such coverage upon request and shall provide Client with no less than thirty (30) days' prior written notice of any material change to, cancellation of, or non-renewal of such coverage.

D-14. Subcontractors. Service Provider shall not engage any subcontractor, agent, or third party to store, process, or transmit Client Data without Client's prior written consent. Service Provider shall ensure that any approved subcontractor processing Client Data is contractually bound by data security and privacy obligations at least as protective as those set forth in this Exhibit D. Service Provider shall remain fully responsible for the acts and omissions of its subcontractors with respect to Client Data and the obligations set forth herein.

[End of Appendix 1 — Amended and Restated Exhibit D]

THIRD AMENDMENT TO MASTER SERVICES AGREEMENT
This Third Amendment to the Master Services Agreement (this "Amendment 3") is entered into as of October 27, 2023 (the "Amendment 3 Effective Date"), by and between:
Quorum Insurance Holdings Corp., a Delaware corporation, with its principal place of business at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103 ("Client" or "Quorum"),
and
Palomar Data Solutions, Inc., a Texas corporation, with its principal place of business at 7100 Greenville Avenue, Suite 450, Dallas, TX 75231 ("Service Provider" or "Palomar").
Client and Service Provider are each individually referred to herein as a "Party" and collectively as the "Parties."
RECITALS
WHEREAS, Client and Service Provider entered into that certain Master Services Agreement dated November 12, 2019 (the "Original MSA"), pursuant to which Service Provider provides claims data processing, document management, and analytics services to Client;
WHEREAS, the Original MSA was amended by that certain First Amendment to the Master Services Agreement dated March 3, 2021 ("Amendment 1"), which, among other things, added processing services related to Client's QuorumEdge digital underwriting platform and increased the annual contract value by Two Million One Hundred Thousand Dollars ($2,100,000), from Fourteen Million Two Hundred Thousand Dollars ($14,200,000) to Sixteen Million Three Hundred Thousand Dollars ($16,300,000), effective April 1, 2021;
WHEREAS, the Original MSA was further amended by that certain Second Amendment to the Master Services Agreement dated September 15, 2022 ("Amendment 2"), which updated the Data Security Exhibit (Exhibit D), added a SOC 2 Type II audit requirement, and updated the cyber insurance minimums set forth in Exhibit E (the Original MSA, as amended by Amendment 1 and Amendment 2, collectively, the "MSA");
WHEREAS, on or about March 14, 2023, a threat actor exploited a known remote code execution vulnerability (CVE-2023-0669) in Service Provider's GoAnywhere MFT file transfer appliance to gain unauthorized access to Service Provider's network, resulting in the exfiltration of Client Data over a period of approximately thirty-five (35) days through April 18, 2023 (the "Security Incident");
WHEREAS, the Security Incident resulted in the compromise of personally identifiable information, protected health information, and financial data of approximately 318,247 of Client's policyholders and claimants across twenty-nine (29) states and the District of Columbia;
WHEREAS, the Parties have entered into a separate Settlement Agreement and Mutual Release of even date herewith (the "Settlement Agreement") resolving certain claims arising from or related to the Security Incident;
WHEREAS, in connection with the Settlement Agreement, the Parties desire to amend the MSA to enhance data security requirements, audit provisions, and incident notification obligations, and to implement certain fee adjustments, all as more particularly set forth herein; and
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
1. DEFINITIONS
1.1 Capitalized terms used but not otherwise defined in this Amendment 3 shall have the meanings ascribed to such terms in the MSA.
1.2 In addition to the defined terms set forth in the MSA, the following terms shall have the meanings set forth below for purposes of this Amendment 3 and the MSA as amended hereby:
(a) "Amendment 3 Effective Date" means October 27, 2023, the date first written above.
(b) "Critical Vulnerability" means any vulnerability rated Critical or High with a Common Vulnerability Scoring System ("CVSS") score of 7.0 or above, as published by the National Institute of Standards and Technology ("NIST") National Vulnerability Database, or as designated Critical or High by the applicable software or hardware vendor in its security advisory or bulletin. For the avoidance of doubt, a vulnerability designated as Critical or High by the applicable vendor shall be treated as a Critical Vulnerability regardless of its CVSS score.
(c) "Endpoint Detection and Response" or "EDR" means a category of cybersecurity tools and solutions that continuously monitor, detect, investigate, and respond to cyber threats at the endpoint level, including but not limited to workstations, laptops, servers, and other networked devices.
(d) "Fee Reduction Period" means the eighteen (18)-month period commencing on November 1, 2023 and ending on April 30, 2025.
(e) "Independent Security Assessor" means a qualified, independent third-party cybersecurity assessment firm mutually agreed upon by the Parties, which firm shall not be an affiliate, subsidiary, or parent company of Service Provider and shall not have provided consulting, implementation, integration, or other non-assessment services to Service Provider within the twelve (12) months preceding any assessment performed hereunder. The initial Independent Security Assessor shall be selected within sixty (60) days of the Amendment 3 Effective Date, subject to Client's prior written approval, which approval shall not be unreasonably withheld, conditioned, or delayed.
(f) "Quarterly Vulnerability Scan" means automated and manual vulnerability scanning of all systems, applications, and network segments that store, process, or transmit Client Data, conducted no less frequently than once per calendar quarter in accordance with Section 2.4 of this Amendment 3.
(g) "Security Incident" shall have the meaning set forth in the Recitals of this Amendment 3, and for purposes of Section 3 and Exhibit D as amended hereby, shall also mean any event constituting a "Security Incident" as defined in the amended and restated Exhibit D attached as Appendix 1 hereto.
2. AMENDMENTS TO EXHIBIT D (DATA SECURITY REQUIREMENTS)
2.1 General. Exhibit D of the MSA, as previously amended by Amendment 2, is hereby amended and restated in its entirety, as set forth in Appendix 1 to this Amendment 3. In the event of any conflict or inconsistency between the prior version of Exhibit D (including as amended by Amendment 2) and Appendix 1 attached hereto, Appendix 1 shall control and supersede the prior version in all respects. All references in the MSA or any Statement of Work to "Exhibit D" shall, from and after the Amendment 3 Effective Date, be deemed to refer to Appendix 1 to this Amendment 3.
2.2 Enhanced Patch Management.
(a) Section D-3 of Exhibit D, as previously in effect, is hereby deleted in its entirety and replaced with the following enhanced patch management requirements. Service Provider shall apply patches, updates, or vendor-recommended remediations for all Critical Vulnerabilities within fourteen (14) calendar days of the date on which the applicable vendor, NIST, or the relevant security community makes a patch, update, or remediation publicly available. For reference, the prior requirement under Exhibit D, as amended by Amendment 2, provided for a thirty (30)-day patching window for critical vulnerabilities; the Parties acknowledge and agree that the fourteen (14)-day requirement set forth herein reflects the heightened security posture necessitated by the circumstances described in the Recitals.
(b) Service Provider shall apply patches, updates, or vendor-recommended remediations for all Medium-severity vulnerabilities, defined as those with a CVSS score of 4.0 through 6.9, within thirty (30) calendar days of the date on which the applicable patch, update, or remediation is made publicly available.
(c) Service Provider shall apply patches, updates, or vendor-recommended remediations for all Low-severity vulnerabilities, defined as those with a CVSS score below 4.0, within sixty (60) calendar days of the date on which the applicable patch, update, or remediation is made publicly available.
(d) In the event that Service Provider determines, in good faith, that a patch for a Critical Vulnerability cannot be applied within fourteen (14) calendar days due to a documented technical limitation, system dependency, or risk of material disruption to Client services, Service Provider shall:
(i) notify Client in writing within seven (7) calendar days of the date the patch or remediation became available, identifying the specific technical limitation or system dependency preventing timely application;
(ii) implement commercially reasonable compensating controls designed to mitigate the risk associated with the unpatched vulnerability within the fourteen (14)-day period referenced in Section 2.2(a);
(iii) apply the full patch or remediation no later than thirty (30) calendar days after the date the patch or remediation became available; and
(iv) document all compensating controls implemented pursuant to this Section 2.2(d) and provide such documentation to Client promptly upon request.
(e) Service Provider shall maintain a comprehensive patch management log documenting all patches applied, the dates of application, any exceptions or delays, compensating controls implemented, and the rationale for any deviation from the timelines set forth in this Section 2.2. Service Provider shall make such patch management log available to Client and the Independent Security Assessor upon reasonable request.
2.3 Mandatory Endpoint Detection and Response (EDR).
(a) Service Provider shall deploy an enterprise-grade Endpoint Detection and Response solution across all endpoints, servers, and systems that store, process, or transmit Client Data, including without limitation workstations, laptops, virtual machines, and physical and cloud-based servers within Service Provider's environment that handle Client Data.
(b) EDR deployment shall be completed no later than ninety (90) calendar days after the Amendment 3 Effective Date (i.e., no later than January 25, 2024). Service Provider acknowledges that this deadline is a material obligation and that failure to meet this deadline may result in the consequences set forth in Section 6.3 of this Amendment 3.
(c) The EDR solution deployed by Service Provider shall include, at a minimum, the following capabilities:
(i) real-time threat detection and alerting;
(ii) automated response capabilities, including the ability to isolate compromised endpoints;
(iii) behavioral analysis using machine learning or heuristic techniques to identify anomalous activity;
(iv) forensic data collection and retention capabilities sufficient to support post-incident investigation; and
(v) centralized management, logging, and alerting through a unified console or dashboard.
(d) Service Provider shall ensure that the EDR solution is actively monitored by trained security operations personnel on a twenty-four (24) hours per day, seven (7) days per week, three hundred sixty-five (365) days per year (24/7/365) basis. Such monitoring may be performed by Service Provider's internal security operations center or by a qualified managed detection and response provider engaged by Service Provider, provided that Service Provider shall remain responsible for all obligations hereunder regardless of any such delegation.
(e) Service Provider shall provide Client with written confirmation of EDR deployment within five (5) business days of completion, which confirmation shall include the identity of the EDR solution vendor, the scope of deployment, and confirmation that 24/7/365 monitoring is operational.
2.4 Quarterly Vulnerability Scanning.
(a) Service Provider shall conduct Quarterly Vulnerability Scans of all systems, network segments, applications, databases, and infrastructure components that store, process, or transmit Client Data. Quarterly Vulnerability Scans shall be conducted no less frequently than once per calendar quarter.
(b) Each Quarterly Vulnerability Scan shall include both internal and external scanning, encompassing all network-accessible systems and services within the scope of the MSA. Scans shall be conducted using industry-standard scanning tools and methodologies consistent with generally accepted information security practices.
(c) Within fifteen (15) business days of the completion of each Quarterly Vulnerability Scan, Service Provider shall deliver to Client a written report (each, a "Quarterly Vulnerability Report") summarizing:
(i) the scope of the scan, including systems, network segments, and applications scanned;
(ii) all identified vulnerabilities, categorized by severity level (Critical, High, Medium, Low, and Informational);
(iii) the remediation status and anticipated timeline for remediation of each identified vulnerability; and
(iv) any compensating controls currently in place to mitigate the risk associated with unpatched or unresolved vulnerabilities.
(d) Quarterly Vulnerability Reports shall be delivered to Client's Chief Information Security Officer (currently David Naranjo) and Vice President, Vendor Risk Management (currently Priya Deshmukh), at the email addresses or mailing addresses designated by Client in writing from time to time. Client may update the designated recipients and contact information upon written notice to Service Provider.
(e) The first Quarterly Vulnerability Scan under this Amendment 3 shall be completed no later than January 31, 2024.
2.5 Annual Independent Security Assessment.
(a) Service Provider shall, at its sole cost and expense, engage the Independent Security Assessor to conduct a comprehensive annual security assessment of Service Provider's systems, controls, policies, procedures, and practices as they relate to the storage, processing, and transmission of Client Data. The scope of the annual security assessment shall encompass all environments, facilities, and personnel involved in the delivery of services to Client under the MSA.
(b) The annual security assessment shall include, at a minimum, the following components:
(i) penetration testing, including both internal and external penetration tests of systems and applications that store, process, or transmit Client Data;
(ii) review and evaluation of access controls, including role-based access controls, multi-factor authentication implementation, and privileged account management;
(iii) evaluation of network segmentation to assess the degree of isolation between Client Data systems and Service Provider's general corporate network and systems processing data of other clients;
(iv) assessment of patch management practices, including compliance with the timelines and processes set forth in Section 2.2 of this Amendment 3;
(v) review of incident response capabilities, including tabletop exercises and evaluation of Service Provider's incident response plan; and
(vi) evaluation of the EDR deployment, including coverage, monitoring effectiveness, and alert response procedures.
(c) The Independent Security Assessor shall deliver a written report of findings and recommendations (the "Annual Security Assessment Report") to both Client and Service Provider no later than thirty (30) calendar days after the completion of the assessment fieldwork. The Annual Security Assessment Report shall include a description of the assessment methodology, detailed findings categorized by severity, specific recommendations for remediation, and an executive summary.
(d) Within thirty (30) calendar days of Service Provider's receipt of the Annual Security Assessment Report, Service Provider shall develop and provide to Client a written remediation plan addressing all findings rated High or Critical in the Annual Security Assessment Report. The remediation plan shall include specific remediation actions, responsible personnel, and target completion dates. Service Provider shall complete remediation of all High and Critical findings within ninety (90) calendar days of the date of the remediation plan.
(e) The first annual security assessment under this Amendment 3 shall be completed no later than April 30, 2024.
(f) The Independent Security Assessor shall be independent of Service Provider and shall not have provided consulting, implementation, integration, managed services, or other non-assessment services to Service Provider within the twelve (12) months preceding the commencement of any assessment. Service Provider shall provide Client with a written attestation of the Independent Security Assessor's independence prior to the commencement of each annual assessment.
(g) For the avoidance of doubt, Service Provider shall continue to maintain and provide to Client an annual SOC 2 Type II report as required by Amendment 2 and the MSA. The annual independent security assessment required by this Section 2.5 is in addition to, and not a replacement for, the SOC 2 Type II audit requirement. Service Provider's current SOC 2 Type II auditor is Kessler, Park & Associates CPA, PLLC. Service Provider shall provide Client with each annual SOC 2 Type II report within thirty (30) days of its issuance.
2.6 Continued Data Security Obligations. All other provisions of Exhibit D not specifically amended by this Section 2 or by Appendix 1 hereto, including without limitation requirements for administrative, technical, and physical safeguards, encryption standards (including AES-256 encryption at rest and TLS 1.2 or higher in transit), access controls, employee security awareness training, network segmentation, data disposal in accordance with NIST SP 800-88, and subcontractor security requirements, shall remain in full force and effect as set forth in Appendix 1 to this Amendment 3.
3. AMENDMENT TO SECTION 9.4 (SECURITY INCIDENT NOTIFICATION)
3.1 Section 9.4 of the MSA is hereby deleted in its entirety and replaced with the following:
(a) Notification Timeline. Service Provider shall notify Client of any Security Incident (as defined in Exhibit D as amended and restated by Appendix 1 hereto) affecting or reasonably believed to affect Client Data within twenty-four (24) hours of Service Provider's discovery of, or the point at which Service Provider reasonably should have discovered or developed a reasonable belief that, such Security Incident has occurred. For reference, this twenty-four (24)-hour notification requirement replaces the prior forty-eight (48)-hour notification requirement set forth in the original Section 9.4 of the MSA.
(b) Notification Recipients. Notification shall be provided simultaneously to the following Client personnel, via both email to designated email addresses and by telephone to designated telephone numbers, as updated by Client from time to time in writing:
(i) Client's General Counsel (currently Thomas R. Whitfield), at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103;
(ii) Client's Chief Information Security Officer (currently David Naranjo); and
(iii) Client's Chief Privacy Officer (currently Jennifer Liang).
(c) Initial Notification Content. The initial notification shall include, to the extent known at the time of notification:
(i) the date and time of discovery of the Security Incident;
(ii) a description of the nature and scope of the Security Incident, including the attack vector and systems affected;
(iii) the types of Client Data believed to be affected or potentially compromised;
(iv) the estimated number of affected individuals, if applicable;
(v) a summary of Service Provider's initial containment and mitigation actions taken or underway; and
(vi) a designated point of contact at Service Provider for ongoing communications regarding the Security Incident, including direct telephone number and email address.
(d) Ongoing Updates. Service Provider shall provide written updates to Client every twenty-four (24) hours following the initial notification until the Security Incident is contained and a preliminary investigation has been completed. Thereafter, Service Provider shall provide updates at such intervals as Client may reasonably request, but no less frequently than weekly, until the investigation is concluded and all remediation activities are complete.
(e) Cooperation. Service Provider shall cooperate fully and in good faith with Client, Client's outside counsel, and any forensic investigators or other consultants retained by or at the direction of Client or Client's counsel in connection with the investigation, remediation, response, and any regulatory notifications arising from or related to any Security Incident. Such cooperation shall include, without limitation, providing timely access to relevant systems, logs, personnel, documentation, and facilities, and preserving all relevant evidence in accordance with applicable law and any litigation hold instructions from Client or Client's counsel.
4. FEE ADJUSTMENT
4.1 Fee Reduction. Effective November 1, 2023, and continuing through April 30, 2025 (the "Fee Reduction Period"), the annual contract value payable by Client to Service Provider under the MSA shall be reduced by eight percent (8%) from the annual contract value then in effect.
4.2 Calculation. The current annual contract value under the MSA is Sixteen Million Three Hundred Thousand Dollars ($16,300,000), as established by Amendment 1 effective April 1, 2021. During the Fee Reduction Period, the annual contract value shall be reduced to Fourteen Million Nine Hundred Ninety-Six Thousand Dollars ($14,996,000), calculated as $16,300,000 multiplied by 0.92.
4.3 Total Fee Reduction. The aggregate fee reduction over the eighteen (18)-month Fee Reduction Period shall be One Million Nine Hundred Fifty-Six Thousand Dollars ($1,956,000), calculated as $16,300,000 multiplied by eight percent (8%) multiplied by 1.5 years.
4.4 Reversion. Effective May 1, 2025, the annual contract value shall automatically revert to Sixteen Million Three Hundred Thousand Dollars ($16,300,000), unless otherwise modified by a separate written agreement executed by both Parties. For the avoidance of doubt, the reversion of the annual contract value to $16,300,000 shall not require any further amendment to the MSA and shall occur automatically upon the expiration of the Fee Reduction Period.
4.5 Settlement Agreement Integration. The fee adjustment set forth in this Section 4 is made in connection with, and as partial consideration for, the settlement of claims described in the Settlement Agreement and Mutual Release of even date herewith. The Parties acknowledge and agree that this fee adjustment shall be in addition to, and not in lieu of, the cash payment of Four Million Two Hundred Thousand Dollars ($4,200,000) from Service Provider to Client as set forth in Section 3.1 of the Settlement Agreement. The aggregate value of the settlement consideration, including both the cash payment and the fee reduction, is Six Million One Hundred Fifty-Six Thousand Dollars ($6,156,000).
4.6 Pro-Ration. Monthly invoices issued by Service Provider during the Fee Reduction Period shall reflect the reduced annual contract value on a pro rata monthly basis. Accordingly, the monthly invoice amount during the Fee Reduction Period shall be One Million Two Hundred Forty-Nine Thousand Six Hundred Sixty-Seven Dollars ($1,249,667), calculated as $14,996,000 divided by twelve (12), rounded to the nearest dollar.
5. REPRESENTATIONS AND WARRANTIES OF SERVICE PROVIDER
5.1 Service Provider represents and warrants to Client that, as of the Amendment 3 Effective Date:
(a) Authority. Service Provider has the corporate power and authority to enter into this Amendment 3 and to perform its obligations hereunder. The execution, delivery, and performance of this Amendment 3 by Service Provider have been duly authorized by all necessary corporate action on the part of Service Provider.
(b) No Conflict. The execution, delivery, and performance of this Amendment 3 by Service Provider does not and will not (i) violate the certificate of incorporation, bylaws, or other organizational documents of Service Provider, (ii) conflict with, result in a breach of, or constitute a default under any agreement, contract, or instrument to which Service Provider is a party or by which Service Provider or its assets are bound, or (iii) violate any applicable law, regulation, order, or judgment.
(c) Insurance. Service Provider currently maintains cyber-liability insurance coverage with a minimum coverage amount of Ten Million Dollars ($10,000,000) per occurrence, as required by Exhibit E of the MSA (as amended by Amendment 2). Service Provider shall provide Client with a certificate of insurance evidencing such coverage within ten (10) business days of the Amendment 3 Effective Date and thereafter upon renewal or upon Client's reasonable request.
(d) Remediation Status. Service Provider is actively engaged in the process of remediating all known vulnerabilities identified during and subsequent to the Security Incident and has committed and allocated resources necessary to complete the implementation of the EDR solution and enhanced patch management processes within the timelines specified in Sections 2 and 6 of this Amendment 3. Service Provider acknowledges that the timely completion of such remediation activities is a material inducement to Client entering into this Amendment 3 and the Settlement Agreement.
6. REMEDIATION MILESTONES AND REPORTING
6.1 Remediation Milestones. Service Provider shall comply with the following remediation milestones:
(a) EDR Deployment. Service Provider shall complete the deployment of an enterprise-grade Endpoint Detection and Response solution across all systems that store, process, or transmit Client Data no later than January 25, 2024 (ninety (90) calendar days from the Amendment 3 Effective Date). Service Provider shall provide Client with written confirmation of completion of EDR deployment within five (5) business days of deployment completion, in the form specified in Section 2.3(e) of this Amendment 3.
(b) Enhanced Patch Management Implementation. Service Provider shall have fully operational enhanced patch management processes consistent with the requirements of Section 2.2 of this Amendment 3 no later than January 25, 2024 (ninety (90) calendar days from the Amendment 3 Effective Date). Full operationalization shall include the establishment of documented procedures, assignment of responsible personnel, deployment of necessary tools, and activation of the patch management log.
(c) First Quarterly Vulnerability Scan. The first Quarterly Vulnerability Scan under this Amendment 3 shall be completed, and the corresponding Quarterly Vulnerability Report delivered to Client, no later than January 31, 2024.
(d) Independent Security Assessor Selection. The Independent Security Assessor shall be mutually agreed upon by the Parties within sixty (60) days of the Amendment 3 Effective Date (i.e., by December 26, 2023), subject to Client's prior written approval as set forth in Section 1.2(e) of this Amendment 3.
(e) First Annual Independent Security Assessment. The first annual independent security assessment shall be completed, and the Annual Security Assessment Report delivered to both Parties, no later than April 30, 2024.
6.2 Monthly Progress Reports. Commencing within thirty (30) days of the Amendment 3 Effective Date and continuing monthly thereafter until all remediation milestones set forth in Section 6.1 have been completed, Service Provider shall provide Client with written progress reports on the status of each remediation milestone. Each monthly progress report shall include: (i) the current status of each milestone; (ii) any risks, issues, or impediments to timely completion; (iii) anticipated completion dates; and (iv) actions being taken to address any identified risks or delays. Monthly progress reports shall be delivered to the Client personnel identified in Section 2.4(d) of this Amendment 3.
6.3 Consequences of Failure. Failure by Service Provider to meet any remediation milestone within the timeframe specified in Section 6.1 shall constitute a material breach of this Amendment 3 and the MSA, and Client shall have the rights and remedies set forth in Section 14.2 of the MSA (Termination for Cause), provided that the cure period applicable to any such breach shall be fifteen (15) calendar days (reduced from the thirty (30)-calendar-day cure period set forth in the original Section 14.2 of the MSA, solely for purposes of breaches of Section 6.1 of this Amendment 3). The reduced cure period reflects the critical nature of the remediation milestones and the heightened security posture required following the Security Incident. For the avoidance of doubt, all other provisions of Section 14.2 of the MSA, including applicable notice requirements, shall continue to apply.
7. AUDIT RIGHTS
7.1 Enhanced Audit Rights. In addition to any audit rights set forth in the MSA (including without limitation Section 12.3 thereof), Client and its designated representatives, including without limitation external counsel, forensic investigators, independent auditors, and the Independent Security Assessor, shall have the right, upon no fewer than ten (10) business days' prior written notice, to audit, inspect, and assess Service Provider's security controls, systems, facilities, policies, procedures, and personnel as they relate to the storage, processing, and transmission of Client Data. Such audits may be conducted no more than twice per calendar year; provided, however, that this limitation shall not apply to (i) the annual independent security assessment conducted pursuant to Section 2.5 of this Amendment 3, or (ii) any audit triggered by a Security Incident as described in Section 7.2 below.
7.2 Audit Rights Following Security Incident. In the event of a Security Incident affecting or reasonably believed to affect Client Data, Client shall have the right to conduct an immediate audit upon reasonable notice (which may be less than ten (10) business days) and without limitation on frequency. Such audit rights shall continue for the duration of the investigation and remediation of the applicable Security Incident.
7.3 Cooperation. Service Provider shall cooperate fully and in good faith with any audit conducted pursuant to this Section 7 and shall provide reasonable access to facilities, personnel, systems, system logs, security records, policies, procedures, and other documentation as reasonably requested by Client or its designated representatives. Service Provider shall designate a knowledgeable point of contact to facilitate each audit and shall respond to audit inquiries and information requests in a timely manner. Service Provider shall not charge Client any fees or costs in connection with Client's exercise of its audit rights under this Section 7.
8. RELATIONSHIP TO SETTLEMENT AGREEMENT
8.1 This Amendment 3 is entered into concurrently with the Settlement Agreement and Mutual Release dated October 27, 2023, between Client and Service Provider (the "Settlement Agreement"). The Settlement Agreement provides for, among other things, a cash payment of Four Million Two Hundred Thousand Dollars ($4,200,000) from Service Provider to Client and the fee reduction set forth in Section 4 of this Amendment 3, as partial consideration for the resolution of certain claims arising from or related to the Security Incident.
8.2 This Amendment 3 is independent of, and shall survive, any termination, rescission, or expiration of the Settlement Agreement. The data security enhancements, audit provisions, incident notification obligations, remediation milestones, and all other obligations and requirements set forth in this Amendment 3 shall remain binding on Service Provider for the remaining term of the MSA and any renewals, extensions, or successor agreements thereto, regardless of the status of the Settlement Agreement.
8.3 Nothing in this Amendment 3 shall be construed as, or deemed to constitute, an admission of liability, fault, wrongdoing, or negligence by either Party with respect to the Security Incident or any claims arising therefrom. Each Party's respective rights, obligations, releases, and waivers with respect to the Security Incident are governed exclusively by the terms and conditions of the Settlement Agreement and Mutual Release, and this Amendment 3 shall not be used as evidence of, or in support of, any claim of liability by either Party.
9. TERM
9.1 The term of the MSA, as previously established, commenced on November 12, 2019 and is scheduled to expire on November 11, 2024 (the initial five (5)-year term from the Original MSA effective date), unless earlier terminated in accordance with the MSA or extended by written agreement of the Parties.
9.2 The amendments set forth in this Amendment 3 shall be effective as of the Amendment 3 Effective Date and shall remain in full force and effect for the remaining term of the MSA and any renewals, extensions, or successor agreements entered into by the Parties.
9.3 For the avoidance of doubt, the Fee Reduction Period commences on November 1, 2023 and extends through April 30, 2025, and shall survive the expiration of the initial term of the MSA if the MSA is renewed or extended beyond November 11, 2024. In the event that the MSA is not renewed or extended beyond November 11, 2024, the fee reduction shall apply through the date of termination or expiration of the MSA, and no fee reduction shall be owed for any period after the MSA has terminated or expired.
10. NO OTHER AMENDMENTS; CONFLICTS
10.1 Except as expressly modified, amended, or supplemented by this Amendment 3, the MSA (including all prior amendments, exhibits, appendices, schedules, and Statements of Work) shall remain in full force and effect and is hereby ratified and confirmed in all respects.
10.2 In the event of any conflict or inconsistency between the terms and conditions of this Amendment 3 and the terms and conditions of the MSA (including Amendment 1, Amendment 2, and all exhibits and schedules thereto), the terms and conditions of this Amendment 3 shall prevail and control to the extent of such conflict or inconsistency.
10.3 This Amendment 3, together with the MSA (including Amendment 1 and Amendment 2), the Settlement Agreement and Mutual Release of even date herewith, and all exhibits, appendices, schedules, and Statements of Work attached to or incorporated by reference in any of the foregoing, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior and contemporaneous negotiations, representations, understandings, and agreements, whether written or oral, relating to such subject matter.
11. GOVERNING LAW; DISPUTE RESOLUTION
11.1 This Amendment 3 shall be governed by and construed in accordance with the laws of the State of Connecticut, without regard to its conflict of laws principles, consistent with the governing law provision set forth in Section 18.1 of the MSA.
11.2 Any dispute, controversy, or claim arising under or in connection with this Amendment 3, or the breach, termination, or validity thereof, shall be resolved in accordance with the dispute resolution provisions set forth in Section 18 of the MSA.
12. COUNTERPARTS; ELECTRONIC SIGNATURES
12.1 This Amendment 3 may be executed in any number of counterparts, each of which shall be deemed an original and all of which, when taken together, shall constitute one and the same instrument. Delivery of an executed counterpart of this Amendment 3 by facsimile, electronic mail (including PDF), or other electronic transmission shall be equally effective as delivery of a manually executed counterpart.
12.2 The Parties agree that electronic or digital signatures affixed to this Amendment 3 shall have the same legal force and effect as original ink signatures to the fullest extent permitted by applicable law, including the Electronic Signatures in Global and National Commerce Act (E-SIGN Act), 15 U.S.C. §§ 7001 et seq., and any applicable state law governing electronic signatures.
13. NOTICES
13.1 All notices, requests, demands, consents, and other communications required or permitted to be given under this Amendment 3 shall be in writing and shall be delivered in accordance with the notice provisions set forth in Section 17 of the MSA, with copies as follows:
If to Client:
Thomas R. Whitfield, General Counsel Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
With a copy (which shall not constitute notice) to:
Kevin Ostrowski Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
If to Service Provider:
Derek Copeland, General Counsel Palomar Data Solutions, Inc. 7100 Greenville Avenue, Suite 450 Dallas, TX 75231
With a copy (which shall not constitute notice) to:
Catherine Langford Mercer, Haight & Dunlop LLP 2100 Ross Avenue, Suite 3600 Dallas, TX 75201
Either Party may change its notice address or designated recipients by providing written notice to the other Party in accordance with the MSA.
[Remainder of Page Intentionally Left Blank — Signature Page Follows]
IN WITNESS WHEREOF, the Parties have executed this Third Amendment to the Master Services Agreement as of the date first written above.
QUORUM INSURANCE HOLDINGS CORP.
By: ________
Name: Thomas R. Whitfield
Title: General Counsel
Date: October 27, 2023
PALOMAR DATA SOLUTIONS, INC.
By: ________
Name: Derek Copeland
Title: General Counsel
Date: October 27, 2023
APPENDIX 1
AMENDED AND RESTATED EXHIBIT D — DATA SECURITY REQUIREMENTS
This Appendix 1 constitutes the Amended and Restated Exhibit D to the Master Services Agreement, effective as of October 27, 2023 (the Amendment 3 Effective Date). This Appendix 1 supersedes and replaces in its entirety the prior version of Exhibit D, including as amended by Amendment 2.
D-1. General Security Obligations
Service Provider shall implement and maintain commercially reasonable administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Client Data against unauthorized access, acquisition, use, disclosure, modification, destruction, or loss, consistent with (i) industry standards, including ISO/IEC 27001, the NIST Cybersecurity Framework, and the CIS Critical Security Controls; (ii) all applicable federal, state, and local laws, statutes, regulations, and rules, including without limitation the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act (HIPAA), and applicable state data breach notification laws; and (iii) the specific requirements set forth in this Exhibit D. Service Provider shall regularly review and update its information security program to address evolving threats and vulnerabilities and changes in applicable law.
D-2. Access Controls
Service Provider shall implement and maintain the following access control measures with respect to all systems that store, process, or transmit Client Data:
(a) Role-Based Access Controls. Access to Client Data shall be restricted to Service Provider personnel who require such access in order to perform their assigned duties in connection with the services provided under the MSA. Access rights shall be assigned based on the principle of least privilege and shall be commensurate with each individual's job function and responsibilities.
(b) Multi-Factor Authentication. Multi-factor authentication ("MFA") shall be required for (i) all remote access to Service Provider's systems and networks that store, process, or transmit Client Data; (ii) all access to privileged accounts, including administrative accounts, root accounts, and accounts with elevated permissions; and (iii) all access to the EDR management console, vulnerability scanning tools, and patch management systems.
(c) Regular Access Reviews. Service Provider shall conduct reviews of access rights and permissions no less frequently than quarterly to verify that access remains appropriate and consistent with the principle of least privilege. Access rights shall be promptly revoked for personnel who no longer require access due to termination, transfer, or change in job responsibilities.
(d) Unique User Identification. Each individual with access to Client Data shall be assigned a unique user identifier. Shared accounts or generic credentials shall not be used to access Client Data.
D-3. Patch Management (Amended)
Service Provider shall maintain a documented patch management program that ensures the timely identification, evaluation, testing, and application of security patches, updates, and vendor-recommended remediations across all systems, applications, and infrastructure components that store, process, or transmit Client Data. The following timelines shall apply:
(a) Critical Vulnerabilities (CVSS score of 7.0 or above, or as designated Critical or High by the applicable vendor): patches or remediations shall be applied within fourteen (14) calendar days of public availability.
(b) Medium Vulnerabilities (CVSS score of 4.0 through 6.9): patches or remediations shall be applied within thirty (30) calendar days of public availability.
(c) Low Vulnerabilities (CVSS score below 4.0): patches or remediations shall be applied within sixty (60) calendar days of public availability.
(d) Exception Process. In the event that a patch for a Critical Vulnerability cannot be applied within fourteen (14) calendar days due to a documented technical limitation or system dependency, Service Provider shall: (i) notify Client in writing within seven (7) calendar days of patch availability, identifying the specific limitation; (ii) implement compensating controls within the fourteen (14)-day period; (iii) apply the full remediation no later than thirty (30) calendar days after patch availability; and (iv) document all compensating controls and make such documentation available to Client upon request.
(e) Patch Management Log. Service Provider shall maintain a comprehensive patch management log and shall make it available to Client and the Independent Security Assessor upon request.
D-4. Endpoint Detection and Response
Service Provider shall deploy and maintain an enterprise-grade Endpoint Detection and Response (EDR) solution across all endpoints, servers, and systems that store, process, or transmit Client Data. The EDR solution shall include, at a minimum: real-time threat detection and alerting, automated response capabilities (including endpoint isolation), behavioral analysis, forensic data collection and retention, and centralized management and alerting. The EDR solution shall be monitored by trained security operations personnel on a 24/7/365 basis. Initial deployment shall be completed no later than ninety (90) calendar days from the Amendment 3 Effective Date (January 25, 2024). Service Provider shall provide Client with written confirmation of EDR deployment, including the identity of the EDR solution vendor, within five (5) business days of completion.
D-5. Vulnerability Scanning
Service Provider shall conduct Quarterly Vulnerability Scans (both internal and external) of all systems, network segments, applications, and infrastructure components that store, process, or transmit Client Data, using industry-standard scanning tools and methodologies. Within fifteen (15) business days of the completion of each Quarterly Vulnerability Scan, Service Provider shall deliver to Client a written Quarterly Vulnerability Report summarizing: (i) the scope of the scan; (ii) all identified vulnerabilities, categorized by severity; (iii) the remediation status and anticipated timeline for each identified vulnerability; and (iv) any compensating controls in place. Quarterly Vulnerability Reports shall be delivered to Client's Chief Information Security Officer and Vice President, Vendor Risk Management, at the addresses designated by Client in writing. The first Quarterly Vulnerability Scan shall be completed no later than January 31, 2024.
D-6. Annual Security Assessment
Service Provider shall, at its sole cost and expense, engage the Independent Security Assessor (as defined in Amendment 3) to conduct a comprehensive annual security assessment of Service Provider's systems, controls, and practices as they relate to the storage, processing, and transmission of Client Data. The annual assessment shall include, at a minimum: internal and external penetration testing; review of access controls; evaluation of network segmentation; assessment of patch management practices; review of incident response capabilities; and evaluation of the EDR deployment. The Independent Security Assessor shall deliver a written Annual Security Assessment Report to both Client and Service Provider within thirty (30) calendar days of the completion of fieldwork. Service Provider shall develop and deliver to Client a written remediation plan for all High and Critical findings within thirty (30) calendar days of receipt of the report, and shall complete remediation of all High and Critical findings within ninety (90) calendar days of the remediation plan. The first annual assessment shall be completed no later than April 30, 2024.
D-7. SOC 2 Type II Audit
Service Provider shall continue to maintain and provide to Client an annual SOC 2 Type II report, covering the trust services criteria of security, availability, processing integrity, confidentiality, and privacy, as applicable to the services provided under the MSA. The SOC 2 Type II report shall be issued by a qualified, independent certified public accounting firm. Service Provider's current SOC 2 Type II auditor is Kessler, Park & Associates CPA, PLLC. Service Provider shall provide Client with each SOC 2 Type II report within thirty (30) calendar days of its issuance. The annual independent security assessment required by Section D-6 is in addition to, and not a replacement for, the SOC 2 Type II audit requirement.
D-8. Encryption.  Service Provider shall encrypt all Client Data as follows:
(a) At Rest. All Client Data stored on Service Provider's systems, databases, storage media, and backup media shall be encrypted using the Advanced Encryption Standard (AES) with a minimum key length of 256 bits (AES-256) or equivalent or stronger encryption standard.
(b) In Transit. All Client Data transmitted over public or untrusted networks, including the internet, shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher, or equivalent or stronger encryption protocol.
(c) Key Management. Service Provider shall implement and maintain encryption key management procedures consistent with industry best practices, including secure key generation, storage, rotation, distribution, and destruction.
D-9. Network Segmentation
Service Provider shall ensure that all systems, network segments, databases, and infrastructure components that store, process, or transmit Client Data are logically and, where practicable, physically segmented from Service Provider's general corporate network and from systems, network segments, and databases that store, process, or transmit data belonging to other Service Provider clients. Network segmentation controls shall be designed to prevent unauthorized lateral movement between network segments and shall be subject to regular review and testing as part of the annual security assessment.
D-10. Employee Training
Service Provider shall provide annual security awareness training to all personnel who have access to Client Data. Such training shall cover, at a minimum, phishing awareness, password hygiene, acceptable use policies, data handling and classification, incident reporting procedures, and applicable privacy and data protection requirements. In addition, Service Provider shall provide specialized training for security operations and incident response personnel, including tabletop exercises and simulated incident response scenarios.
D-11. Data Disposal
Upon termination or expiration of the MSA, or upon Client's prior written request, Service Provider shall securely destroy or return all Client Data in its possession or control, including all copies, backups, and archives, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) or an equivalent or more stringent standard. Service Provider shall provide Client with a written certificate of destruction within thirty (30) calendar days of completing the destruction process.
D-12. Incident Notification
Service Provider's obligations with respect to Security Incident notification are set forth in Section 9.4 of the MSA, as amended by Section 3 of Amendment 3. In summary, Service Provider shall notify Client within twenty-four (24) hours of discovery of any Security Incident affecting Client Data, with simultaneous notification to Client's General Counsel, Chief Information Security Officer, and Chief Privacy Officer. The initial notification shall include, to the extent known: date and time of discovery; nature of the incident; types of Client Data affected; estimated number of affected individuals; initial containment actions; and a designated contact. Service Provider shall provide written updates every twenty-four (24) hours until containment and preliminary investigation are complete, and thereafter as reasonably requested by Client.
D-13. Insurance.  Service Provider shall maintain cyber-liability insurance coverage with a minimum coverage amount of Ten Million Dollars ($10,000,000) per occurrence, as further described in Exhibit E of the MSA. Service Provider shall provide Client with certificates of insurance evidencing such coverage upon request and shall provide Client with no less than thirty (30) days' prior written notice of any material change to, cancellation of, or non-renewal of such coverage.
D-14. Subcontractors.  Service Provider shall not engage any subcontractor, agent, or third party to store, process, or transmit Client Data without Client's prior written consent. Service Provider shall ensure that any approved subcontractor processing Client Data is contractually bound by data security and privacy obligations at least as protective as those set forth in this Exhibit D. Service Provider shall remain fully responsible for the acts and omissions of its subcontractors with respect to Client Data and the obligations set forth herein.
[End of Appendix 1 — Amended and Restated Exhibit D]

THIRD AMENDMENT TO MASTER SERVICES AGREEMENT

RECITALS

QUORUM INSURANCE HOLDINGS CORP.

PALOMAR DATA SOLUTIONS, INC.

APPENDIX 1

Record

Parties

Dates

Amounts