1025-00009 · Calderwood & Harkness LLP · Transaction Documents

exhibit-d-security-requirements.docx DOCUMENT M&A / Corporate

10 / 12 ← → ✕

EXHIBIT D — SECURITY REQUIREMENTS

to the Enterprise SaaS Subscription Agreement

Effective Date: April 26, 2024

This Exhibit D (this "Exhibit") is attached to and forms part of the Enterprise SaaS Subscription Agreement dated April 26, 2024 (the "Agreement") by and between Quorum Insurance Holdings Corp., a Delaware corporation ("Licensee" or "Quorum"), and Clearpoint Analytics, Inc., a Delaware corporation ("Licensor" or "Clearpoint").

This Exhibit D sets forth the security requirements applicable to Clearpoint's provision of the ClaimsIQ™ platform and related services under the Agreement. Capitalized terms used but not defined herein shall have the meanings set forth in the Agreement. Clearpoint shall comply with all requirements set forth in this Exhibit D throughout the Term of the Agreement. In the event of any conflict between the terms of this Exhibit D and the body of the Agreement, the terms that are more protective of Customer Data shall control.

1. GENERAL SECURITY OBLIGATIONS

1.1 Security Program. Clearpoint shall establish, implement, and maintain a comprehensive written information security program (the "Security Program") designed to protect Customer Data (as defined in the Agreement and in Exhibit C — Data Processing Addendum) against unauthorized access, use, disclosure, alteration, or destruction. The Security Program shall be commensurate with the nature, scope, and sensitivity of the Customer Data processed by Clearpoint, taking into account the particular risks associated with insurance claims data, including personally identifiable information ("PII") and, where applicable, protected health information ("PHI"). The Security Program shall include administrative, technical, and physical safeguards and shall be reviewed and updated by Clearpoint no less frequently than annually to address evolving threats, vulnerabilities, and regulatory requirements.

1.2 Applicable Standards. The Security Program shall be designed and operated in accordance with industry-recognized standards, including but not limited to:

(a) the American Institute of Certified Public Accountants ("AICPA") Trust Services Criteria (SOC 2);

(b) the National Association of Insurance Commissioners ("NAIC") Insurance Data Security Model Law (MDL-668) as adopted in the State of Connecticut;

(d) to the extent applicable to Quorum's workers' compensation lines of business, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") Security Rule, 45 C.F.R. Part 160 and Subparts A and C of Part 164, as amended.

Where the requirements of the foregoing standards differ, Clearpoint shall comply with the most protective standard applicable to the relevant category of Customer Data. Clearpoint acknowledges that Quorum operates in a highly regulated industry and that the protection of Customer Data is of paramount importance to Quorum's business operations, regulatory standing, and policyholder trust.

1.3 Responsibility. Clearpoint shall designate a qualified individual (at a minimum, a senior officer or director-level employee) as the person responsible for overseeing and implementing the Security Program (the "Security Program Lead"). As of the Effective Date, the designated Security Program Lead is Clearpoint's Chief Information Security Officer. The Security Program Lead shall have sufficient authority, resources, and organizational support to carry out the objectives of the Security Program effectively. Clearpoint shall notify Quorum in writing within thirty (30) days of any change in the designated Security Program Lead, including the identity and qualifications of the successor.

1.4 Subprocessor Security. Clearpoint shall ensure that each subprocessor engaged in connection with the ClaimsIQ™ platform, including without limitation Cobalt Cloud Infrastructure, Inc. (hosting and infrastructure-as-a-service) and Redline Document AI, LLC (optical character recognition processing), maintains security measures that are no less protective than those set forth in this Exhibit D. Prior to engaging any subprocessor that will have access to or will process Customer Data, Clearpoint shall conduct an appropriate due diligence assessment of such subprocessor's security practices. Clearpoint remains fully responsible for the acts and omissions of its subprocessors with respect to the security of Customer Data, and any failure by a subprocessor to meet the requirements of this Exhibit D shall be deemed a failure by Clearpoint for all purposes under the Agreement.

2. ENCRYPTION STANDARDS

2.1 Encryption at Rest. All Customer Data stored by Clearpoint or its subprocessors, whether on primary storage systems, backup media, or any other storage medium, shall be encrypted at rest using the Advanced Encryption Standard with a minimum key length of 256 bits ("AES-256") or an equivalent or stronger encryption algorithm approved by the National Institute of Standards and Technology ("NIST"). This requirement applies to all Customer Data, including but not limited to database records, file-system objects, archived data, and data stored in temporary or staging environments.

2.2 Encryption in Transit. All Customer Data transmitted between Quorum's systems and the ClaimsIQ™ platform, between the ClaimsIQ™ platform and any subprocessor systems, and between components of the ClaimsIQ™ platform infrastructure, shall be encrypted in transit using Transport Layer Security version 1.2 or higher ("TLS 1.2+"). Earlier versions of TLS (including TLS 1.0 and TLS 1.1) and all versions of the Secure Sockets Layer ("SSL") protocol shall not be used for any transmission of Customer Data. Clearpoint shall implement HTTP Strict Transport Security ("HSTS") headers and shall ensure that all API endpoints utilized in connection with the ClaimsIQ™ platform enforce encrypted connections.

2.3 Key Management. Clearpoint shall implement and maintain encryption key management procedures that are consistent with NIST Special Publication 800-57 (Recommendation for Key Management) or an equivalent industry standard. Such procedures shall include, at a minimum:

(a) Secure Key Generation. Encryption keys shall be generated using cryptographically secure random number generators.

(b) Secure Key Storage. Encryption keys shall be stored separately from the encrypted data they protect and shall be safeguarded using hardware security modules ("HSMs") or equivalent secure storage mechanisms.

(c) Key Rotation. Encryption keys shall be rotated at least annually, or immediately upon suspected or confirmed compromise of any key.

(d) Key Destruction. Encryption keys that are no longer required shall be securely destroyed in a manner that prevents recovery or reconstruction.

Clearpoint shall maintain documentation of its key management procedures and shall make such documentation available to Quorum upon reasonable request in connection with audits permitted under Section 5.3 of this Exhibit D.

3. ACCESS CONTROLS

3.1 Authentication. Clearpoint shall implement multi-factor authentication ("MFA") for all administrative and privileged access to systems hosting or processing Customer Data. MFA shall require at least two distinct authentication factors (e.g., something the user knows and something the user possesses). User authentication for the ClaimsIQ™ platform shall support integration with Quorum's enterprise identity provider via Security Assertion Markup Language 2.0 ("SAML 2.0") or OpenID Connect ("OIDC"), at Quorum's election. Clearpoint shall implement account lockout mechanisms that temporarily disable accounts after a defined number of consecutive failed authentication attempts (not to exceed five (5) attempts) and shall enforce password policies requiring minimum password complexity and length for any local accounts.

3.2 Principle of Least Privilege. Access to Customer Data shall be granted strictly on a need-to-know basis, limited to those Clearpoint personnel and authorized subprocessor personnel whose roles require such access for the performance of obligations under the Agreement. No Clearpoint personnel shall be granted standing administrative access to production environments containing Customer Data unless such access is necessary for the individual's designated responsibilities. Elevated or temporary access shall be granted through a documented request and approval process and shall be time-limited.

3.3 Role-Based Access Control. Clearpoint shall maintain role-based access control ("RBAC") policies that define access levels based on job function and responsibilities. RBAC configurations shall ensure that users are assigned the minimum set of permissions necessary to perform their duties. Clearpoint shall conduct regular access reviews no less frequently than quarterly to verify that access levels remain appropriate, and shall promptly remediate any identified discrepancies, including the removal of excessive or outdated permissions.

3.4 Access Logging and Monitoring. Clearpoint shall log all access to systems containing Customer Data, including without limitation the following information: user identity, date and time of access, actions performed (including read, write, modify, and delete operations), and the data or data categories accessed. Access logs shall be protected against unauthorized modification or deletion. Logs shall be retained for a minimum of twelve (12) months and shall be available for review by Quorum upon reasonable request, subject to the audit provisions set forth in Section 5.3 of this Exhibit D. Clearpoint shall implement automated monitoring and alerting mechanisms to detect anomalous or unauthorized access attempts in real time or near-real time.

3.5 Employee Background Checks. Clearpoint shall conduct background checks on all employees and contractors with access to Customer Data, to the extent permitted by applicable law, prior to granting such access. Background checks shall include, at a minimum, verification of identity, criminal history review, and, where applicable, verification of relevant professional credentials. Clearpoint shall maintain records evidencing completion of background checks and shall make such records available to Quorum upon request in connection with an audit under Section 5.3.

3.6 Termination of Access. Upon termination of employment or contractual engagement, or upon reassignment to a role that does not require access to Customer Data, of any Clearpoint employee or contractor who had access to Customer Data, Clearpoint shall revoke all such access within twenty-four (24) hours. Clearpoint shall maintain documented procedures governing the timely deprovisioning of access, including the return or secure destruction of any devices, tokens, or credentials associated with such access.

4. NETWORK AND INFRASTRUCTURE SECURITY

4.1 Firewalls and Intrusion Detection. Clearpoint shall deploy and maintain firewalls, intrusion detection systems ("IDS"), and intrusion prevention systems ("IPS") to protect the network perimeter and internal network segments hosting the ClaimsIQ™ platform and processing Customer Data. Firewall rules and IDS/IPS signatures shall be reviewed and updated on a regular basis and in response to emerging threats. Clearpoint shall implement web application firewalls ("WAFs") to protect the ClaimsIQ™ platform's web-facing components from common application-layer attacks, including those identified in the OWASP Top 10.

4.2 Vulnerability Management. Clearpoint shall maintain a vulnerability management program that includes regular automated scanning of all systems hosting or processing Customer Data. Such scanning shall occur at least monthly and shall cover operating systems, applications, databases, and network infrastructure components. Clearpoint shall classify discovered vulnerabilities using a risk-based methodology (e.g., CVSS scoring) and shall remediate vulnerabilities in accordance with the following timelines:

(a) Critical vulnerabilities (CVSS score of 9.0 or above): remediated within thirty (30) days of discovery.

(b) High-severity vulnerabilities (CVSS score of 7.0 to 8.9): remediated within sixty (60) days of discovery.

Where remediation within the specified timeline is not feasible due to technical constraints, Clearpoint shall implement compensating controls and shall notify Quorum in writing of the delay, the nature of the compensating controls, and the revised remediation timeline.

4.3 Patch Management. Clearpoint shall apply security patches to operating systems, applications, and infrastructure components in accordance with a documented patch management policy. Critical security patches (i.e., patches addressing critical vulnerabilities as defined in Section 4.2(a) above) shall be applied within fourteen (14) days of release by the applicable vendor. Clearpoint shall maintain an inventory of all software and hardware components in the ClaimsIQ™ platform environment to facilitate timely identification and application of relevant patches.

4.4 Segmentation. Customer Data shall be logically segregated from the data of other Clearpoint customers at the application and database layers. Clearpoint shall implement network segmentation to isolate production environments containing Customer Data from development, testing, staging, and other non-production environments. Production Customer Data shall not be used in non-production environments unless the data has been fully de-identified or pseudonymized in accordance with applicable law and best practices, and only with Quorum's prior written approval.

4.5 Hosting Environment. The ClaimsIQ™ platform is hosted by Cobalt Cloud Infrastructure, Inc. at data center facilities located within the continental United States. All Customer Data — including primary data stores, backups, replicas, and disaster recovery copies — shall reside exclusively within data center facilities located in the continental United States. Clearpoint shall not transfer, store, or process Customer Data outside of the United States without the prior written consent of Quorum. Any change in the hosting provider or data center location shall require Quorum's prior written consent and shall be communicated to Quorum no less than ninety (90) days in advance.

5. SECURITY AUDITS AND ASSESSMENTS

5.1 SOC 2 Type II Audit

Clearpoint shall engage an independent, nationally recognized certified public accounting firm to conduct an annual SOC 2 Type II audit of the ClaimsIQ™ platform and related systems. The audit shall cover the AICPA Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy. As of the Effective Date, Clearpoint's current SOC 2 Type II auditor is Hawthorne & Ellers, CPAs LLP. Any change in the engagement of the audit firm shall be communicated to Quorum in writing at least sixty (60) days in advance, and Quorum shall have the right to object to the proposed replacement firm on reasonable grounds.

The most recent SOC 2 Type II audit report covers the twelve (12) month period from April 1, 2023 through March 31, 2024. Clearpoint shall ensure that there is no gap in SOC 2 audit coverage throughout the Term of the Agreement.

Clearpoint shall deliver each SOC 2 Type II audit report, including any bridge letters, to Quorum within ninety (90) days of the close of each audit period. If any SOC 2 Type II audit report identifies material deficiencies, qualified opinions, or exceptions to the applicable Trust Services Criteria, Clearpoint shall provide a written remediation plan to Quorum within thirty (30) days of report delivery. Such remediation plan shall include a description of each deficiency or exception, the root cause analysis, the proposed remediation actions, and the estimated timeline for completion. Clearpoint shall remediate all material deficiencies within ninety (90) days of report delivery and shall provide Quorum with written confirmation upon completion of remediation.

5.2 Penetration Testing

Clearpoint shall engage an independent third-party security firm to conduct penetration testing of the ClaimsIQ™ platform and related infrastructure at least annually. As of the Effective Date, Clearpoint's current penetration testing vendor is Sentinel Cyber Solutions LLC. Any change in the penetration testing vendor shall be communicated to Quorum in writing at least thirty (30) days in advance.

Each annual penetration test shall include, at a minimum:

(a) External network penetration testing of internet-facing systems and services associated with the ClaimsIQ™ platform;

(b) Web application penetration testing of the ClaimsIQ™ platform, including testing for vulnerabilities identified in the OWASP Top 10 and OWASP API Security Top 10;

(c) Internal network penetration testing of environments hosting or processing Customer Data, simulating an attacker who has gained initial access to the internal network; and

(d) Social engineering testing (at Clearpoint's discretion, or upon Quorum's request) targeting Clearpoint personnel with access to Customer Data.

Clearpoint shall provide an executive summary of penetration test results to Quorum within thirty (30) days of completion of each annual test. The executive summary shall describe the scope and methodology of the test, the number and severity of identified findings, and the status of remediation efforts. Quorum acknowledges that the full detailed penetration test report may contain sensitive security information and agrees that the executive summary shall satisfy Clearpoint's delivery obligation under this Section 5.2, provided that Quorum may request and review the full report under the audit provisions of Section 5.3, subject to reasonable confidentiality restrictions.

Critical findings (CVSS 9.0 or above) from penetration testing shall be remediated within thirty (30) days of identification. High-severity findings (CVSS 7.0 to 8.9) shall be remediated within sixty (60) days of identification. Clearpoint shall provide written confirmation of remediation to Quorum, including a description of the corrective actions taken, within five (5) business days of the completion of remediation for each finding.

5.3 Quorum Audit Rights

Quorum (or its designated third-party auditor, subject to reasonable confidentiality restrictions acceptable to both parties) shall have the right, upon at least thirty (30) days' prior written notice, to conduct or commission a security audit or assessment of Clearpoint's systems, facilities, and processes that handle Customer Data. Quorum may exercise this right no more than once per twelve (12) month period; provided, however, that this limitation shall not apply if the audit is triggered by:

(a) a confirmed Security Incident (as defined in Section 6.2) affecting Customer Data;

(b) a material deficiency or qualified opinion identified in a SOC 2 Type II audit report;

(d) a reasonable, good-faith determination by Quorum that Clearpoint is not in material compliance with the requirements of this Exhibit D.

Clearpoint shall cooperate fully with such audits, including providing reasonable access to relevant personnel, documentation, and systems during normal business hours at Clearpoint's offices or, where applicable, via secure remote access. Clearpoint shall designate a point of contact to coordinate audit logistics and respond to audit inquiries in a timely manner.

The costs of audits conducted under this Section 5.3 shall be borne by Quorum, unless the audit reveals a material non-compliance by Clearpoint with the requirements of this Exhibit D, in which case Clearpoint shall bear the reasonable costs of such audit, including any follow-up verification audit reasonably necessary to confirm remediation.

6. SECURITY INCIDENT RESPONSE AND NOTIFICATION

6.1 Incident Response Plan. Clearpoint shall maintain a written security incident response plan (the "Incident Response Plan") that defines roles and responsibilities, escalation procedures, communication protocols, evidence preservation procedures, and remediation processes. The Incident Response Plan shall be tested at least annually through tabletop exercises, simulated incident scenarios, or functional tests. Clearpoint shall update the Incident Response Plan as necessary to reflect lessons learned from testing, actual incidents, and changes in the threat environment.

6.2 Incident Notification. In the event of any confirmed Security Incident — defined as any unauthorized access to, acquisition of, use of, or disclosure of Customer Data, or any breach of the security, confidentiality, or integrity of systems containing Customer Data — Clearpoint shall notify Quorum in writing within twenty-four (24) hours of Clearpoint's confirmation that a Security Incident has occurred. Notification shall be provided to Quorum's designated security contact and to the General Counsel of Quorum via email and telephone. Clearpoint shall provide prompt updates as additional information becomes available, and in no event less frequently than every twenty-four (24) hours during the initial investigation and containment phase.

6.3 Content of Notification. Each notification provided under Section 6.2 shall include, to the extent known at the time of notification:

(a) the nature and scope of the Security Incident, including the systems, services, and data categories involved;

(b) the categories and approximate number of data records and individuals affected;

(d) the measures taken or proposed to be taken to address and mitigate the Security Incident, including containment actions; and

(e) the identity and contact information of a designated Clearpoint contact person for further information and coordination.

If Clearpoint is unable to provide all of the foregoing information at the time of initial notification, Clearpoint shall provide the information that is available and shall supplement the notification as additional information is gathered, without undue delay.

6.4 Cooperation and Remediation. Clearpoint shall cooperate fully with Quorum in the investigation, mitigation, and remediation of any Security Incident. Such cooperation shall include providing timely access to relevant logs, forensic evidence, personnel, and systems as reasonably requested by Quorum or its designated forensic investigators. Clearpoint shall take all commercially reasonable steps to contain and remediate the Security Incident, preserve relevant evidence (including logs and forensic images), and prevent recurrence. Clearpoint shall not destroy or alter any evidence related to a Security Incident without Quorum's prior written consent, except as required by applicable law or necessary for containment.

6.5 Regulatory Notification. Clearpoint shall assist Quorum in complying with any applicable breach notification obligations under the CTDPA, HIPAA, the NAIC Insurance Data Security Model Law as adopted in the State of Connecticut, and any other applicable federal, state, or local law or regulation. Such assistance shall include providing the information necessary for Quorum to prepare and submit required notifications to regulatory authorities, affected individuals, and other parties as required by law. Clearpoint shall not issue any public statement, press release, or regulatory notification regarding a Security Incident involving Customer Data without Quorum's prior written consent, except as required by applicable law, in which case Clearpoint shall provide Quorum with as much advance notice as is reasonably practicable and shall consult with Quorum regarding the content of such notification.

6.6 Root Cause Analysis. Within thirty (30) days following the resolution of a Security Incident, Clearpoint shall provide Quorum with a written root cause analysis report. The root cause analysis shall include, at a minimum:

(a) a detailed description of the Security Incident, including the timeline of events;

(b) an identification of the root cause(s) of the Security Incident;

(d) an assessment of the effectiveness of the remediation actions; and

(e) a description of the measures implemented, or planned to be implemented, to prevent recurrence of similar incidents.

7. BUSINESS CONTINUITY AND DISASTER RECOVERY

7.1 BCP/DR Plan. Clearpoint shall maintain documented business continuity and disaster recovery plans (collectively, the "BCP/DR Plans") for the ClaimsIQ™ platform that are designed to ensure the continued availability and integrity of Customer Data and the platform in the event of a disruption, including without limitation natural disasters, infrastructure failures, cyberattacks, and pandemic events. The BCP/DR Plans shall be reviewed and updated at least annually and shall address the critical functions, dependencies, and recovery procedures necessary to restore the ClaimsIQ™ platform to full operation.

7.2 Recovery Objectives. Clearpoint's BCP/DR Plans shall target the following recovery objectives:

(a) Recovery Time Objective ("RTO"): No more than four (4) hours from the declaration of a disaster or major disruption to the restoration of the ClaimsIQ™ platform to operational status.

(b) Recovery Point Objective ("RPO"): No more than one (1) hour, meaning that Customer Data loss in the event of a disaster shall not exceed the data created, modified, or processed in the one (1) hour immediately preceding the disaster event.

Clearpoint acknowledges that the foregoing recovery objectives represent committed service levels and that a failure to meet such objectives may constitute a material breach of the Agreement, subject to any applicable cure provisions set forth therein.

7.3 Testing. Clearpoint shall test its BCP/DR Plans at least annually through scheduled exercises, including failover testing to disaster recovery infrastructure. Clearpoint shall provide a summary of test results, including any identified deficiencies and corrective actions, to Quorum upon request. If testing reveals deficiencies that could materially affect the ability to meet the recovery objectives set forth in Section 7.2, Clearpoint shall remediate such deficiencies within sixty (60) days of identification and shall notify Quorum in writing of the remediation actions taken.

7.4 Data Backups. Clearpoint shall perform regular backups of Customer Data at least daily. Backups shall be stored in a geographically separate data center facility located within the continental United States, at a distance sufficient to mitigate the risk of a single regional event affecting both the primary and backup locations. All backup data shall be encrypted in accordance with Section 2 of this Exhibit D. Clearpoint shall periodically test backup restoration procedures to verify the integrity and recoverability of backup data, and shall maintain documentation of such testing.

8. PERSONNEL SECURITY AND TRAINING

8.1 Security Awareness Training. Clearpoint shall provide annual security awareness training to all employees and contractors with access to Customer Data. Training shall cover, at a minimum, the following topics:

(a) proper handling and protection of sensitive data, including PII and PHI;

(b) recognition and reporting of phishing, social engineering, and other cyber threats;

(d) regulatory requirements applicable to insurance data, including HIPAA, CTDPA, and the NAIC Insurance Data Security Model Law; and

(e) Clearpoint's internal security policies and procedures, including acceptable use policies and data classification standards.

Clearpoint shall maintain records of training completion and shall make such records available to Quorum upon reasonable request. New employees and contractors shall complete security awareness training within thirty (30) days of commencing their engagement.

8.2 Confidentiality Obligations. All Clearpoint employees and contractors with access to Customer Data shall be bound by written confidentiality obligations no less protective than those set forth in the Agreement, including the confidentiality and non-disclosure provisions of the Agreement. Such obligations shall survive the termination of the individual's employment or contractual engagement with Clearpoint.

8.3 Specialized Training. In addition to the general security awareness training described in Section 8.1, Clearpoint personnel who handle PII or PHI related to Quorum's workers' compensation lines of business shall receive training specific to the requirements of the HIPAA Privacy Rule and Security Rule, including the proper handling, use, and disclosure of PHI, minimum necessary standards, and individual rights under HIPAA. Such specialized training shall be provided upon initial assignment and at least annually thereafter.

9. INSURANCE REQUIREMENTS

9.1 Required Coverages. Throughout the Term of the Agreement, Clearpoint shall obtain and maintain the following insurance coverages with financially sound and reputable insurers rated no lower than "A-" (Excellent) by A.M. Best Company:

(a) Commercial General Liability ("CGL") Insurance: Not less than Five Million Dollars ($5,000,000) per occurrence and Ten Million Dollars ($10,000,000) in the aggregate, covering bodily injury, property damage, personal injury, and advertising injury arising out of Clearpoint's operations.

(b) Technology Errors & Omissions / Cyber Liability Insurance: Not less than Ten Million Dollars ($10,000,000) per claim and Twenty Million Dollars ($20,000,000) in the aggregate, covering claims arising from technology errors and omissions, data breaches, network security failures, unauthorized access to or disclosure of data, and privacy-related liabilities. Such coverage shall include, at a minimum, coverage for notification costs, credit monitoring, crisis management, regulatory defense and penalties (to the extent insurable), and media liability.

(c) Workers' Compensation Insurance: At statutory limits as required by applicable law in each jurisdiction in which Clearpoint operates, including employer's liability coverage with limits of not less than One Million Dollars ($1,000,000) per accident.

9.2 Insurance Carrier. As of the Effective Date, Clearpoint's current carrier for the coverages described in Section 9.1(a) and Section 9.1(b) is Northern Ridge Mutual Insurance Company. Clearpoint shall notify Quorum in writing at least thirty (30) days prior to any material change in carrier, coverage limits, policy terms, or conditions, including any cancellation, non-renewal, or material reduction in coverage.

9.3 Certificates of Insurance. Clearpoint shall provide certificates of insurance evidencing the required coverages upon execution of the Agreement and annually thereafter upon each policy renewal, and promptly upon Quorum's reasonable request. Quorum Insurance Holdings Corp. shall be named as an additional insured on the CGL and Technology E&O/Cyber Liability insurance policies. All policies shall include a waiver of subrogation in favor of Quorum to the extent permitted by the applicable policy and applicable law. Each policy shall provide that the insurer will endeavor to provide Quorum with at least thirty (30) days' prior written notice of cancellation or material change.

9.4 No Limitation of Liability. Maintenance of the insurance coverages set forth in this Section 9 shall not limit, reduce, or otherwise affect Clearpoint's obligations or liabilities under the Agreement, including without limitation the indemnification obligations, limitation of liability provisions, and other risk allocation provisions set forth in the Agreement. The insurance requirements set forth herein represent minimum coverage levels and do not constitute a representation by either party that such coverages are adequate to cover all potential liabilities.

10. PHYSICAL SECURITY

10.1 Data Center Controls. Clearpoint shall ensure that data center facilities operated by Cobalt Cloud Infrastructure, Inc. or any other hosting subprocessor engaged in connection with the ClaimsIQ™ platform maintain physical security controls that are no less protective than the following minimum requirements:

(a) On-Site Security: 24/7 on-site security personnel, security patrols, or continuous remote monitoring by trained security personnel;

(b) Access Control Systems: Physical access control systems, including badge readers, biometric authentication (such as fingerprint or retinal scanning), and mantrap entries, restricting physical entry to authorized individuals only, with access permissions reviewed and updated regularly;

(c) Video Surveillance: Closed-circuit video surveillance covering all entry points, server rooms, and critical infrastructure areas, with recorded footage retained for a minimum period of ninety (90) days;

(d) Environmental Controls: Environmental protection systems, including fire detection and suppression systems (e.g., pre-action dry-pipe or clean-agent suppression), climate control systems (HVAC with redundancy), flood detection sensors, and uninterruptible power supply ("UPS") systems with backup generator capacity; and

(e) Visitor Management: Documented visitor management procedures requiring visitor identification, sign-in/sign-out, escort by authorized personnel at all times, and visitor logs retained for a minimum of ninety (90) days.

10.2 Clearpoint Office Facilities. Clearpoint shall maintain appropriate physical security measures at its own office facilities, including its principal office located at 200 South Wacker Drive, Suite 3100, Chicago, Illinois 60606, and any other locations where Customer Data may be accessed by Clearpoint personnel, to prevent unauthorized physical access to systems, devices, and materials containing or providing access to Customer Data. Such measures shall include, at a minimum, controlled entry to office spaces, locked workstations, clean-desk policies, and secure storage of physical media (if any) containing Customer Data.

11. SECURE DEVELOPMENT PRACTICES

11.1 Secure Software Development Lifecycle. Clearpoint shall maintain a documented secure software development lifecycle ("SDLC") for the ClaimsIQ™ platform that incorporates security at each phase of the development process. The SDLC shall include, at a minimum:

(a) Security Requirements Analysis: Identification and documentation of security requirements during the design phase of each development project or release;

(b) Secure Coding Standards: Adherence to secure coding standards and guidelines (e.g., OWASP Secure Coding Practices) by all development personnel;

(c) Code Reviews: Mandatory peer code reviews, with security-focused review of code changes affecting authentication, authorization, data handling, and encryption;

(d) Static Application Security Testing ("SAST"): Automated static analysis of source code to identify security vulnerabilities prior to deployment;

(e) Dynamic Application Security Testing ("DAST"): Automated dynamic testing of running applications to identify runtime vulnerabilities; and

(f) Pre-Release Security Assessments: Security assessments conducted prior to the release of new versions or significant updates to the ClaimsIQ™ platform, including review of SAST and DAST results and verification that identified vulnerabilities have been addressed.

11.2 Change Management. All changes to the ClaimsIQ™ platform that affect the processing, storage, or transmission of Customer Data shall be subject to documented change management procedures. Such procedures shall include, at a minimum, impact assessment (including security impact), approval by authorized personnel, testing in a non-production environment prior to deployment, and documented rollback capabilities to restore the prior version in the event of a failure or security issue. Emergency changes shall be subject to expedited review and retrospective documentation.

12. DATA DISPOSAL

12.1 Secure Disposal. Upon expiration or termination of the Agreement, and following the completion of the data export obligations set forth in Exhibit C (Data Processing Addendum) — specifically, the full export of Customer Data in ACORD XML and CSV formats within sixty (60) days of the effective date of expiration or termination — Clearpoint shall securely destroy all copies of Customer Data in its possession or control, including without limitation copies held by subprocessors, backup copies, archived copies, and copies in disaster recovery environments, within thirty (30) days of the completion of the data export process. For the avoidance of doubt, the thirty (30) day destruction period commences upon the later of (i) Quorum's written confirmation of successful receipt of the exported data, or (ii) the expiration of the sixty (60) day export period.

12.2 Destruction Methods. Destruction of Customer Data shall be performed using methods consistent with NIST Special Publication 800-88, Revision 1 (Guidelines for Media Sanitization) or equivalent industry-recognized standards, ensuring that Customer Data cannot be recovered, reconstructed, or otherwise retrieved by any means. For electronic media, acceptable methods include cryptographic erasure (destruction of encryption keys rendering the encrypted data unrecoverable), secure overwriting, degaussing, or physical destruction. For physical media (e.g., paper documents, if any), acceptable methods include cross-cut shredding or incineration.

12.3 Certification. Clearpoint shall provide Quorum with a written certification of destruction, signed by an authorized officer of Clearpoint, within five (5) business days following the completion of destruction. The certification shall confirm that all copies of Customer Data, including those held by subprocessors, have been destroyed in accordance with the requirements of this Section 12, and shall identify the destruction methods used and the date(s) of destruction.

13. COMPLIANCE WITH APPLICABLE LAWS

13.1 Clearpoint shall comply with all applicable federal, state, and local laws, rules, and regulations relating to data security and privacy in connection with its performance under the Agreement, including without limitation:

(a) the Connecticut Data Privacy Act, Conn. Gen. Stat. § 42-515 et seq. (the "CTDPA");

(b) the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), including the Privacy Rule, Security Rule, and Breach Notification Rule, to the extent applicable to Quorum's workers' compensation lines of business and to the extent that Clearpoint qualifies as a business associate (as defined in HIPAA) of Quorum;

(c) the NAIC Insurance Data Security Model Law (MDL-668) as adopted in the State of Connecticut (Conn. Gen. Stat. § 38a-38 et seq.);

(d) any other applicable insurance-industry-specific data security or privacy requirements in jurisdictions where Quorum operates, including without limitation the States of Connecticut, Texas, and Florida, and any regulations promulgated by the Connecticut Insurance Department, the Texas Department of Insurance, and the Florida Office of Insurance Regulation; and

(e) any other applicable data protection law, regulation, or regulatory guidance that applies to the processing of Customer Data by Clearpoint in connection with the ClaimsIQ™ platform.

13.2 In the event of a conflict between the requirements of this Exhibit D and any applicable law, rule, or regulation, the more protective standard shall apply to the extent that compliance with both is feasible; provided, however, that Clearpoint shall in all cases comply with mandatory legal requirements. If Clearpoint becomes aware that compliance with a specific provision of this Exhibit D would conflict with a mandatory legal requirement, Clearpoint shall promptly notify Quorum in writing and the parties shall cooperate in good faith to agree upon an alternative measure that satisfies both the intent of this Exhibit D and the applicable legal requirement.

14. MODIFICATIONS AND UPDATES

14.1 Updates to Security Requirements. Quorum may propose reasonable updates to the security requirements set forth in this Exhibit D from time to time to reflect changes in applicable law, regulatory guidance, industry standards, or the evolving threat landscape. Any such proposed updates shall be submitted to Clearpoint in writing. The parties shall negotiate any such updates in good faith and in a commercially reasonable manner. Material updates — including any updates that would require Clearpoint to implement new technologies, significantly modify existing infrastructure, or incur material additional costs — shall require mutual written agreement, documented as an amendment to the Agreement executed by authorized representatives of both parties. Notwithstanding the foregoing, updates required to comply with changes in applicable law shall be implemented by Clearpoint in a timely manner and shall not require Quorum's separate consent.

14.2 Clearpoint's Security Enhancements. Clearpoint shall not materially reduce the security measures applicable to Customer Data below the levels set forth in this Exhibit D, or below the levels in effect as of the Effective Date (whichever is more protective), without the prior written consent of Quorum. Clearpoint shall notify Quorum in writing of any material enhancements to its Security Program that affect the protection of Customer Data, including the adoption of new security technologies, the expansion of monitoring capabilities, or improvements to incident response procedures. Such notifications shall be provided within thirty (30) days of implementation of the enhancement.

15. SURVIVAL

15.1 The obligations set forth in this Exhibit D relating to the protection, disposal, and certification of destruction of Customer Data (including, without limitation, Sections 2, 6, 10, 12, and 13), and Quorum's audit rights under Section 5.3, shall survive any expiration or termination of the Agreement for a period of two (2) years or until Clearpoint has provided the certification of destruction of all Customer Data pursuant to Section 12.3, whichever is later. For the avoidance of doubt, Clearpoint's obligations with respect to any Customer Data remaining in its possession or control following expiration or termination of the Agreement shall continue in full force and effect until such data has been securely destroyed and certified as destroyed in accordance with this Exhibit D.

EXHIBIT ACKNOWLEDGMENT

This Exhibit D is incorporated into and forms an integral part of the Enterprise SaaS Subscription Agreement dated April 26, 2024, by and between Quorum Insurance Holdings Corp. and Clearpoint Analytics, Inc. By executing this Exhibit D (or by executing the Agreement to which this Exhibit D is attached), each party acknowledges that it has read, understands, and agrees to be bound by the terms and conditions set forth herein.

IN WITNESS WHEREOF, the parties have caused this Exhibit D to be executed by their duly authorized representatives as of the date set forth below.

QUORUM INSURANCE HOLDINGS CORP.

By: ________

Name: Patricia Okonkwo

Title: General Counsel

Date: ________

CLEARPOINT ANALYTICS, INC.

By: ________

Name: Anita Rajan

Title: CEO & Co-Founder

Date: ________

Exhibit D — Security Requirements — Page intentionally concludes here.

EXHIBIT D — SECURITY REQUIREMENTS
to the Enterprise SaaS Subscription Agreement
Effective Date: April 26, 2024
This Exhibit D (this "Exhibit") is attached to and forms part of the Enterprise SaaS Subscription Agreement dated April 26, 2024 (the "Agreement") by and between Quorum Insurance Holdings Corp., a Delaware corporation ("Licensee" or "Quorum"), and Clearpoint Analytics, Inc., a Delaware corporation ("Licensor" or "Clearpoint").
This Exhibit D sets forth the security requirements applicable to Clearpoint's provision of the ClaimsIQ™ platform and related services under the Agreement. Capitalized terms used but not defined herein shall have the meanings set forth in the Agreement. Clearpoint shall comply with all requirements set forth in this Exhibit D throughout the Term of the Agreement. In the event of any conflict between the terms of this Exhibit D and the body of the Agreement, the terms that are more protective of Customer Data shall control.
1. GENERAL SECURITY OBLIGATIONS
1.1 Security Program. Clearpoint shall establish, implement, and maintain a comprehensive written information security program (the "Security Program") designed to protect Customer Data (as defined in the Agreement and in Exhibit C — Data Processing Addendum) against unauthorized access, use, disclosure, alteration, or destruction. The Security Program shall be commensurate with the nature, scope, and sensitivity of the Customer Data processed by Clearpoint, taking into account the particular risks associated with insurance claims data, including personally identifiable information ("PII") and, where applicable, protected health information ("PHI"). The Security Program shall include administrative, technical, and physical safeguards and shall be reviewed and updated by Clearpoint no less frequently than annually to address evolving threats, vulnerabilities, and regulatory requirements.
1.2 Applicable Standards. The Security Program shall be designed and operated in accordance with industry-recognized standards, including but not limited to:
(a) the American Institute of Certified Public Accountants ("AICPA") Trust Services Criteria (SOC 2);
(b) the National Association of Insurance Commissioners ("NAIC") Insurance Data Security Model Law (MDL-668) as adopted in the State of Connecticut;
(c) the Connecticut Data Privacy Act, Conn. Gen. Stat. § 42-515 et seq. (the "CTDPA"); and
(d) to the extent applicable to Quorum's workers' compensation lines of business, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") Security Rule, 45 C.F.R. Part 160 and Subparts A and C of Part 164, as amended.
Where the requirements of the foregoing standards differ, Clearpoint shall comply with the most protective standard applicable to the relevant category of Customer Data. Clearpoint acknowledges that Quorum operates in a highly regulated industry and that the protection of Customer Data is of paramount importance to Quorum's business operations, regulatory standing, and policyholder trust.
1.3 Responsibility. Clearpoint shall designate a qualified individual (at a minimum, a senior officer or director-level employee) as the person responsible for overseeing and implementing the Security Program (the "Security Program Lead"). As of the Effective Date, the designated Security Program Lead is Clearpoint's Chief Information Security Officer. The Security Program Lead shall have sufficient authority, resources, and organizational support to carry out the objectives of the Security Program effectively. Clearpoint shall notify Quorum in writing within thirty (30) days of any change in the designated Security Program Lead, including the identity and qualifications of the successor.
1.4 Subprocessor Security. Clearpoint shall ensure that each subprocessor engaged in connection with the ClaimsIQ™ platform, including without limitation Cobalt Cloud Infrastructure, Inc. (hosting and infrastructure-as-a-service) and Redline Document AI, LLC (optical character recognition processing), maintains security measures that are no less protective than those set forth in this Exhibit D. Prior to engaging any subprocessor that will have access to or will process Customer Data, Clearpoint shall conduct an appropriate due diligence assessment of such subprocessor's security practices. Clearpoint remains fully responsible for the acts and omissions of its subprocessors with respect to the security of Customer Data, and any failure by a subprocessor to meet the requirements of this Exhibit D shall be deemed a failure by Clearpoint for all purposes under the Agreement.
2. ENCRYPTION STANDARDS
2.1 Encryption at Rest. All Customer Data stored by Clearpoint or its subprocessors, whether on primary storage systems, backup media, or any other storage medium, shall be encrypted at rest using the Advanced Encryption Standard with a minimum key length of 256 bits ("AES-256") or an equivalent or stronger encryption algorithm approved by the National Institute of Standards and Technology ("NIST"). This requirement applies to all Customer Data, including but not limited to database records, file-system objects, archived data, and data stored in temporary or staging environments.
2.2 Encryption in Transit. All Customer Data transmitted between Quorum's systems and the ClaimsIQ™ platform, between the ClaimsIQ™ platform and any subprocessor systems, and between components of the ClaimsIQ™ platform infrastructure, shall be encrypted in transit using Transport Layer Security version 1.2 or higher ("TLS 1.2+"). Earlier versions of TLS (including TLS 1.0 and TLS 1.1) and all versions of the Secure Sockets Layer ("SSL") protocol shall not be used for any transmission of Customer Data. Clearpoint shall implement HTTP Strict Transport Security ("HSTS") headers and shall ensure that all API endpoints utilized in connection with the ClaimsIQ™ platform enforce encrypted connections.
2.3 Key Management. Clearpoint shall implement and maintain encryption key management procedures that are consistent with NIST Special Publication 800-57 (Recommendation for Key Management) or an equivalent industry standard. Such procedures shall include, at a minimum:
(a) Secure Key Generation. Encryption keys shall be generated using cryptographically secure random number generators.
(b) Secure Key Storage. Encryption keys shall be stored separately from the encrypted data they protect and shall be safeguarded using hardware security modules ("HSMs") or equivalent secure storage mechanisms.
(c) Key Rotation. Encryption keys shall be rotated at least annually, or immediately upon suspected or confirmed compromise of any key.
(d) Key Destruction. Encryption keys that are no longer required shall be securely destroyed in a manner that prevents recovery or reconstruction.
Clearpoint shall maintain documentation of its key management procedures and shall make such documentation available to Quorum upon reasonable request in connection with audits permitted under Section 5.3 of this Exhibit D.
3. ACCESS CONTROLS
3.1 Authentication. Clearpoint shall implement multi-factor authentication ("MFA") for all administrative and privileged access to systems hosting or processing Customer Data. MFA shall require at least two distinct authentication factors (e.g., something the user knows and something the user possesses). User authentication for the ClaimsIQ™ platform shall support integration with Quorum's enterprise identity provider via Security Assertion Markup Language 2.0 ("SAML 2.0") or OpenID Connect ("OIDC"), at Quorum's election. Clearpoint shall implement account lockout mechanisms that temporarily disable accounts after a defined number of consecutive failed authentication attempts (not to exceed five (5) attempts) and shall enforce password policies requiring minimum password complexity and length for any local accounts.
3.2 Principle of Least Privilege. Access to Customer Data shall be granted strictly on a need-to-know basis, limited to those Clearpoint personnel and authorized subprocessor personnel whose roles require such access for the performance of obligations under the Agreement. No Clearpoint personnel shall be granted standing administrative access to production environments containing Customer Data unless such access is necessary for the individual's designated responsibilities. Elevated or temporary access shall be granted through a documented request and approval process and shall be time-limited.
3.3 Role-Based Access Control. Clearpoint shall maintain role-based access control ("RBAC") policies that define access levels based on job function and responsibilities. RBAC configurations shall ensure that users are assigned the minimum set of permissions necessary to perform their duties. Clearpoint shall conduct regular access reviews no less frequently than quarterly to verify that access levels remain appropriate, and shall promptly remediate any identified discrepancies, including the removal of excessive or outdated permissions.
3.4 Access Logging and Monitoring. Clearpoint shall log all access to systems containing Customer Data, including without limitation the following information: user identity, date and time of access, actions performed (including read, write, modify, and delete operations), and the data or data categories accessed. Access logs shall be protected against unauthorized modification or deletion. Logs shall be retained for a minimum of twelve (12) months and shall be available for review by Quorum upon reasonable request, subject to the audit provisions set forth in Section 5.3 of this Exhibit D. Clearpoint shall implement automated monitoring and alerting mechanisms to detect anomalous or unauthorized access attempts in real time or near-real time.
3.5 Employee Background Checks. Clearpoint shall conduct background checks on all employees and contractors with access to Customer Data, to the extent permitted by applicable law, prior to granting such access. Background checks shall include, at a minimum, verification of identity, criminal history review, and, where applicable, verification of relevant professional credentials. Clearpoint shall maintain records evidencing completion of background checks and shall make such records available to Quorum upon request in connection with an audit under Section 5.3.
3.6 Termination of Access. Upon termination of employment or contractual engagement, or upon reassignment to a role that does not require access to Customer Data, of any Clearpoint employee or contractor who had access to Customer Data, Clearpoint shall revoke all such access within twenty-four (24) hours. Clearpoint shall maintain documented procedures governing the timely deprovisioning of access, including the return or secure destruction of any devices, tokens, or credentials associated with such access.
4. NETWORK AND INFRASTRUCTURE SECURITY
4.1 Firewalls and Intrusion Detection. Clearpoint shall deploy and maintain firewalls, intrusion detection systems ("IDS"), and intrusion prevention systems ("IPS") to protect the network perimeter and internal network segments hosting the ClaimsIQ™ platform and processing Customer Data. Firewall rules and IDS/IPS signatures shall be reviewed and updated on a regular basis and in response to emerging threats. Clearpoint shall implement web application firewalls ("WAFs") to protect the ClaimsIQ™ platform's web-facing components from common application-layer attacks, including those identified in the OWASP Top 10.
4.2 Vulnerability Management. Clearpoint shall maintain a vulnerability management program that includes regular automated scanning of all systems hosting or processing Customer Data. Such scanning shall occur at least monthly and shall cover operating systems, applications, databases, and network infrastructure components. Clearpoint shall classify discovered vulnerabilities using a risk-based methodology (e.g., CVSS scoring) and shall remediate vulnerabilities in accordance with the following timelines:
(a) Critical vulnerabilities (CVSS score of 9.0 or above): remediated within thirty (30) days of discovery.
(b) High-severity vulnerabilities (CVSS score of 7.0 to 8.9): remediated within sixty (60) days of discovery.
(c) Medium-severity vulnerabilities (CVSS score of 4.0 to 6.9): remediated within ninety (90) days of discovery.
Where remediation within the specified timeline is not feasible due to technical constraints, Clearpoint shall implement compensating controls and shall notify Quorum in writing of the delay, the nature of the compensating controls, and the revised remediation timeline.
4.3 Patch Management. Clearpoint shall apply security patches to operating systems, applications, and infrastructure components in accordance with a documented patch management policy. Critical security patches (i.e., patches addressing critical vulnerabilities as defined in Section 4.2(a) above) shall be applied within fourteen (14) days of release by the applicable vendor. Clearpoint shall maintain an inventory of all software and hardware components in the ClaimsIQ™ platform environment to facilitate timely identification and application of relevant patches.
4.4 Segmentation. Customer Data shall be logically segregated from the data of other Clearpoint customers at the application and database layers. Clearpoint shall implement network segmentation to isolate production environments containing Customer Data from development, testing, staging, and other non-production environments. Production Customer Data shall not be used in non-production environments unless the data has been fully de-identified or pseudonymized in accordance with applicable law and best practices, and only with Quorum's prior written approval.
4.5 Hosting Environment. The ClaimsIQ™ platform is hosted by Cobalt Cloud Infrastructure, Inc. at data center facilities located within the continental United States. All Customer Data — including primary data stores, backups, replicas, and disaster recovery copies — shall reside exclusively within data center facilities located in the continental United States. Clearpoint shall not transfer, store, or process Customer Data outside of the United States without the prior written consent of Quorum. Any change in the hosting provider or data center location shall require Quorum's prior written consent and shall be communicated to Quorum no less than ninety (90) days in advance.
5. SECURITY AUDITS AND ASSESSMENTS
5.1 SOC 2 Type II Audit
Clearpoint shall engage an independent, nationally recognized certified public accounting firm to conduct an annual SOC 2 Type II audit of the ClaimsIQ™ platform and related systems. The audit shall cover the AICPA Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy. As of the Effective Date, Clearpoint's current SOC 2 Type II auditor is Hawthorne & Ellers, CPAs LLP. Any change in the engagement of the audit firm shall be communicated to Quorum in writing at least sixty (60) days in advance, and Quorum shall have the right to object to the proposed replacement firm on reasonable grounds.
The most recent SOC 2 Type II audit report covers the twelve (12) month period from April 1, 2023 through March 31, 2024. Clearpoint shall ensure that there is no gap in SOC 2 audit coverage throughout the Term of the Agreement.
Clearpoint shall deliver each SOC 2 Type II audit report, including any bridge letters, to Quorum within ninety (90) days of the close of each audit period. If any SOC 2 Type II audit report identifies material deficiencies, qualified opinions, or exceptions to the applicable Trust Services Criteria, Clearpoint shall provide a written remediation plan to Quorum within thirty (30) days of report delivery. Such remediation plan shall include a description of each deficiency or exception, the root cause analysis, the proposed remediation actions, and the estimated timeline for completion. Clearpoint shall remediate all material deficiencies within ninety (90) days of report delivery and shall provide Quorum with written confirmation upon completion of remediation.
5.2 Penetration Testing
Clearpoint shall engage an independent third-party security firm to conduct penetration testing of the ClaimsIQ™ platform and related infrastructure at least annually. As of the Effective Date, Clearpoint's current penetration testing vendor is Sentinel Cyber Solutions LLC. Any change in the penetration testing vendor shall be communicated to Quorum in writing at least thirty (30) days in advance.
Each annual penetration test shall include, at a minimum:
(a) External network penetration testing of internet-facing systems and services associated with the ClaimsIQ™ platform;
(b) Web application penetration testing of the ClaimsIQ™ platform, including testing for vulnerabilities identified in the OWASP Top 10 and OWASP API Security Top 10;
(c) Internal network penetration testing of environments hosting or processing Customer Data, simulating an attacker who has gained initial access to the internal network; and
(d) Social engineering testing (at Clearpoint's discretion, or upon Quorum's request) targeting Clearpoint personnel with access to Customer Data.
Clearpoint shall provide an executive summary of penetration test results to Quorum within thirty (30) days of completion of each annual test. The executive summary shall describe the scope and methodology of the test, the number and severity of identified findings, and the status of remediation efforts. Quorum acknowledges that the full detailed penetration test report may contain sensitive security information and agrees that the executive summary shall satisfy Clearpoint's delivery obligation under this Section 5.2, provided that Quorum may request and review the full report under the audit provisions of Section 5.3, subject to reasonable confidentiality restrictions.
Critical findings (CVSS 9.0 or above) from penetration testing shall be remediated within thirty (30) days of identification. High-severity findings (CVSS 7.0 to 8.9) shall be remediated within sixty (60) days of identification. Clearpoint shall provide written confirmation of remediation to Quorum, including a description of the corrective actions taken, within five (5) business days of the completion of remediation for each finding.
5.3 Quorum Audit Rights
Quorum (or its designated third-party auditor, subject to reasonable confidentiality restrictions acceptable to both parties) shall have the right, upon at least thirty (30) days' prior written notice, to conduct or commission a security audit or assessment of Clearpoint's systems, facilities, and processes that handle Customer Data. Quorum may exercise this right no more than once per twelve (12) month period; provided, however, that this limitation shall not apply if the audit is triggered by:
(a) a confirmed Security Incident (as defined in Section 6.2) affecting Customer Data;
(b) a material deficiency or qualified opinion identified in a SOC 2 Type II audit report;
(c) a critical finding identified in a penetration test that has not been remediated within the applicable timeline; or
(d) a reasonable, good-faith determination by Quorum that Clearpoint is not in material compliance with the requirements of this Exhibit D.
Clearpoint shall cooperate fully with such audits, including providing reasonable access to relevant personnel, documentation, and systems during normal business hours at Clearpoint's offices or, where applicable, via secure remote access. Clearpoint shall designate a point of contact to coordinate audit logistics and respond to audit inquiries in a timely manner.
The costs of audits conducted under this Section 5.3 shall be borne by Quorum, unless the audit reveals a material non-compliance by Clearpoint with the requirements of this Exhibit D, in which case Clearpoint shall bear the reasonable costs of such audit, including any follow-up verification audit reasonably necessary to confirm remediation.
6. SECURITY INCIDENT RESPONSE AND NOTIFICATION
6.1 Incident Response Plan. Clearpoint shall maintain a written security incident response plan (the "Incident Response Plan") that defines roles and responsibilities, escalation procedures, communication protocols, evidence preservation procedures, and remediation processes. The Incident Response Plan shall be tested at least annually through tabletop exercises, simulated incident scenarios, or functional tests. Clearpoint shall update the Incident Response Plan as necessary to reflect lessons learned from testing, actual incidents, and changes in the threat environment.
6.2 Incident Notification. In the event of any confirmed Security Incident — defined as any unauthorized access to, acquisition of, use of, or disclosure of Customer Data, or any breach of the security, confidentiality, or integrity of systems containing Customer Data — Clearpoint shall notify Quorum in writing within twenty-four (24) hours of Clearpoint's confirmation that a Security Incident has occurred. Notification shall be provided to Quorum's designated security contact and to the General Counsel of Quorum via email and telephone. Clearpoint shall provide prompt updates as additional information becomes available, and in no event less frequently than every twenty-four (24) hours during the initial investigation and containment phase.
6.3 Content of Notification. Each notification provided under Section 6.2 shall include, to the extent known at the time of notification:
(a) the nature and scope of the Security Incident, including the systems, services, and data categories involved;
(b) the categories and approximate number of data records and individuals affected;
(c) the likely consequences of the Security Incident for Quorum and affected data subjects;
(d) the measures taken or proposed to be taken to address and mitigate the Security Incident, including containment actions; and
(e) the identity and contact information of a designated Clearpoint contact person for further information and coordination.
If Clearpoint is unable to provide all of the foregoing information at the time of initial notification, Clearpoint shall provide the information that is available and shall supplement the notification as additional information is gathered, without undue delay.
6.4 Cooperation and Remediation. Clearpoint shall cooperate fully with Quorum in the investigation, mitigation, and remediation of any Security Incident. Such cooperation shall include providing timely access to relevant logs, forensic evidence, personnel, and systems as reasonably requested by Quorum or its designated forensic investigators. Clearpoint shall take all commercially reasonable steps to contain and remediate the Security Incident, preserve relevant evidence (including logs and forensic images), and prevent recurrence. Clearpoint shall not destroy or alter any evidence related to a Security Incident without Quorum's prior written consent, except as required by applicable law or necessary for containment.
6.5 Regulatory Notification. Clearpoint shall assist Quorum in complying with any applicable breach notification obligations under the CTDPA, HIPAA, the NAIC Insurance Data Security Model Law as adopted in the State of Connecticut, and any other applicable federal, state, or local law or regulation. Such assistance shall include providing the information necessary for Quorum to prepare and submit required notifications to regulatory authorities, affected individuals, and other parties as required by law. Clearpoint shall not issue any public statement, press release, or regulatory notification regarding a Security Incident involving Customer Data without Quorum's prior written consent, except as required by applicable law, in which case Clearpoint shall provide Quorum with as much advance notice as is reasonably practicable and shall consult with Quorum regarding the content of such notification.
6.6 Root Cause Analysis. Within thirty (30) days following the resolution of a Security Incident, Clearpoint shall provide Quorum with a written root cause analysis report. The root cause analysis shall include, at a minimum:
(a) a detailed description of the Security Incident, including the timeline of events;
(b) an identification of the root cause(s) of the Security Incident;
(c) a description of the remediation actions taken to address the Security Incident;
(d) an assessment of the effectiveness of the remediation actions; and
(e) a description of the measures implemented, or planned to be implemented, to prevent recurrence of similar incidents.
7. BUSINESS CONTINUITY AND DISASTER RECOVERY
7.1 BCP/DR Plan. Clearpoint shall maintain documented business continuity and disaster recovery plans (collectively, the "BCP/DR Plans") for the ClaimsIQ™ platform that are designed to ensure the continued availability and integrity of Customer Data and the platform in the event of a disruption, including without limitation natural disasters, infrastructure failures, cyberattacks, and pandemic events. The BCP/DR Plans shall be reviewed and updated at least annually and shall address the critical functions, dependencies, and recovery procedures necessary to restore the ClaimsIQ™ platform to full operation.
7.2 Recovery Objectives. Clearpoint's BCP/DR Plans shall target the following recovery objectives:
(a) Recovery Time Objective ("RTO"): No more than four (4) hours from the declaration of a disaster or major disruption to the restoration of the ClaimsIQ™ platform to operational status.
(b) Recovery Point Objective ("RPO"): No more than one (1) hour, meaning that Customer Data loss in the event of a disaster shall not exceed the data created, modified, or processed in the one (1) hour immediately preceding the disaster event.
Clearpoint acknowledges that the foregoing recovery objectives represent committed service levels and that a failure to meet such objectives may constitute a material breach of the Agreement, subject to any applicable cure provisions set forth therein.
7.3 Testing. Clearpoint shall test its BCP/DR Plans at least annually through scheduled exercises, including failover testing to disaster recovery infrastructure. Clearpoint shall provide a summary of test results, including any identified deficiencies and corrective actions, to Quorum upon request. If testing reveals deficiencies that could materially affect the ability to meet the recovery objectives set forth in Section 7.2, Clearpoint shall remediate such deficiencies within sixty (60) days of identification and shall notify Quorum in writing of the remediation actions taken.
7.4 Data Backups. Clearpoint shall perform regular backups of Customer Data at least daily. Backups shall be stored in a geographically separate data center facility located within the continental United States, at a distance sufficient to mitigate the risk of a single regional event affecting both the primary and backup locations. All backup data shall be encrypted in accordance with Section 2 of this Exhibit D. Clearpoint shall periodically test backup restoration procedures to verify the integrity and recoverability of backup data, and shall maintain documentation of such testing.
8. PERSONNEL SECURITY AND TRAINING
8.1 Security Awareness Training. Clearpoint shall provide annual security awareness training to all employees and contractors with access to Customer Data. Training shall cover, at a minimum, the following topics:
(a) proper handling and protection of sensitive data, including PII and PHI;
(b) recognition and reporting of phishing, social engineering, and other cyber threats;
(c) incident reporting procedures, including the obligation to report suspected Security Incidents promptly;
(d) regulatory requirements applicable to insurance data, including HIPAA, CTDPA, and the NAIC Insurance Data Security Model Law; and
(e) Clearpoint's internal security policies and procedures, including acceptable use policies and data classification standards.
Clearpoint shall maintain records of training completion and shall make such records available to Quorum upon reasonable request. New employees and contractors shall complete security awareness training within thirty (30) days of commencing their engagement.
8.2 Confidentiality Obligations. All Clearpoint employees and contractors with access to Customer Data shall be bound by written confidentiality obligations no less protective than those set forth in the Agreement, including the confidentiality and non-disclosure provisions of the Agreement. Such obligations shall survive the termination of the individual's employment or contractual engagement with Clearpoint.
8.3 Specialized Training. In addition to the general security awareness training described in Section 8.1, Clearpoint personnel who handle PII or PHI related to Quorum's workers' compensation lines of business shall receive training specific to the requirements of the HIPAA Privacy Rule and Security Rule, including the proper handling, use, and disclosure of PHI, minimum necessary standards, and individual rights under HIPAA. Such specialized training shall be provided upon initial assignment and at least annually thereafter.
9. INSURANCE REQUIREMENTS
9.1 Required Coverages. Throughout the Term of the Agreement, Clearpoint shall obtain and maintain the following insurance coverages with financially sound and reputable insurers rated no lower than "A-" (Excellent) by A.M. Best Company:
(a) Commercial General Liability ("CGL") Insurance: Not less than Five Million Dollars ($5,000,000) per occurrence and Ten Million Dollars ($10,000,000) in the aggregate, covering bodily injury, property damage, personal injury, and advertising injury arising out of Clearpoint's operations.
(b) Technology Errors & Omissions / Cyber Liability Insurance: Not less than Ten Million Dollars ($10,000,000) per claim and Twenty Million Dollars ($20,000,000) in the aggregate, covering claims arising from technology errors and omissions, data breaches, network security failures, unauthorized access to or disclosure of data, and privacy-related liabilities. Such coverage shall include, at a minimum, coverage for notification costs, credit monitoring, crisis management, regulatory defense and penalties (to the extent insurable), and media liability.
(c) Workers' Compensation Insurance: At statutory limits as required by applicable law in each jurisdiction in which Clearpoint operates, including employer's liability coverage with limits of not less than One Million Dollars ($1,000,000) per accident.
9.2 Insurance Carrier. As of the Effective Date, Clearpoint's current carrier for the coverages described in Section 9.1(a) and Section 9.1(b) is Northern Ridge Mutual Insurance Company. Clearpoint shall notify Quorum in writing at least thirty (30) days prior to any material change in carrier, coverage limits, policy terms, or conditions, including any cancellation, non-renewal, or material reduction in coverage.
9.3 Certificates of Insurance. Clearpoint shall provide certificates of insurance evidencing the required coverages upon execution of the Agreement and annually thereafter upon each policy renewal, and promptly upon Quorum's reasonable request. Quorum Insurance Holdings Corp. shall be named as an additional insured on the CGL and Technology E&O/Cyber Liability insurance policies. All policies shall include a waiver of subrogation in favor of Quorum to the extent permitted by the applicable policy and applicable law. Each policy shall provide that the insurer will endeavor to provide Quorum with at least thirty (30) days' prior written notice of cancellation or material change.
9.4 No Limitation of Liability. Maintenance of the insurance coverages set forth in this Section 9 shall not limit, reduce, or otherwise affect Clearpoint's obligations or liabilities under the Agreement, including without limitation the indemnification obligations, limitation of liability provisions, and other risk allocation provisions set forth in the Agreement. The insurance requirements set forth herein represent minimum coverage levels and do not constitute a representation by either party that such coverages are adequate to cover all potential liabilities.
10. PHYSICAL SECURITY
10.1 Data Center Controls. Clearpoint shall ensure that data center facilities operated by Cobalt Cloud Infrastructure, Inc. or any other hosting subprocessor engaged in connection with the ClaimsIQ™ platform maintain physical security controls that are no less protective than the following minimum requirements:
(a) On-Site Security: 24/7 on-site security personnel, security patrols, or continuous remote monitoring by trained security personnel;
(b) Access Control Systems: Physical access control systems, including badge readers, biometric authentication (such as fingerprint or retinal scanning), and mantrap entries, restricting physical entry to authorized individuals only, with access permissions reviewed and updated regularly;
(c) Video Surveillance: Closed-circuit video surveillance covering all entry points, server rooms, and critical infrastructure areas, with recorded footage retained for a minimum period of ninety (90) days;
(d) Environmental Controls: Environmental protection systems, including fire detection and suppression systems (e.g., pre-action dry-pipe or clean-agent suppression), climate control systems (HVAC with redundancy), flood detection sensors, and uninterruptible power supply ("UPS") systems with backup generator capacity; and
(e) Visitor Management: Documented visitor management procedures requiring visitor identification, sign-in/sign-out, escort by authorized personnel at all times, and visitor logs retained for a minimum of ninety (90) days.
10.2 Clearpoint Office Facilities. Clearpoint shall maintain appropriate physical security measures at its own office facilities, including its principal office located at 200 South Wacker Drive, Suite 3100, Chicago, Illinois 60606, and any other locations where Customer Data may be accessed by Clearpoint personnel, to prevent unauthorized physical access to systems, devices, and materials containing or providing access to Customer Data. Such measures shall include, at a minimum, controlled entry to office spaces, locked workstations, clean-desk policies, and secure storage of physical media (if any) containing Customer Data.
11. SECURE DEVELOPMENT PRACTICES
11.1 Secure Software Development Lifecycle. Clearpoint shall maintain a documented secure software development lifecycle ("SDLC") for the ClaimsIQ™ platform that incorporates security at each phase of the development process. The SDLC shall include, at a minimum:
(a) Security Requirements Analysis: Identification and documentation of security requirements during the design phase of each development project or release;
(b) Secure Coding Standards: Adherence to secure coding standards and guidelines (e.g., OWASP Secure Coding Practices) by all development personnel;
(c) Code Reviews: Mandatory peer code reviews, with security-focused review of code changes affecting authentication, authorization, data handling, and encryption;
(d) Static Application Security Testing ("SAST"): Automated static analysis of source code to identify security vulnerabilities prior to deployment;
(e) Dynamic Application Security Testing ("DAST"): Automated dynamic testing of running applications to identify runtime vulnerabilities; and
(f) Pre-Release Security Assessments: Security assessments conducted prior to the release of new versions or significant updates to the ClaimsIQ™ platform, including review of SAST and DAST results and verification that identified vulnerabilities have been addressed.
11.2 Change Management. All changes to the ClaimsIQ™ platform that affect the processing, storage, or transmission of Customer Data shall be subject to documented change management procedures. Such procedures shall include, at a minimum, impact assessment (including security impact), approval by authorized personnel, testing in a non-production environment prior to deployment, and documented rollback capabilities to restore the prior version in the event of a failure or security issue. Emergency changes shall be subject to expedited review and retrospective documentation.
12. DATA DISPOSAL
12.1 Secure Disposal. Upon expiration or termination of the Agreement, and following the completion of the data export obligations set forth in Exhibit C (Data Processing Addendum) — specifically, the full export of Customer Data in ACORD XML and CSV formats within sixty (60) days of the effective date of expiration or termination — Clearpoint shall securely destroy all copies of Customer Data in its possession or control, including without limitation copies held by subprocessors, backup copies, archived copies, and copies in disaster recovery environments, within thirty (30) days of the completion of the data export process. For the avoidance of doubt, the thirty (30) day destruction period commences upon the later of (i) Quorum's written confirmation of successful receipt of the exported data, or (ii) the expiration of the sixty (60) day export period.
12.2 Destruction Methods. Destruction of Customer Data shall be performed using methods consistent with NIST Special Publication 800-88, Revision 1 (Guidelines for Media Sanitization) or equivalent industry-recognized standards, ensuring that Customer Data cannot be recovered, reconstructed, or otherwise retrieved by any means. For electronic media, acceptable methods include cryptographic erasure (destruction of encryption keys rendering the encrypted data unrecoverable), secure overwriting, degaussing, or physical destruction. For physical media (e.g., paper documents, if any), acceptable methods include cross-cut shredding or incineration.
12.3 Certification. Clearpoint shall provide Quorum with a written certification of destruction, signed by an authorized officer of Clearpoint, within five (5) business days following the completion of destruction. The certification shall confirm that all copies of Customer Data, including those held by subprocessors, have been destroyed in accordance with the requirements of this Section 12, and shall identify the destruction methods used and the date(s) of destruction.
13. COMPLIANCE WITH APPLICABLE LAWS
13.1 Clearpoint shall comply with all applicable federal, state, and local laws, rules, and regulations relating to data security and privacy in connection with its performance under the Agreement, including without limitation:
(a) the Connecticut Data Privacy Act, Conn. Gen. Stat. § 42-515 et seq. (the "CTDPA");
(b) the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), including the Privacy Rule, Security Rule, and Breach Notification Rule, to the extent applicable to Quorum's workers' compensation lines of business and to the extent that Clearpoint qualifies as a business associate (as defined in HIPAA) of Quorum;
(c) the NAIC Insurance Data Security Model Law (MDL-668) as adopted in the State of Connecticut (Conn. Gen. Stat. § 38a-38 et seq.);
(d) any other applicable insurance-industry-specific data security or privacy requirements in jurisdictions where Quorum operates, including without limitation the States of Connecticut, Texas, and Florida, and any regulations promulgated by the Connecticut Insurance Department, the Texas Department of Insurance, and the Florida Office of Insurance Regulation; and
(e) any other applicable data protection law, regulation, or regulatory guidance that applies to the processing of Customer Data by Clearpoint in connection with the ClaimsIQ™ platform.
13.2 In the event of a conflict between the requirements of this Exhibit D and any applicable law, rule, or regulation, the more protective standard shall apply to the extent that compliance with both is feasible; provided, however, that Clearpoint shall in all cases comply with mandatory legal requirements. If Clearpoint becomes aware that compliance with a specific provision of this Exhibit D would conflict with a mandatory legal requirement, Clearpoint shall promptly notify Quorum in writing and the parties shall cooperate in good faith to agree upon an alternative measure that satisfies both the intent of this Exhibit D and the applicable legal requirement.
14. MODIFICATIONS AND UPDATES
14.1 Updates to Security Requirements. Quorum may propose reasonable updates to the security requirements set forth in this Exhibit D from time to time to reflect changes in applicable law, regulatory guidance, industry standards, or the evolving threat landscape. Any such proposed updates shall be submitted to Clearpoint in writing. The parties shall negotiate any such updates in good faith and in a commercially reasonable manner. Material updates — including any updates that would require Clearpoint to implement new technologies, significantly modify existing infrastructure, or incur material additional costs — shall require mutual written agreement, documented as an amendment to the Agreement executed by authorized representatives of both parties. Notwithstanding the foregoing, updates required to comply with changes in applicable law shall be implemented by Clearpoint in a timely manner and shall not require Quorum's separate consent.
14.2 Clearpoint's Security Enhancements. Clearpoint shall not materially reduce the security measures applicable to Customer Data below the levels set forth in this Exhibit D, or below the levels in effect as of the Effective Date (whichever is more protective), without the prior written consent of Quorum. Clearpoint shall notify Quorum in writing of any material enhancements to its Security Program that affect the protection of Customer Data, including the adoption of new security technologies, the expansion of monitoring capabilities, or improvements to incident response procedures. Such notifications shall be provided within thirty (30) days of implementation of the enhancement.
15. SURVIVAL
15.1 The obligations set forth in this Exhibit D relating to the protection, disposal, and certification of destruction of Customer Data (including, without limitation, Sections 2, 6, 10, 12, and 13), and Quorum's audit rights under Section 5.3, shall survive any expiration or termination of the Agreement for a period of two (2) years or until Clearpoint has provided the certification of destruction of all Customer Data pursuant to Section 12.3, whichever is later. For the avoidance of doubt, Clearpoint's obligations with respect to any Customer Data remaining in its possession or control following expiration or termination of the Agreement shall continue in full force and effect until such data has been securely destroyed and certified as destroyed in accordance with this Exhibit D.
EXHIBIT ACKNOWLEDGMENT
This Exhibit D is incorporated into and forms an integral part of the Enterprise SaaS Subscription Agreement dated April 26, 2024, by and between Quorum Insurance Holdings Corp. and Clearpoint Analytics, Inc. By executing this Exhibit D (or by executing the Agreement to which this Exhibit D is attached), each party acknowledges that it has read, understands, and agrees to be bound by the terms and conditions set forth herein.
IN WITNESS WHEREOF, the parties have caused this Exhibit D to be executed by their duly authorized representatives as of the date set forth below.
QUORUM INSURANCE HOLDINGS CORP.
By: ________
Name: Patricia Okonkwo
Title: General Counsel
Date: ________
CLEARPOINT ANALYTICS, INC.
By: ________
Name: Anita Rajan
Title: CEO & Co-Founder
Date: ________
Exhibit D — Security Requirements — Page intentionally concludes here.

EXHIBIT D — SECURITY REQUIREMENTS

EXHIBIT ACKNOWLEDGMENT

QUORUM INSURANCE HOLDINGS CORP.

CLEARPOINT ANALYTICS, INC.

Record

Parties

Dates

Amounts