PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION
MEMORANDUM
February 3, 2023
FROM: David Cartwright, Partner, Data Privacy & Cybersecurity, Calderwood & Harkness LLP Lisa Johannsen, Associate, Data Privacy & Cybersecurity, Calderwood & Harkness LLP
TO: Carolyn Whitford, General Counsel & Executive Vice President, Quorum Insurance Holdings Corp. Gregory Stahl, Vice President, Legal Affairs, Quorum Insurance Holdings Corp.
CC: Leonard Cross, Responsible Partner, Calderwood & Harkness LLP Wendy Schultz, Lead Associate, Calderwood & Harkness LLP Patricia Heng, Senior Counsel, Technology Transactions, Calderwood & Harkness LLP
RE: Compliance Requirements Under New York Department of Financial Services Cybersecurity Regulation (23 NYCRR 500) Applicable to Quorum's Proposed Enterprise Data-Licensing Arrangement with Meridian Credit intelligence, Inc.
MATTER NO.: C&H Matter No. 1025-00008
This memorandum is a privileged and confidential attorney-client communication prepared by Calderwood & Harkness LLP for the exclusive use of Quorum Insurance Holdings Corp. and its authorized officers and employees. This memorandum contains legal advice and analysis that is protected by the attorney-client privilege and the work product doctrine. Any disclosure, distribution, or copying of this memorandum or its contents to any person other than the intended recipients without the prior written consent of Calderwood & Harkness LLP and Quorum Insurance Holdings Corp. is strictly prohibited. Receipt by any unintended recipient does not constitute a waiver of any applicable privilege.
Right-click to update Table of Contents
I. Executive Summary
This memorandum analyzes the compliance obligations arising under the New York Department of Financial Services ("DFS") Cybersecurity Regulation, 23 NYCRR Part 500 (the "Regulation"), as they apply to Quorum Insurance Holdings Corp. ("Quorum" or the "Company") in connection with the proposed five-year, $60,000,000 Master Data License Agreement ("MDLA") with Meridian Credit intelligence, Inc. ("Meridian"). This analysis is intended to guide the structuring and negotiation of both the MDLA and the companion Data Security Addendum ("DSA"), and to identify the contractual provisions necessary to ensure Quorum's compliance with the Regulation.
Quorum is a Nasdaq-listed, Delaware-incorporated multi-line insurance carrier and insurtech platform operator, headquartered at 1200 Atlantic Street, Suite 3400, Stamford, Connecticut 06901. Through its licensed insurance subsidiaries, Quorum operates licensed insurance lines in the State of New York and is therefore a "Covered Entity" within the meaning of Section 500.01(e) of the Regulation. No exemptions under Section 500.19 are available to Quorum given the Company's substantial size — total assets of $27.6 billion, FY 2023 revenue of $4.18 billion, and net income of $312 million — well in excess of any applicable thresholds.
Meridian is a privately held Georgia corporation, a consumer and commercial credit bureau headquartered at 3300 Peachtree Road NE, Suite 2100, Atlanta, Georgia 30326. Under the proposed MDLA, Quorum will receive and process massive volumes of consumer and commercial credit data from Meridian across three data products:
• MCI Consumer Credit File™ — Approximately 310 million consumer records, including full-file consumer tradeline data, delivered via daily SFTP batch and real-time REST API;
• MCI CommercialView™ — Approximately 42 million business records of commercial credit data, delivered via weekly SFTP batch; and
• MCI AltSignal™ — Approximately 85 million consumer alternative-data records (utility, telecom, and rental payment data), delivered via daily SFTP batch.
In total, Quorum anticipates receiving approximately 437 million records per month across these three products, representing approximately 87.4% of the contractual base tier of 500 million records per month.
Our core conclusion is as follows: Meridian will function as a "Third-Party Service Provider" as defined in Section 500.01(n) of the Regulation, triggering specific and detailed contractual and oversight obligations for Quorum under Section 500.11 and related provisions. The MDLA and the companion DSA must incorporate provisions addressing, at a minimum, third-party service provider security policies, encryption requirements (both in transit and at rest), access controls and identity management, penetration testing and vulnerability assessments, audit trail maintenance and retention, incident response coordination, regulatory notification obligations, data retention and disposal protocols, and ongoing audit rights. This memorandum identifies each applicable requirement of the Regulation, analyzes its application to the proposed transaction, and recommends specific contractual provisions for inclusion in the MDLA and DSA.
This memorandum should be read in conjunction with the following companion memoranda, which address related regulatory requirements:
• Memorandum on Incident Response and Breach Notification Obligations (David Cartwright, February 2023), which addresses the full landscape of state and federal breach notification requirements applicable to the transaction;
• Memorandum on FCRA/GLBA Regulatory Framework (David Cartwright and Lisa Johannsen, forthcoming), which analyzes the Fair Credit Reporting Act and Gramm-Leach-Bliley Act requirements applicable to Quorum's receipt and use of Meridian data; and
• Memorandum on CCPA/CPRA Implications (Lisa Johannsen, forthcoming), which analyzes the California Consumer Privacy Act and California Privacy Rights Act requirements applicable to the licensed data products and Derived Data.
Together, these memoranda are intended to provide Quorum with a comprehensive regulatory roadmap for the structuring and negotiation of the MDLA and DSA.
II. Background on the Transaction and Data Flows
A. Transaction Overview
Quorum proposes to enter into a five-year MDLA with Meridian pursuant to which Quorum will license three data products from Meridian for use across its property and casualty ("P&C"), life, and specialty insurance lines. The licensed data will serve three primary business purposes: (i) enhancing Quorum's automated underwriting models, including the proprietary QuorumScore™ predictive underwriting system; (ii) powering claims-fraud detection algorithms deployed across Quorum's claims processing operations; and (iii) enabling customer propensity scoring to support marketing, retention, and cross-sell strategies.
The total deal value of the MDLA is $60,000,000 over the five-year term, structured as follows:
• Year 1: $10,800,000 ($900,000 per month), reflecting a six-month implementation and ramp period during which Quorum will not have full data access and will be conducting integration, testing, and compliance readiness activities;
• Years 2 through 5: $12,300,000 per year ($1,025,000 per month), representing the full annual run-rate for the three licensed data products at anticipated volumes.
In addition to the license fees set forth above, the MDLA contemplates a separate one-time implementation and integration fee of $1,500,000, which is outside the $60,000,000 license value and covers Meridian's technical services associated with configuring SFTP connections, REST API provisioning, data-mapping activities, and initial quality assurance testing.
The MDLA establishes a base tier of up to 500 million records per month (consumer and commercial combined). Current estimated monthly volume is approximately 437 million records per month, representing approximately 87.4% of the base tier. Any records delivered in excess of the 500 million base tier will be subject to an overage rate of $0.003 per record.
B. Data Products at Issue
The three data products licensed under the proposed MDLA are as follows:
MCI Consumer Credit File™. This product comprises full-file consumer tradeline data, including credit account information, payment histories, outstanding balances, credit inquiries, public record data (bankruptcies, liens, judgments), and associated personally identifiable information (names, Social Security numbers, dates of birth, addresses, and similar identifiers). The MCI Consumer Credit File™ covers approximately 310 million consumer records and is delivered via two channels: (i) daily batch files transmitted via SFTP, and (ii) real-time query access via Meridian's REST API for on-demand credit data retrieval in connection with underwriting and claims-processing workflows.
MCI CommercialView™. This product comprises commercial credit data on approximately 42 million U.S. businesses, including business credit scores, payment histories, trade references, business demographic information, corporate linkage data, and associated information regarding business owners, guarantors, and authorized officers. MCI CommercialView™ is delivered via weekly batch files transmitted via SFTP.
MCI AltSignal™. This product comprises alternative data derived from utility payment records, telecommunications payment records, and rental payment data. MCI AltSignal™ covers approximately 85 million consumer records and is delivered via daily batch files transmitted via SFTP. This product is intended to supplement the MCI Consumer Credit File™ data by providing credit-relevant signals for consumers who may have limited traditional credit histories ("thin-file" or "no-file" consumers).
C. Derived Data and QuorumScore™
A critical aspect of the proposed transaction involves Quorum's intended creation of blended risk scores, propensity models, and enriched datasets — collectively referred to as "Derived Data" — built on top of the licensed Meridian data combined with Quorum's own first-party claims data, policy data, telematics data, and other proprietary datasets.
Central to this effort is QuorumScore™, Quorum's proprietary predictive underwriting model, for which a patent application is currently pending before the U.S. Patent and Trademark Office (Serial No. 97/482,116). QuorumScore™ is a key element of Quorum's competitive differentiation in the insurtech market and is central to a planned B2B licensing revenue line projected to generate $40–50 million in annual revenue by 2027. Quorum envisions licensing QuorumScore™ outputs and related Derived Data products to third-party insurance carriers, managing general agents, and reinsurers.
The treatment of Derived Data under the MDLA — including intellectual property ownership, rights of commercialization, license-back provisions, and revenue-sharing mechanisms — remains a major unresolved negotiation issue between the parties. This issue is being addressed in separate memoranda prepared by Wendy Schultz and Omar Siddiqui. However, the cybersecurity regulatory implications of creating, storing, processing, and potentially distributing Derived Data must also be considered under 23 NYCRR 500, as discussed in detail in Sections IV.B, IV.J, and IV.M below. To the extent that Derived Data contains or is traceable to consumer personally identifiable information or other "Nonpublic Information" as defined by the Regulation, it will be subject to the full panoply of 23 NYCRR 500 requirements regardless of the intellectual property ownership structure ultimately agreed upon by the parties.
D. Parties' Counsel and Key Contacts
For ease of reference, we set forth below the principal counsel and key contacts for each party:
Quorum Insurance Holdings Corp.:
• Outside Counsel: Calderwood & Harkness LLP (this firm), C&H Matter No. 1025-00008; engagement opened August 8, 2022.
• General Counsel & EVP: Carolyn Whitford
• VP, Legal Affairs: Gregory Stahl
• Chief Data Officer: Rajesh Anand
• Director, Data Engineering: Priya Nair (technical integration lead)
• VP, Regulatory & Compliance: Claudia Reeves (insurance regulatory review)
Meridian Credit intelligence, Inc.:
• Outside Counsel: Kessler Pruitt & Ashe LLP; lead partner Graham Whitley; associates Nina Chastain and Derek Fontaine.
• General Counsel: Arthur Pennington
• VP, Legal Affairs: Ben Overstreet
• Chief Privacy Officer: Lena Vasquez
III. Applicability of 23 NYCRR 500 to Quorum
A. Quorum as a "Covered Entity"
The threshold question in any analysis under 23 NYCRR 500 is whether the entity at issue qualifies as a "Covered Entity" subject to the Regulation's requirements. Section 500.01(e) of the Regulation defines "Covered Entity" as "any Person operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law." The definition is intentionally broad and encompasses the full range of entities subject to DFS supervision.
Quorum Insurance Holdings Corp., through its licensed insurance subsidiaries, operates licensed insurance lines in the State of New York. As a multi-line insurance carrier and insurtech platform operator with total assets of approximately $27.6 billion, FY 2023 revenue of $4.18 billion, and net income of $312 million, Quorum unambiguously qualifies as a Covered Entity under the Regulation. This conclusion is beyond reasonable dispute, and no party to the transaction has suggested otherwise.
Furthermore, no exemptions under Section 500.19 of the Regulation are available to Quorum. Section 500.19 provides limited exemptions for entities with (i) fewer than 10 employees and independent contractors, (ii) less than $5,000,000 in gross annual revenue in each of the last three fiscal years, or (iii) less than $10,000,000 in year-end total assets. Quorum exceeds each of these thresholds by orders of magnitude. Accordingly, Quorum is subject to the full requirements of the Regulation without limitation or exemption.
B. Scope of "Nonpublic Information" Covered
Having established that Quorum is a Covered Entity, the next analytical step is to determine whether the data at issue in the proposed transaction constitutes "Nonpublic Information" within the meaning of the Regulation. Section 500.01(g) of the Regulation defines "Nonpublic Information" as all electronic information that is not "Publicly Available Information" and that falls into one or more of the following categories:
(i) Business-related information of a Covered Entity the tampering with which, or unauthorized disclosure, access, or use of which, would cause a material adverse impact to the business, operations, or security of the Covered Entity;
(ii) Any information concerning an individual which because of name, number, personal mark, or other identifier can be used to identify such individual, in combination with any one or more of the following data elements: (a) Social Security number, (b) drivers' license number or non-driver identification card number, (c) account number, credit or debit card number, (d) any security code, access code, or password that would permit access to an individual's financial account, or (e) biometric records; or
(iii) Any information or data, except age or gender, in any form or medium created by or derived from a health care provider or an individual and that relates to (a) the past, present, or future physical, mental, or behavioral health or condition of any individual or a member of the individual's family, (b) the provision of health care to any individual, or (c) payment for the provision of health care to any individual.
Application to Meridian Data Products. Each of the three Meridian data products at issue contains information that falls squarely within the definition of Nonpublic Information:
MCI Consumer Credit File™. This product comprises approximately 310 million consumer records containing full-file consumer tradeline data, including Social Security numbers, account numbers, payment histories, outstanding balances, credit inquiries, and associated personally identifiable information. Consumer records containing Social Security numbers in combination with individually identifiable information clearly constitute Nonpublic Information under Section 500.01(g)(2). There is no ambiguity on this point.
MCI AltSignal™. This product comprises approximately 85 million consumer records containing utility payment data, telecommunications payment data, and rental payment data, together with individually identifiable information sufficient to match records to specific consumers. To the extent these records contain Social Security numbers, account numbers, or other enumerated data elements in combination with personally identifiable information, they constitute Nonpublic Information. Even where individual records may not contain Social Security numbers, the records may nonetheless constitute Nonpublic Information under Section 500.01(g)(1) to the extent that unauthorized disclosure or access would cause a material adverse impact to Quorum's business.
MCI CommercialView™. This product comprises approximately 42 million business records. While commercial credit data does not, by itself, necessarily constitute individually identifiable information, MCI CommercialView™ records include information regarding business owners, personal guarantors, and authorized officers — including, in many cases, personally identifiable information such as names, Social Security numbers, and dates of birth. To the extent that MCI CommercialView™ records contain such individually identifiable information, they constitute Nonpublic Information under Section 500.01(g)(2).
QuorumScore™ and Derived Data. QuorumScore™ outputs and other Derived Data that incorporate, are derived from, or are traceable to consumer personally identifiable information originating from the Meridian data products will also constitute Nonpublic Information requiring protection under the Regulation. The fact that such data has been processed, aggregated, modeled, or transformed by Quorum's proprietary algorithms does not, standing alone, remove it from the scope of the Regulation. As discussed further in Section IV.M and in connection with the CCPA/CPRA de-identification analysis in Lisa Johannsen's companion memorandum, only data that has been fully and irreversibly de-identified — such that it can no longer be used, either alone or in combination with other reasonably available information, to identify a specific individual — would fall outside the definition of Nonpublic Information.
In summary, the overwhelming majority of the data flowing under the proposed MDLA — and a significant portion of the Derived Data to be created by Quorum — will constitute Nonpublic Information subject to the full requirements of 23 NYCRR 500.
IV. Key 23 NYCRR 500 Requirements Applicable to the Meridian Data License
This Section identifies and analyzes each provision of 23 NYCRR 500 that is material to the proposed transaction, explains its application to the Meridian data license, and sets forth our specific recommendations for contractual provisions to be included in the MDLA and DSA.
A. Cybersecurity Program (Section 500.02)
Section 500.02 of the Regulation requires each Covered Entity to "maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the Covered Entity's Information Systems." The cybersecurity program must be based on the Covered Entity's risk assessment and must be designed to perform the following core functions:
(a) identify and assess internal and external cybersecurity risks that may threaten the security or integrity of Nonpublic Information stored on the Covered Entity's Information Systems;
(b) use defensive infrastructure and the implementation of policies and procedures to protect the Covered Entity's Information Systems, and the Nonpublic Information stored on those Information Systems, from unauthorized access, use, or other malicious acts;
(c) detect Cybersecurity Events;
(d) respond to identified Cybersecurity Events to mitigate any negative effects;
(e) recover from Cybersecurity Events and restore normal operations and services; and
(f) fulfill applicable regulatory reporting obligations.
Application. Once Quorum begins ingesting Meridian data — up to 437 million records per month of consumer and commercial credit information — that data will be stored on and processed by Quorum's Information Systems. Quorum's cybersecurity program must be designed to protect the confidentiality, integrity, and availability of this data from the point of ingestion through the entire data lifecycle, including processing, storage, use in underwriting and claims operations, incorporation into Derived Data products, and ultimate retention or disposal.
The cybersecurity program must address both the internal risks (e.g., unauthorized employee access, insider threats, misconfiguration of data environments) and external risks (e.g., cyberattacks targeting Quorum's systems, man-in-the-middle attacks during data transmission, supply-chain attacks affecting Meridian's delivery infrastructure) associated with the Meridian data environment.
Recommendation. The MDLA and DSA should include representations from Quorum that it maintains a cybersecurity program consistent with 23 NYCRR 500, and should require evidence of compliance, including Quorum's most recent SOC 2 Type II report (issued by Felton Thorpe & Co. LLP, period ending December 31, 2023). The DSA should also require that Quorum's cybersecurity program specifically encompasses the Meridian data environment and all Information Systems that receive, process, store, or transmit Meridian data or Derived Data containing Nonpublic Information. Reciprocal representations should be obtained from Meridian regarding the adequacy of its own cybersecurity program as it relates to the licensed data products.
B. Cybersecurity Policy (Section 500.03)
Section 500.03 requires each Covered Entity to "implement and maintain a written policy or policies, approved by a Senior Officer or the Covered Entity's board of directors (or an appropriate committee thereof) or equivalent governing body," setting forth the Covered Entity's policies and procedures for the protection of its Information Systems and Nonpublic Information. The cybersecurity policy must address, at a minimum, fourteen specified areas:
(a) information security; (b) data governance and classification; (c) asset inventory and device management; (d) access controls and identity management; (e) business continuity and disaster recovery planning and resources; (f) systems operations and availability concerns; (g) systems and network security; (h) systems and network monitoring; (i) systems and application development and quality assurance; (j) physical security and environmental controls; (k) customer data privacy; (l) vendor and Third-Party Service Provider management; (m) risk assessment; and (n) incident response.
Application. Several of these policy areas are directly implicated by the proposed Meridian data license. In particular, data governance and classification policies must address the classification of Meridian data products and Derived Data; access controls and identity management policies must govern who within Quorum may access the licensed data; vendor and Third-Party Service Provider management policies must address Meridian's status as a Third-Party Service Provider; and incident response policies must address cybersecurity events affecting the Meridian data environment.
Recommendation. The MDLA should require Quorum to certify annually that its cybersecurity policy covers the receipt, processing, storage, and (if applicable) onward transmission of Meridian data, and to make the relevant portions of its cybersecurity policy available to Meridian upon request for audit purposes. We note that Quorum should not be required to disclose its entire cybersecurity policy — only those portions relevant to the protection of data in which Meridian has a legitimate interest. Similarly, Meridian should be required to maintain cybersecurity policies addressing the enumerated areas to the extent relevant to its role in delivering and maintaining the licensed data products.
C. Chief Information Security Officer (Section 500.04)
Section 500.04 requires each Covered Entity to "designate a qualified individual responsible for overseeing and implementing the Covered Entity's cybersecurity program and enforcing its cybersecurity policy." This individual serves as the Covered Entity's Chief Information Security Officer ("CISO"). The CISO must report in writing at least annually to the Covered Entity's board of directors or equivalent governing body on the cybersecurity program, covering material cybersecurity risks, the overall effectiveness of the cybersecurity program, and material cybersecurity events.
Application. Quorum must have a designated CISO whose responsibilities encompass oversight of the Meridian data environment. We understand from initial discussions with Quorum's internal team that a CISO is currently in place; however, we have not yet received confirmation that the CISO's responsibilities have been scoped to encompass the incoming Meridian data environment. We recommend confirming this point with Rajesh Anand (Chief Data Officer) and Priya Nair (Director, Data Engineering) during the next coordination call.
Recommendation. The DSA should identify Quorum's CISO by title (rather than by name, to avoid the need for amendment upon personnel changes) as the responsible party for cybersecurity oversight of the licensed data environment. The DSA should also require Quorum to notify Meridian if there is a material change in CISO designation — for example, if the position becomes vacant for more than 60 days or if the CISO's responsibilities are materially restructured in a manner that could affect oversight of the Meridian data environment.
D. Penetration Testing and Vulnerability Assessments (Section 500.05)
Section 500.05 requires each Covered Entity's cybersecurity program to include "monitoring and testing, developed in accordance with the Covered Entity's Risk Assessment, designed to assess the effectiveness of the Covered Entity's cybersecurity program." At a minimum, the Regulation requires:
(a) annual penetration testing of the Covered Entity's Information Systems; and
(b) bi-annual vulnerability assessments, including any systematic scans or reviews of Information Systems reasonably designed to identify publicly known cybersecurity vulnerabilities in the Covered Entity's Information Systems based on the Risk Assessment.
Application. The Information Systems that store, process, or transmit Meridian data — including ingestion pipelines, data warehouses, analytical platforms, and the systems hosting the REST API integration for real-time MCI Consumer Credit File™ queries — must be within the scope of Quorum's annual penetration testing and bi-annual vulnerability assessment programs. Similarly, Meridian's systems that store and transmit the licensed data products, including its SFTP delivery infrastructure and REST API endpoints, should be subject to equivalent testing.
Recommendation. The DSA should include a mutual obligation for both Quorum and Meridian to conduct annual penetration testing and bi-annual vulnerability assessments of the Information Systems involved in data delivery, receipt, processing, and storage. Executive summaries of penetration testing results and vulnerability assessment findings should be made available to the other party upon reasonable request, subject to appropriate confidentiality protections and reasonable redaction of information that could itself create security vulnerabilities if disclosed. The parties should agree on a minimum standard for penetration testing methodology (e.g., adherence to NIST SP 800-115 or OWASP Testing Guide) to ensure comparability and rigor.
E. Audit Trail (Section 500.06)
Section 500.06 requires each Covered Entity to implement audit trail systems that serve two distinct purposes:
(a) Track and maintain data that allows for the complete and accurate reconstruction of all financial transactions and accounting sufficient to detect and respond to a Cybersecurity Event; these records must be maintained for not less than five years; and
(b) Include audit trails designed to detect and respond to Cybersecurity Events that have a reasonable likelihood of materially harming any material part of the normal operations of the Covered Entity; these records must be maintained for not less than three years.
Application. Quorum must maintain audit trail systems that track access to the Meridian data products — including all privileged user access to Nonpublic Information contained in the MCI Consumer Credit File™, MCI CommercialView™, and MCI AltSignal™ data feeds — and that are sufficient to reconstruct data access patterns and detect anomalous activity indicative of a cybersecurity event. Given the volume of data at issue (approximately 437 million records per month), the audit trail systems must be capable of handling significant log volumes and providing searchable, time-stamped records of access events.
Recommendation. The MDLA and DSA should require both parties to maintain audit trails consistent with Section 500.06. The retention periods should be stated explicitly, and we recommend that Quorum adopt the more stringent five-year retention period for all audit trail data related to Meridian data access (rather than applying the three-year period to access logs that are not directly related to financial transaction reconstruction). This approach aligns the retention period with the five-year term of the MDLA and ensures that comprehensive audit trail data will be available for the full duration of the license. The DSA should also specifically address audit trail requirements for Derived Data, to the extent such Derived Data contains or is traceable to Nonpublic Information — access to Derived Data environments should be logged and retained on the same basis as access to raw Meridian data.
F. Access Privileges and Identity Management (Section 500.07)
Section 500.07 requires each Covered Entity, as part of its cybersecurity program, to "limit user access privileges to Information Systems that provide access to Nonpublic Information" and to "periodically review such access privileges." Access privileges must be limited to those individuals who require such access for legitimate business purposes, consistent with the principle of least privilege.
Application. The Meridian data products contain highly sensitive consumer and commercial credit information. Access to this data within Quorum's organization must be strictly controlled and limited to personnel with a legitimate business need. Given the multiple business uses contemplated (underwriting, claims-fraud detection, customer propensity scoring, and Derived Data creation), access will necessarily extend across multiple functional groups within Quorum — but each group's access should be limited to the specific data products and data elements required for its particular function.
Quorum must also implement policies and procedures for the periodic review (at least annually) of access privileges, including processes for the timely termination of access upon departure of personnel, changes in role, or completion of specific projects.
Recommendation. The DSA should require Quorum to implement role-based access controls ("RBAC") for all Meridian data, limiting access to authorized personnel within specified functional categories. At a minimum, the following functional categories should be defined:
• Underwriting analytics personnel (access to MCI Consumer Credit File™ and MCI AltSignal™ for underwriting model development and deployment);
• Data engineering and data science personnel (access to all three data products for data integration, pipeline management, and model training);
• Claims operations and fraud detection personnel (access to MCI Consumer Credit File™ and MCI CommercialView™ for claims investigation and fraud scoring);
• Compliance and regulatory affairs personnel (access to metadata and audit logs, but not to raw consumer data, for regulatory monitoring and reporting); and
• Information security personnel (access to system logs and security monitoring data associated with the Meridian data environment).
The DSA should require annual certification by Quorum that a review of access privileges has been completed and that access remains limited to authorized personnel. Similar access control obligations should apply to Meridian regarding its systems that store and transmit data destined for Quorum.
G. Application Security (Section 500.08)
Section 500.08 requires each Covered Entity's cybersecurity program to include "written procedures, guidelines and standards designed to ensure the use of secure development practices for in-house developed applications utilized by the Covered Entity," as well as procedures for "evaluating, assessing or testing the security of externally developed applications utilized by the Covered Entity within the context of the Covered Entity's technology environment."
Application. This provision is relevant to the proposed transaction in two distinct respects. First, Quorum will develop and deploy internal applications that ingest, process, and analyze the Meridian data products — including the underwriting models, claims-fraud detection algorithms, and the QuorumScore™ predictive underwriting system. These applications must be developed in accordance with secure development practices.
Second, Quorum will utilize externally developed applications in connection with the Meridian data license — most notably, Meridian's REST API for real-time access to MCI Consumer Credit File™ data. The security of this externally developed application must be evaluated and tested within the context of Quorum's technology environment.
Recommendation. The DSA should impose two sets of requirements. For Meridian, the DSA should require that the REST API for MCI Consumer Credit File™ conforms to recognized secure development standards, including at a minimum the mitigation of vulnerabilities identified in the OWASP Top 10 (currently the 2021 edition), and that Meridian conducts regular security testing of the API. For Quorum, the DSA should require that Quorum applies secure development practices — including code review, static application security testing ("SAST"), dynamic application security testing ("DAST"), and security-focused quality assurance procedures — to all internal applications that ingest and process Meridian data, including QuorumScore™ and related analytical platforms.
H. Risk Assessment (Section 500.09)
Section 500.09 requires each Covered Entity to "conduct a periodic risk assessment of the Covered Entity's Information Systems sufficient to inform the design of the cybersecurity program as required by this Part." The risk assessment must be "carried out in accordance with written policies and procedures" and must allow for "revision of controls to respond to technological developments and evolving threats." The risk assessment must be "updated as reasonably necessary to address changes to the Covered Entity's Information Systems, Nonpublic Information or business operations."
Application. The onboarding of approximately 437 million records per month of sensitive consumer and commercial credit data from Meridian represents a material change to Quorum's Information Systems, its inventory of Nonpublic Information, and its business operations. This change is of sufficient magnitude and significance to trigger the requirement for an updated risk assessment under Section 500.09. A comprehensive risk assessment specific to the Meridian data environment should be conducted before Quorum begins full-scale data ingestion.
The risk assessment should address, at a minimum: the types of Nonpublic Information to be received from Meridian; the Information Systems that will receive, process, and store the data; the data flows between Quorum and Meridian systems (including SFTP and REST API channels); the internal data flows within Quorum's environment (including data pipelines, data warehouses, analytical platforms, and QuorumScore™ systems); the access controls and encryption measures applicable to the data; the threats and vulnerabilities specific to the Meridian data environment; and the adequacy of existing controls to mitigate identified risks.
Recommendation. The MDLA should include a condition precedent (or, at minimum, an initial implementation obligation with a defined completion deadline) requiring Quorum to complete a risk assessment specific to the Meridian data environment before full data delivery commences. This requirement aligns naturally with the Year 1 implementation and ramp period, during which Quorum will have limited data access and will be paying the reduced annual fee of $10,800,000 (versus the $12,300,000 annualized rate in Years 2–5). The discounted Year 1 fee structure was designed in part to accommodate this ramp-up period, and the phased compliance approach is consistent with the Regulation's requirement that the risk assessment inform the design and implementation of the cybersecurity program. Full data delivery should not commence until the risk assessment has been completed and any identified remediation measures have been implemented.
I. Third-Party Service Provider Security Policy (Section 500.11) — Critical Provision
Section 500.11 is the most directly applicable provision of the Regulation to the proposed transaction. It addresses the cybersecurity risks arising from a Covered Entity's relationships with Third-Party Service Providers and imposes specific obligations regarding the management of those risks.
1. Classification of Meridian as a Third-Party Service Provider
Section 500.01(n) of the Regulation defines "Third-Party Service Provider" as:
"a Person that (i) is not an Affiliate of the Covered Entity, (ii) provides services to the Covered Entity, and (iii) maintains, processes or otherwise is permitted access to Nonpublic Information through its provision of services to the Covered Entity."
Analysis. Each element of this definition is satisfied with respect to Meridian:
(i) Not an Affiliate. Meridian Credit intelligence, Inc. is a privately held Georgia corporation with no ownership, control, or common management relationship with Quorum Insurance Holdings Corp. Meridian is not an "Affiliate" of Quorum within the meaning of the Regulation or any other applicable definition.
(ii) Provides services to the Covered Entity. Under the proposed MDLA, Meridian will provide data licensing services to Quorum, including the delivery of three data products via SFTP batch and REST API, ongoing data quality assurance, technical support, and implementation services. These activities constitute the provision of "services" to Quorum.
(iii) Maintains, processes, or is permitted access to Nonpublic Information. Meridian will "maintain" Nonpublic Information (i.e., the consumer and commercial credit data that constitutes the licensed data products is stored on Meridian's systems prior to delivery) and will "provide access to" such Nonpublic Information through its delivery mechanisms (SFTP batch transfers and REST API real-time queries). The Nonpublic Information is accessed by Quorum "through [Meridian's] provision of services to [Quorum]."
Accordingly, Meridian qualifies as a "Third-Party Service Provider" under 23 NYCRR 500, and Quorum's obligations under Section 500.11 are triggered.
2. Required Elements of the Third-Party Service Provider Policy
Section 500.11 requires each Covered Entity to implement "written policies and procedures designed to ensure the security of Information Systems and Nonpublic Information that are accessible to, or held by, Third-Party Service Providers." These policies and procedures must be based on the Covered Entity's risk assessment and must address, at a minimum, the following elements:
(a) Identification and risk assessment of Third-Party Service Providers — Quorum must identify Meridian as a Third-Party Service Provider and conduct a risk assessment that evaluates the risks Meridian presents based on the volume and sensitivity of the Nonpublic Information it maintains or accesses, the adequacy of its cybersecurity practices, and the nature of the services it provides.
(b) Minimum cybersecurity practices required to be met by Third-Party Service Providers — Quorum must establish baseline cybersecurity standards that Meridian must satisfy as a condition of the business relationship.
(c) Due diligence processes used to evaluate the adequacy of cybersecurity practices of Third-Party Service Providers — Quorum must conduct due diligence on Meridian's cybersecurity posture, including review of relevant certifications (Meridian's SOC 2 Type II report issued by Galloway Nash LLP, period ending March 31, 2023, and Meridian's ISO 27001 certification), policies, and practices.
(d) Periodic assessment of Third-Party Service Providers based on the risk they present and the continued adequacy of their cybersecurity practices — Quorum must conduct ongoing monitoring and at least annual reassessment of Meridian's cybersecurity practices.
(e) Contractual protections — The Regulation specifically requires that the Third-Party Service Provider security policy address the adequacy of contractual provisions to ensure the Third-Party Service Provider implements and maintains the required cybersecurity safeguards.
3. Specific Contractual Requirements
DFS has indicated, through published guidance and enforcement actions, that the contractual provisions required under Section 500.11 should address, at a minimum, the following elements:
(a) Use of multi-factor authentication ("MFA") or reasonably equivalent or more secure access controls for any individual accessing the Covered Entity's Information Systems or Nonpublic Information;
(b) Use of encryption for Nonpublic Information both in transit over external networks and at rest;
(c) Prompt notification to the Covered Entity of any Cybersecurity Event directly impacting the Covered Entity's Information Systems or the Nonpublic Information being processed by the Third-Party Service Provider; and
(d) Representations and warranties from the Third-Party Service Provider regarding its cybersecurity practices and the adequacy of those practices to protect the Covered Entity's Nonpublic Information.
4. Recommended Contractual Provisions for the MDLA and DSA
Based on the foregoing analysis, we recommend that the MDLA and DSA include the following provisions to satisfy Quorum's obligations under Section 500.11:
Certification and Audit Requirements:
• Require Meridian to maintain and annually renew its SOC 2 Type II certification and ISO 27001 certification throughout the entire five-year term of the MDLA, with no gap in coverage of more than 90 days between successive reporting periods.
• Require Meridian to provide copies of its SOC 2 Type II reports and ISO 27001 certificates to Quorum within 30 days of issuance, and at any time upon Quorum's reasonable request.
• Require Meridian to notify Quorum within 15 business days of any material adverse findings, qualified opinions, or exceptions noted in its SOC 2 Type II reports or ISO 27001 audit findings, together with a remediation plan and timeline.
Access Controls and Authentication:
• Require Meridian to implement multi-factor authentication for all administrative and privileged access to systems that store, process, or transmit data destined for delivery to Quorum.
• Specify that MFA must conform to NIST SP 800-63B standards at Authentication Assurance Level 2 ("AAL2") or higher.
Encryption:
• Require encryption of all data in transit using TLS 1.2 or higher for both SFTP batch transfers and REST API transmissions.
• Require encryption of all data at rest using AES-256 or equivalent industry-standard cryptographic algorithms.
• Prohibit the transmission or storage of Nonpublic Information in unencrypted form, subject only to limited and documented exceptions approved in writing by both parties' CISOs.
Incident Notification:
• Require Meridian to notify Quorum of any Cybersecurity Event affecting Nonpublic Information maintained, processed, or transmitted by Meridian in connection with the MDLA within 48 hours of discovery, consistent with the 48-hour notification requirement already proposed in the current draft DSA and with the analysis in the companion incident response memorandum (David Cartwright, February 2023).
• Require that the initial notification include, at a minimum: the nature and scope of the event; the categories and approximate number of records affected; the date and time of discovery; the initial assessment of the cause; and the remediation steps taken or planned.
Audit Rights:
• Grant Quorum the right to audit Meridian's cybersecurity practices at least annually, and at any time upon reasonable suspicion of a security incident, upon not less than 30 days' prior written notice (or upon 48 hours' notice in the case of a suspected active security incident).
• Specify the scope of audit rights to cover systems, processes, personnel training records, sub-processor arrangements, and documentation of cybersecurity controls relevant to the licensed data products.
• Permit Quorum to engage a qualified independent third-party auditor to conduct the audit at Quorum's expense, with the auditor bound by appropriate confidentiality obligations.
Representations and Warranties:
• Include representations and warranties from Meridian that its cybersecurity practices are adequate to protect the confidentiality, integrity, and availability of the licensed data products, and that such practices conform to industry standards and applicable law.
• Include a representation that Meridian has not, during the 36-month period prior to the effective date of the MDLA, experienced any cybersecurity event affecting consumer or commercial credit data that resulted in a regulatory enforcement action, consent order, or settlement exceeding $500,000.
Material Changes and Adverse Findings:
• Require Meridian to notify Quorum within 30 days of any material changes to its cybersecurity program, including changes in CISO, material changes to encryption protocols, changes in data center locations, or adoption of materially different security architectures.
• Require notification of any adverse findings in SOC 2 Type II or ISO 27001 audits, as noted above.
Sub-Processor Management:
• Require Meridian to provide Quorum with a current list of all sub-processors that will have access to Nonpublic Information destined for or derived from Quorum's data feeds.
• Require Meridian to notify Quorum at least 30 days before engaging any new sub-processor that will have such access, with sufficient detail for Quorum to conduct its own risk assessment.
• Require that all sub-processors be bound by cybersecurity obligations at least as stringent as those imposed on Meridian under the DSA.
• Grant Quorum the right to object to the engagement of a proposed sub-processor on reasonable cybersecurity grounds, with a dispute resolution mechanism if the parties cannot agree.
J. Encryption of Nonpublic Information (Section 500.15)
Section 500.15 of the Regulation establishes specific encryption requirements for Nonpublic Information. These requirements apply both to data in transit and data at rest, and represent one of the more prescriptive provisions of the Regulation.
1. Encryption in Transit
Section 500.15(a) requires each Covered Entity to implement controls, including encryption, to protect Nonpublic Information "held or transmitted by the Covered Entity both in transit over external networks and at rest." For Nonpublic Information in transit, each Covered Entity must "utilize effective encryption based on the Covered Entity's Risk Assessment."
Application to Meridian Data Feeds. All Nonpublic Information transmitted between Meridian and Quorum must be encrypted in transit using effective, industry-standard cryptographic protocols. For the proposed data delivery mechanisms:
• SFTP Batch Transfers (used for daily MCI Consumer Credit File™ and MCI AltSignal™ batch files, and weekly MCI CommercialView™ batch files): SFTP (SSH File Transfer Protocol) inherently uses SSH encryption to protect data in transit. The parties should agree on minimum SSH protocol versions and cipher suites, requiring SSH version 2 with AES-256-CBC or AES-256-CTR cipher suites.
• REST API (used for real-time MCI Consumer Credit File™ queries): All REST API communications must be transmitted over HTTPS using TLS 1.2 or higher. TLS 1.0 and 1.1 must be disabled, and the parties should agree on minimum cipher suite requirements consistent with current NIST guidance (e.g., prohibiting cipher suites using RC4, DES, or 3DES).
2. Encryption at Rest
Section 500.15(a) also requires encryption of Nonpublic Information at rest. All Nonpublic Information held or maintained by Quorum — including ingested Meridian data stored in data warehouses, analytical platforms, backup systems, and disaster recovery environments, as well as Derived Data that contains or is traceable to Nonpublic Information — must be encrypted at rest using industry-standard cryptographic algorithms.
Recommended Standard. We recommend specifying AES-256 (Advanced Encryption Standard with 256-bit key length) as the minimum encryption standard for data at rest. AES-256 is widely recognized as the industry standard for strong encryption and is consistent with NIST and DFS guidance.
3. Compensating Controls
Section 500.15(b) provides that to the extent a Covered Entity determines that encryption of Nonpublic Information in transit or at rest is infeasible, the Covered Entity may instead "secure such Nonpublic Information using effective alternative compensating controls reviewed and approved by the Covered Entity's CISO." Any such compensating controls must be "reviewed by the CISO at least annually."
Recommendation. We recommend against relying on compensating controls for any aspect of the Meridian data environment. Given the volume and sensitivity of the data at issue (437 million records per month of consumer and commercial credit data, including Social Security numbers), the use of compensating controls in lieu of encryption would be difficult to justify and would likely invite regulatory scrutiny. The DSA should require encryption of all Nonpublic Information in transit and at rest without exception.
4. Recommended DSA Provisions
The DSA should impose mutual encryption obligations on both parties:
• Meridian: Encryption of all Nonpublic Information in its systems prior to delivery and during transmission to Quorum, using the standards specified above.
• Quorum: Encryption of all Nonpublic Information upon receipt and while stored in Quorum's systems, including primary storage, backup storage, disaster recovery environments, and any downstream analytical or production environments.
Specific encryption standards (TLS 1.2+ for data in transit; AES-256 for data at rest) should be stated in a Technical Schedule to the DSA (which we recommend designating as "Technical Schedule A — Data Delivery and Security Specifications") alongside the data delivery specifications, connection parameters, and related technical requirements. These encryption requirements must extend to Derived Data that contains or is traceable to Nonpublic Information, regardless of the intellectual property ownership structure ultimately agreed upon in the MDLA.
K. Incident Response Plan (Section 500.16)
Section 500.16 requires each Covered Entity to "establish a written incident response plan designed to promptly respond to, and recover from, any Cybersecurity Event materially affecting the confidentiality, integrity or availability of the Covered Entity's Information Systems or the continuing functionality of any aspect of the Covered Entity's business or operations."