SUPPLEMENTAL DUE DILIGENCE REQUEST LIST

SUPPLEMENTAL DUE DILIGENCE REQUEST LIST
REGULATORY AND GOVERNMENT CONTRACTS
CONFIDENTIAL
CONFIDENTIAL — Subject to the Confidentiality / Non-Disclosure Agreement dated September 5, 2023, between Solara Digital Infrastructure LP and Cloudium Technologies plc. This document and all information contained herein are protected by the terms and conditions of such agreement and may not be disclosed, distributed, or reproduced, in whole or in part, without the prior written consent of Calderwood & Harkness LLP.
Date: October 15, 2023
Matter No.: 1041-00003
Right-click to update Table of Contents
INTRODUCTORY INSTRUCTIONS
This Supplemental Due Diligence Request List (this "Supplemental Request List") supplements the Preliminary Due Diligence Request List dated September 10, 2023 (the "Preliminary Request List"), previously delivered by Calderwood & Harkness LLP on behalf of Solara Digital Infrastructure LP ("Solara" or "Buyer") to Ridgeway Phelps & Sato LLP, counsel to Cloudium Technologies plc ("Cloudium" or the "Company"), in connection with the Proposed Transaction. This Supplemental Request List focuses specifically on regulatory compliance, government contracts, export controls, data localization, and related matters that have been identified through our preliminary review of data room materials and management discussions as requiring more detailed examination.
All documents and information responsive to this Supplemental Request List should be uploaded to the Thackeray Solutions virtual data room established for this transaction (the "Data Room"), access to which was granted to the Buyer and its advisors on September 18, 2023. We ask that responsive materials be organized in the Data Room by the numbered request items set forth below, to the extent practicable, and that a cover index be provided to both Ridgeway Phelps & Sato LLP and Calderwood & Harkness LLP upon completion of each upload.
Unless otherwise specified, the requests contained in this Supplemental Request List apply to Cloudium Technologies plc and all of its direct and indirect subsidiaries (collectively, the "Cloudium Group"), including without limitation:
(a) Cloudium Technologies UK Ltd. (Company No. 11287456), with approximately 1,200 employees located in London and Manchester, United Kingdom, reporting revenues of approximately £312,000,000 (approximately $390,000,000 at $1.25/£) for the fiscal year ended September 30, 2023;
(b) Cloudium Technologies India Pvt. Ltd., incorporated and registered in Bangalore, Karnataka, India, with approximately 2,400 employees; and
(c) Cloudium Solutions GmbH, registered in Berlin, Germany, with approximately 400 employees.
For the avoidance of doubt, the Cloudium Group maintains a global workforce of approximately 6,800 employees across its operations in the United States, United Kingdom, India, and Germany, and the requests herein are intended to capture information and materials pertaining to each of these jurisdictions and any other jurisdiction in which any member of the Cloudium Group conducts business, maintains operations, or has employees, contractors, or agents.
Unless otherwise indicated, the requests in this Supplemental Request List cover the past five (5) years (i.e., from October 15, 2018, to the present), or the period from formation of the applicable entity if shorter. Where a request seeks "copies," please provide complete, unredacted versions of the responsive documents. Where a request seeks information or a "description," please provide a narrative response with reasonable specificity, cross-referencing supporting documents where available. If any responsive document or information is subject to a claim of attorney-client privilege, work-product protection, or any other applicable privilege, please identify such document or information on a privilege log in accordance with the instructions set forth in the Closing Instructions below, rather than withholding it without notation.
We note that this Supplemental Request List is not intended to be exhaustive, and the Buyer reserves the right to submit additional or follow-up requests as the due diligence process continues. Nothing in this Supplemental Request List shall be deemed to limit or waive any rights of the Buyer under the Confidentiality / Non-Disclosure Agreement dated September 5, 2023, between Solara Digital Infrastructure LP and Cloudium Technologies plc (the "NDA"), or any other agreement between the parties.
SECTION I — GOVERNMENT CONTRACTS: GENERAL
The following requests relate to the Cloudium Group's contracts, arrangements, and relationships with governmental entities and agencies, and are designed to provide the Buyer with a comprehensive understanding of the government contracting footprint of the Cloudium Group.
Request 1. Please provide a complete list or schedule of all current and expired (within the past five years) contracts, task orders, blanket purchase agreements, indefinite-delivery/indefinite-quantity ("IDIQ") contracts, and other arrangements with any federal, state, local, or foreign governmental body or agency (each, a "Government Contract"), including for each such Government Contract the following information:
(a) contract number or identifier;
(b) the awarding governmental body or agency;
(c) a brief description of the products or services provided under such contract;
(d) the period of performance, including the base period and all option periods (indicating which option periods have been exercised and which remain unexercised);
(e) the total contract value (including the value of all exercised and unexercised options);
(f) the current annual recurring revenue ("ARR") or annual revenue attributable to each such contract; and
(g) the current status of each such contract (e.g., active, completed, terminated, expired, or in close-out).
Request 2. Please provide copies of all Government Contracts identified in response to Request 1 above, together with all amendments, modifications, change orders, option exercises, and any other supplemental documentation related thereto. Where a Government Contract consists of a base contract with multiple task orders or delivery orders, please provide the base contract and all associated task orders or delivery orders.
Request 3. Please provide a schedule of all pending proposals, bids, quotations, or responses to requests for proposals ("RFPs"), requests for information ("RFIs"), or requests for quotations ("RFQs") submitted to any governmental entity that have not yet been awarded or otherwise resolved as of the date of this Supplemental Request List. For each such pending proposal, bid, or quotation, please provide the following information:
(a) the solicitation number and issuing agency;
(b) a description of the products or services proposed;
(c) the estimated total contract value, if available;
(d) the anticipated award date; and
(e) the current status of the procurement process.
Request 4. Please provide a schedule of all subcontracts, teaming agreements, joint venture agreements, mentor-protégé agreements, or other arrangements under which any member of the Cloudium Group serves as a subcontractor or team member to a prime government contractor (each, a "Subcontract Arrangement"). For each Subcontract Arrangement, please identify:
(a) the prime contractor;
(b) the government end-user or agency;
(c) a brief description of the products or services provided by the Cloudium Group under the arrangement;
(d) the contract number or identifier of the prime contract, if known;
(e) the annual revenue attributable to the Cloudium Group under the arrangement; and
(f) the period of performance applicable to the Cloudium Group's participation.
Request 5. Please provide a schedule of all subcontracts, teaming agreements, or similar arrangements under which any member of the Cloudium Group acts as a prime contractor and engages subcontractors to perform work in connection with any Government Contract. For each such arrangement, please identify:
(a) the subcontractor;
(b) a description of the products or services provided by the subcontractor;
(c) the Government Contract under which the subcontract was issued;
(d) the subcontract value; and
(e) whether the subcontractor is a small business, small disadvantaged business, woman-owned small business, HUBZone small business, service-disabled veteran-owned small business, or other socioeconomic category that may be relevant for small business subcontracting plan compliance.
Request 6. Please provide a description of any organizational conflict of interest ("OCI") mitigation plans developed, implemented, or maintained by any member of the Cloudium Group, and copies of all OCI determinations, disclosures, or analyses made to or requested by any contracting officer or governmental agency. In addition, please describe:
(a) any instances in which any member of the Cloudium Group was determined to have an actual or potential OCI;
(b) the nature of any mitigation measures adopted (e.g., firewalls, recusals, divestitures);
(c) any instances in which an OCI resulted in the disqualification or exclusion of any member of the Cloudium Group from a procurement; and
(d) any pending OCI reviews or determinations.
SECTION II — GOVERNMENT CONTRACTS: KEY CUSTOMER RELATIONSHIPS
The following requests focus on specific government and government contractor customer relationships that have been identified through the preliminary due diligence process as material to the evaluation of the Proposed Transaction.
Request 7. Please provide detailed information regarding the Cloudium Group's contractual relationship with Aegis Federal Solutions Inc. ("Aegis Federal"), which has been identified in preliminary due diligence as a material government contractor customer of Cloudium. Specifically, please provide:
(a) Copies of the Master SaaS Agreement between Cloudium (or any subsidiary) and Aegis Federal, together with all amendments, addenda, statements of work, order forms, service level agreements, and any other ancillary agreements related to the provision of products or services by the Cloudium Group to Aegis Federal.
(b) Confirmation of the current ARR attributable to the Aegis Federal relationship. Based on preliminary information provided during the management presentation on October 2, 2023, we understand this figure to be approximately $84,000,000. Please confirm this figure or provide an updated figure, including a breakdown by product line, service offering, or statement of work, as applicable.
(c) Identification of any change of control provisions, consent requirements, notification obligations, or termination rights contained in any agreement with Aegis Federal that would be triggered by a change in ownership or control of Cloudium or any of its subsidiaries, including any provisions triggered by (i) a merger, consolidation, or sale of all or substantially all assets; (ii) the acquisition of a specified percentage of voting securities or equity interests; or (iii) a change in the composition of the board of directors or governing body. Please provide the specific contractual language of each such provision.
(d) A description of the current status of any pending contract renewals, option exercises, re-competitions, or renegotiations with Aegis Federal, including anticipated timelines and any material terms under discussion.
(e) A description of the government end-customer(s) served by Cloudium through Aegis Federal. We understand from preliminary information that Aegis Federal is a US government contractor. Please identify the specific US government agency or agencies that are the ultimate end-users of Cloudium's products and services under this relationship, and describe the nature of the services provided to such end-users.
(f) Copies of any correspondence, notices, or communications between any member of the Cloudium Group and Aegis Federal regarding potential changes in ownership of Cloudium, the Proposed Transaction, or any transaction-related matters, including any informal discussions or inquiries.
Request 8. Please identify any other government customer or government contractor customer of the Cloudium Group (other than Aegis Federal, addressed in Request 7 above) representing more than $10,000,000 in ARR as of the most recent measurement date. For each such customer, please provide information comparable to that requested in Request 7 above, including:
(a) copies of all material agreements;
(b) confirmation of current ARR;
(c) identification of change of control provisions, consent requirements, or termination rights;
(d) status of pending renewals or re-competitions;
(e) identification of the government end-user(s), if the customer is a government contractor rather than a government agency itself; and
(f) any transaction-related correspondence or communications.
Request 9. Please provide copies of all customer contracts (whether with government entities, government contractors, or commercial customers) containing "change of control" provisions that would be triggered by a change in ownership, merger, acquisition, or similar transaction involving Cloudium or any of its subsidiaries. In addition, please prepare and provide a summary chart or schedule identifying:
(a) the counterparty;
(b) the specific change of control trigger (e.g., merger, asset sale, change in voting control exceeding a specified threshold);
(c) the required action (e.g., prior written consent, advance notice, termination right);
(d) the applicable notice period or cure period, if any;
(e) any financial or operational consequences of failing to obtain consent or provide notice (e.g., termination, fee acceleration, penalty); and
(f) the current ARR attributable to each such contract.
We specifically request that the Master SaaS Agreement with Aegis Federal Solutions Inc. and any similar provisions in other material contracts be highlighted and given priority in the preparation of this summary chart.
SECTION III — FedRAMP AUTHORIZATION
The Buyer's evaluation of the Proposed Transaction requires a thorough understanding of the Cloudium Group's FedRAMP authorization status, given the significance of government cloud services to Cloudium's business and revenue base. The following requests are designed to provide that understanding.
Request 10. Please provide a comprehensive description of the Cloudium Group's current FedRAMP authorization status, including:
(a) Identification of all cloud service offerings ("CSOs") that have received FedRAMP authorization, whether in the form of a Provisional Authority to Operate ("P-ATO") issued by the Joint Authorization Board ("JAB") or an Agency Authority to Operate ("A-ATO") issued by a sponsoring federal agency.
(b) The FedRAMP authorization level (Low, Moderate, or High) for each CSO, together with a description of the security controls baseline applicable to each authorization level and any additional controls or enhancements beyond the baseline that have been implemented.
(c) Identification of the sponsoring federal agency for each A-ATO, and, if applicable, the JAB for any P-ATO, including the name and title of the authorizing official at such agency.
(d) The date of the most recent initial authorization or reauthorization for each CSO, and the date of the most recent continuous monitoring assessment conducted in accordance with FedRAMP requirements.
(e) Identification of the Third-Party Assessment Organization ("3PAO") that conducted the most recent security assessment for each CSO, including confirmation that such 3PAO is accredited by the American Association for Laboratory Accreditation (A2LA) as required by the FedRAMP program.
Request 11. Please provide copies of the following documents for each FedRAMP-authorized CSO:
(a) The System Security Plan ("SSP"), including all appendices and attachments;
(b) The most recent Security Assessment Report ("SAR") prepared by the 3PAO; and
(c) The current Plan of Action and Milestones ("POA&M"), identifying all open findings, the applicable risk level (Low, Moderate, High) for each finding, the planned remediation actions, and the expected completion dates.
Request 12. Please provide copies of all FedRAMP Annual Assessment reports and continuous monitoring deliverables for the past three (3) years, including monthly and quarterly deliverables such as vulnerability scan results, POA&M updates, incident reports, and significant change notifications submitted to the sponsoring agency and/or the FedRAMP Program Management Office ("PMO").
Request 13. Please provide copies of any corrective action plans, significant change requests, or deviation requests submitted by any member of the Cloudium Group to the FedRAMP PMO or any sponsoring agency, together with all related correspondence, approvals, denials, or other responsive communications from the PMO or agency.
Request 14. Please describe any pending or planned FedRAMP authorization applications for new or modified cloud service offerings, including:
(a) a description of the CSO for which authorization is being sought;
(b) the targeted authorization level (Low, Moderate, or High);
(c) the anticipated sponsoring agency or, if pursuing a JAB P-ATO, the current status in the JAB prioritization queue;
(d) the estimated timeline for completing the authorization process; and
(e) any dependencies on the completion of the Proposed Transaction or potential impacts of the Proposed Transaction on the authorization timeline.
Request 15. Please provide an analysis, prepared by Cloudium's internal security and compliance team and/or outside counsel, of whether a change in ownership or control of Cloudium (including the Proposed Transaction) would affect any existing FedRAMP authorization or require:
(a) notification to the sponsoring agency, JAB, or FedRAMP PMO;
(b) re-assessment or re-authorization of any CSO;
(c) updates to any SSP, SAR, or POA&M to reflect changes in organizational structure, ownership, or governance;
(d) modification of any continuous monitoring arrangements; or
(e) any other action under FedRAMP program requirements, including the FedRAMP Authorization Act (codified at 44 U.S.C. § 3607 et seq.) and implementing guidance.
SECTION IV — ITAR / EAR AND EXPORT CONTROLS
The following requests relate to the Cloudium Group's compliance with US export control laws and regulations, including the International Traffic in Arms Regulations ("ITAR"), the Export Administration Regulations ("EAR"), and the sanctions programs administered by the Office of Foreign Assets Control ("OFAC"). Given the Cloudium Group's international operations, including significant employee populations in India and Germany, export control compliance is a critical area of diligence for the Proposed Transaction.
Request 16. Please provide a comprehensive description of the Cloudium Group's compliance program for the International Traffic in Arms Regulations (ITAR, 22 C.F.R. Parts 120–130) and the Export Administration Regulations (EAR, 15 C.F.R. Parts 730–774), including:
(a) Identification of any products, software, or technology developed, manufactured, distributed, or otherwise made available by any member of the Cloudium Group that are classified under the Commerce Control List ("CCL") set forth at 15 C.F.R. Part 774, Supplement No. 1, or the United States Munitions List ("USML") set forth at 22 C.F.R. Part 121.
(b) All Export Control Classification Numbers ("ECCNs") applicable to any Cloudium products, software, or technology, together with a description of the basis for each classification (e.g., self-classification, classification request to BIS, commodity jurisdiction determination from DDTC).
(c) Whether any Cloudium products, software, or technology are classified as EAR99 (i.e., subject to the EAR but not listed on the CCL), and, if so, a description of the controls applicable to exports of such items under the EAR.
(d) A description of the organizational structure and personnel responsible for managing export compliance within the Cloudium Group, including the identity and qualifications of the empowered official (if applicable under ITAR) and the export compliance officer or team.
Request 17. Please provide copies of all export licenses, license exceptions, agreements (including Technical Assistance Agreements and Manufacturing License Agreements), or other authorizations obtained by any member of the Cloudium Group from any of the following authorities within the past five (5) years:
(a) the Bureau of Industry and Security ("BIS") of the US Department of Commerce;
(b) the Directorate of Defense Trade Controls ("DDTC") of the US Department of State; and
(c) the Office of Foreign Assets Control ("OFAC") of the US Department of the Treasury.
For each such license, exception, agreement, or authorization, please indicate whether it is currently in effect, expired, revoked, or superseded, and identify any conditions or provisos attached thereto.
Request 18. Please provide copies of the Cloudium Group's written export compliance policies, procedures, and manuals, including:
(a) the export compliance management program ("ECMP") or equivalent policy document;
(b) any technology control plans ("TCPs") governing access to export-controlled technology by foreign nationals, visitors, or overseas facilities;
(c) end-use and end-user screening procedures;
(d) record-keeping and audit procedures for export transactions;
(e) training materials and records of training sessions provided to employees; and
(f) any internal audit or compliance review reports concerning export control compliance.
Request 19. Please provide a description of any voluntary self-disclosures ("VSDs") made by any member of the Cloudium Group to BIS, DDTC, or OFAC within the past five (5) years, including:
(a) the date of each VSD;
(b) a summary of the facts and circumstances giving rise to the disclosure;
(c) the agency to which the disclosure was made;
(d) copies of all correspondence between the Cloudium Group and the relevant agency regarding the VSD, including initial submissions, supplemental submissions, agency acknowledgment letters, requests for additional information, and final determinations; and
(e) copies of any consent agreements, penalty notices, warning letters, or other dispositions issued by the agency.
Request 20. Please provide a description of any pending or threatened investigations, enforcement actions, inquiries, or proceedings by BIS, DDTC, OFAC, or any other export control or sanctions authority (whether US or foreign) involving any member of the Cloudium Group, any current or former officer, director, or employee of any member of the Cloudium Group, or any agent or representative acting on behalf of any member of the Cloudium Group. For each such matter, please describe:
(a) the nature and scope of the investigation, enforcement action, or inquiry;
(b) the agency or authority conducting the investigation;
(c) the current status of the matter;
(d) the potential exposure or penalties, if known; and
(e) copies of all related correspondence, subpoenas, or requests for information.
Request 21. Please provide an analysis of whether any products, services, software, or technology of the Cloudium Group are provided, directly or indirectly, to:
(a) any country subject to comprehensive US sanctions, including Cuba, Iran, North Korea, Syria, or the Crimea, Donetsk, and Luhansk regions of Ukraine;
(b) any person or entity on the Specially Designated Nationals and blocked Persons List ("SDN List") maintained by OFAC;
(c) any person or entity on the Entity List maintained by BIS (15 C.F.R. Part 744, Supplement No. 4);
(d) any person or entity on the Denied Persons List maintained by BIS; or
(e) any person or entity on the Unverified List maintained by BIS (15 C.F.R. Part 744, Supplement No. 6), or any other restricted party list maintained by a US government agency.
Please describe the screening tools and processes used by the Cloudium Group to identify and prevent transactions with sanctioned or restricted parties, and the frequency with which customer, vendor, and partner databases are rescreened against updated sanctions lists.
Request 22. Please provide a description of deemed export controls applicable to the Cloudium Group's operations, with particular focus on:
(a) access by foreign-national employees to controlled technology or source code at any Cloudium Group facility, including the US headquarters in San Francisco and any other US offices;
(b) access by employees of Cloudium Technologies India Pvt. Ltd. in Bangalore, India, to technology controlled under the EAR, including any technology subject to national security, anti-terrorism, or regional stability controls;
(c) access by employees of Cloudium Solutions GmbH in Berlin, Germany, to technology controlled under the EAR;
(d) any deemed export licenses obtained by the Cloudium Group to authorize such access; and
(e) any technology control plans or physical, logical, or administrative access controls implemented to manage deemed export risk.
SECTION V — DATA PRIVACY, DATA PROTECTION, AND DATA LOCALIZATION
Given the nature of Cloudium's cloud-based enterprise software business and its operations across multiple jurisdictions with distinct data protection regimes, the following requests are designed to provide a comprehensive view of the Cloudium Group's data privacy, data protection, and data localization obligations and compliance posture.
Request 23. Please provide a description of all personal data and customer data processed, stored, or transmitted by any member of the Cloudium Group, organized by:
(a) jurisdiction of data collection and/or processing;
(b) data subject category (e.g., employees, customers, end-users of customer systems, prospects, website visitors);
(c) categories of personal data processed (e.g., names, contact information, financial data, health data, biometric data, geolocation data, device identifiers);
(d) the legal basis for processing under applicable law (e.g., consent, legitimate interest, contractual necessity, legal obligation); and
(e) the volume of data subjects in each category, to the extent reasonably determinable.
Request 24. Please provide copies of the Cloudium Group's data privacy and protection policies applicable to each jurisdiction of operation, including:
(a) the external-facing privacy policy or privacy notice published on each Cloudium website or application;
(b) internal data protection policies and procedures applicable to employees;
(c) data retention and deletion policies;
(d) cookie policies and consent management procedures; and
(e) any data protection impact assessments ("DPIAs") or privacy impact assessments ("PIAs") conducted within the past three (3) years.
Request 25. Please provide a description of the Cloudium Group's compliance with each of the following data protection and privacy laws and regulations:
(a) EU General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679, as applicable to Cloudium Solutions GmbH and to any processing of personal data of individuals located in the European Economic Area by other members of the Cloudium Group. Please describe the Data Protection Officer ("DPO") appointed by Cloudium Solutions GmbH (or the Cloudium Group as a whole), the GDPR compliance program, records of processing activities maintained under Article 30, and any data protection authority registrations or filings.
(b) UK Data Protection Act 2018 and UK GDPR — as applicable to Cloudium Technologies UK Ltd. and to any processing of personal data of individuals located in the United Kingdom by other members of the Cloudium Group. We note that following Brexit, the UK operates under a separate but substantially similar data protection regime, and we request confirmation of the steps taken by the Cloudium Group to ensure compliance with both the EU GDPR and the UK GDPR, including any separate UK representative appointments, registration with the Information Commissioner's Office ("ICO"), and reliance on the UK International Data Transfer Agreement or UK Addendum to the EU SCCs.
(c) California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) — as applicable to the Cloudium Group's US operations and any processing of personal information of California residents. Please describe compliance measures, including consumer rights mechanisms, "Do Not Sell or Share My Personal Information" processes, and any data processing agreements required under the CPRA.
(d) India's Digital Personal Data Protection Act, 2023 — as applicable to Cloudium Technologies India Pvt. Ltd. and any processing of digital personal data of individuals located in India. Please describe the Cloudium Group's assessment of its obligations under this recently enacted legislation, including the appointment of a Data Protection Officer (as required under the Act), consent mechanisms, and any data localization requirements.
(e) Sector-Specific Data Protection Requirements — Please describe any sector-specific data protection requirements applicable to the Cloudium Group's customer base, including but not limited to the Health Insurance Portability and Accountability Act ("HIPAA"), the Gramm-Leach-Bliley Act ("GLBA"), the Family Educational Rights and Privacy Act ("FERPA"), the Payment Card Industry Data Security Standard ("PCI DSS"), and any other applicable industry standards or regulations. For each, please describe the nature of the obligation, the customers or contracts to which it relates, and the Cloudium Group's compliance measures.
Request 26. Please provide copies of all Data Processing Agreements ("DPAs"), Data Processing Addenda, or similar agreements entered into by any member of the Cloudium Group with customers, vendors, or other third parties. In addition, please provide copies of all Standard Contractual Clauses ("SCCs") — whether EU SCCs adopted pursuant to Commission Implementing Decision (EU) 2021/914 or UK SCCs — or other cross-border data transfer mechanisms (e.g., Binding Corporate Rules, transfer impact assessments, adequacy decisions relied upon) currently in place to facilitate the international transfer of personal data within the Cloudium Group or between the Cloudium Group and third parties.
Request 27. Please provide a description of data localization requirements applicable to the Cloudium Group's operations in each jurisdiction, including:
(a) Government Contract Data Residency Requirements: Any data residency or data sovereignty requirements imposed by or arising under Government Contracts, particularly US federal contracts, including requirements that government data be processed or stored only within the territorial boundaries of the United States or in FedRAMP-authorized cloud environments located in the continental United States.
(b) EU/UK Data Localization Considerations: Any restrictions on the transfer of personal data outside of the European Economic Area or the United Kingdom, including the adequacy determinations relied upon, the transfer mechanisms employed (e.g., SCCs, Binding Corporate Rules), and any supplementary measures implemented in accordance with the European Data Protection Board's Recommendations 01/2020 or equivalent UK ICO guidance.
(c) India Data Localization Requirements: Any data localization requirements applicable under Indian law, including requirements under the Digital Personal Data Protection Act, 2023, guidelines issued by the Reserve Bank of India ("RBI") regarding storage of payment data within India, and any other sector-specific localization mandates.
(d) Data Center and Cloud Hosting Inventory: A complete list of all data centers and cloud hosting environments utilized by any member of the Cloudium Group, identifying for each (i) the hosting provider (e.g., Meridian Technologies, Crestline Systems, Aldermere Technologies, or proprietary data centers), (ii) the geographic location (city and country), (iii) the types of data processed or stored at such location, and (iv) any relevant certifications (e.g., ISO 27001, SOC 2, FedRAMP).
Request 28. Please provide a description of any data localization obligations that would be triggered, modified, or otherwise affected by a change of control of Cloudium or any restructuring of the Cloudium Group's ownership or corporate structure, including:
(a) any contractual data residency obligations that include restrictions on data access by new owners or affiliates;
(b) any regulatory requirements that would necessitate re-evaluation of cross-border data transfer mechanisms in light of a change in the Cloudium Group's ultimate parent entity or beneficial ownership;
(c) any government contract requirements that would restrict data access or processing by entities affiliated with the Buyer; and
(d) any potential impacts on data adequacy determinations or transfer mechanisms arising from the change in corporate structure.
Request 29. Please provide a description of all data breaches, security incidents, unauthorized access events, ransomware attacks, or other cybersecurity incidents experienced by any member of the Cloudium Group within the past five (5) years, including for each incident:
(a) the date of the incident and the date of discovery;
(b) the scope and nature of the affected data (e.g., number of data subjects affected, categories of personal data compromised);
(c) a description of the root cause or attack vector;
(d) the notification actions taken, including notifications to affected individuals, regulators, and law enforcement;
(e) copies of all breach notification letters or filings sent to regulators, including the UK Information Commissioner's Office ("ICO"), state attorneys general (in the United States), data protection authorities in the EU (e.g., the Berlin Commissioner for Data Protection and Freedom of Information for Cloudium Solutions GmbH), and any other applicable regulators;
(f) copies of any regulatory inquiries, orders, fines, penalties, or consent decrees issued in connection with any data security or privacy incident; and
(g) a description of remediation actions taken following each incident.
Request 30. Please provide copies of all third-party security audits, penetration test reports, and SOC 2 reports (both Type I and Type II) for each member of the Cloudium Group for the past three (3) years, including:
(a) the auditing or testing firm;
(b) the scope of the audit or test;
(c) the date of the report;
(d) any material findings, exceptions, or qualifications noted in the report; and
(e) management's response to any such findings.
In addition, please provide copies of any ISO 27001, ISO 27017, ISO 27018, HITRUST CSF, or other information security certifications or attestations held by any member of the Cloudium Group.
SECTION VI — TELECOMMUNICATIONS AND CLOUD INFRASTRUCTURE REGULATORY
Request 31. Please provide a description of any telecommunications licenses, authorizations, registrations, or permits held by any member of the Cloudium Group in any jurisdiction, including:
(a) any registrations with the Federal Communications Commission ("FCC") in the United States, including any interstate or international telecommunications carrier registrations;
(b) any authorizations or registrations with the Office of Communications ("Ofcom") in the United Kingdom;
(c) any registrations or notifications with the Federal Network Agency (Bundesnetzagentur, "BNetzA") in Germany; and
(d) any telecommunications or Internet service provider licenses or registrations in India, including any licenses issued by the Department of Telecommunications ("DoT") or the Telecom Regulatory Authority of India ("TRAI").
For each such license, authorization, or registration, please provide copies of the relevant documentation, the date of issuance, any renewal dates or expiration dates, and any conditions or obligations attached thereto.
Request 32. Please provide a description of any requirements under Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 ("NDAA") applicable to the Cloudium Group's Government Contracts, including:
(a) whether any member of the Cloudium Group uses, or has used, any covered telecommunications equipment or services from prohibited vendors (including Huawei Technologies Company, ZTE Corporation, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company, or any subsidiary or affiliate of such entities) in any system, component, or service provided to the US government or used in the performance of any Government Contract;
(b) copies of any representations, certifications, or disclosures submitted by any member of the Cloudium Group regarding Section 889 compliance, including FAR 52.204-24 (Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment) and FAR 52.204-25 (Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment);
(c) a description of any supply chain risk management processes implemented to ensure ongoing compliance with Section 889; and
(d) a description of any waivers, exemptions, or exceptions obtained or applied for under Section 889(d) of the NDAA.
Request 33. Please provide a description of any critical infrastructure designations, essential service provider obligations, or similar requirements applicable to the Cloudium Group's cloud hosting operations or data center infrastructure in any jurisdiction, including:
(a) any designation as critical infrastructure under Presidential Policy Directive 21 (PPD-21) or Executive Order 13636, or any obligations under the Cybersecurity and Infrastructure Security Agency ("CISA") guidelines in the United States;
(b) any designation as an operator of essential services ("OES") or a digital service provider ("DSP") under the EU Network and Information Security Directive (NIS Directive) or the NIS2 Directive (Directive (EU) 2022/2555), as applicable to Cloudium Solutions GmbH;
(c) any designation under the UK Network and Information Systems Regulations 2018 (SI 2018/506) as applicable to Cloudium Technologies UK Ltd.; and
(d) any similar designations or obligations in India.
SECTION VII — ANTI-CORRUPTION AND ANTI-BRIBERY
The following requests relate to the Cloudium Group's compliance with applicable anti-corruption and anti-bribery laws, including the US Foreign Corrupt Practices Act ("FCPA"), the UK Bribery Act 2010, and equivalent laws in other jurisdictions of operation.
Request 34. Please provide a comprehensive description of the Cloudium Group's anti-corruption and anti-bribery compliance program, including:
(a) copies of all written anti-corruption and anti-bribery policies and procedures, including any global compliance policy, gift and entertainment policy, travel and hospitality policy, and charitable contributions and political donations policy;
(b) a description of the training programs provided to officers, directors, employees, and agents on anti-corruption and anti-bribery compliance, including the frequency of such training, the content covered, and the percentage of relevant personnel who have completed training;
(c) identification of the compliance officer, Chief Ethics and Compliance Officer, or other individual or team responsible for the administration and oversight of the Cloudium Group's anti-corruption compliance program;
(d) a description of the reporting mechanisms available to employees and third parties to report suspected violations of anti-corruption laws, including any whistleblower hotline, ethics helpline, or anonymous reporting channel;
(e) a description of the internal audit or monitoring processes used to assess the effectiveness of the anti-corruption compliance program; and
(f) copies of any third-party assessments or certifications of the anti-corruption compliance program (e.g., ISO 37001 certification for anti-bribery management systems).
Request 35. Please provide a description of all payments, gifts, entertainment, travel, hospitality, charitable contributions, political donations, or other things of value provided by any member of the Cloudium Group, or by any agent, consultant, or representative acting on behalf of any member of the Cloudium Group, to any foreign government official (or family member of such official), any domestic government official, or any officer or employee of a state-owned or state-controlled enterprise, within the past five (5) years. This description should include the identity of the recipient (to the extent disclosable), the amount and nature of the payment or benefit, the business purpose, and the approval process followed.
Request 36. Please provide a description of all third-party agents, consultants, distributors, intermediaries, joint venture partners, or other representatives used by any member of the Cloudium Group in connection with government-facing activities, business development, or sales to government entities or state-owned enterprises. For each such third party, please provide:
(a) the identity and jurisdiction of the third party;
(b) a description of the services provided;
(c) the compensation arrangement (e.g., flat fee, commission, success fee);
(d) the duration of the engagement;
(e) copies of all due diligence performed on such third party prior to and during the engagement, including background checks, compliance questionnaires, and risk assessments; and
(f) copies of the governing agreement, including any anti-corruption representations, warranties, and compliance provisions.
Request 37. Please provide a description of any internal investigations, audits, voluntary self-disclosures, or government inquiries related to potential violations of the FCPA, the UK Bribery Act 2010, the German Criminal Code (Strafgesetzbuch) provisions on bribery, the India Prevention of Corruption Act, 1988, or any other anti-corruption law, involving any member of the Cloudium Group or any current or former officer, director, employee, agent, or representative of any member of the Cloudium Group, within the past five (5) years. For each such matter, please describe:
(a) the nature and scope of the investigation or inquiry;
(b) the date of initiation and current status;
(c) the governmental authority or internal function conducting the investigation;
(d) any findings, conclusions, or remedial actions; and
(e) any financial or operational impact.
Request 38. Please provide copies of any correspondence, subpoenas, civil investigative demands, requests for information, or other communications received by any member of the Cloudium Group from the US Department of Justice ("DOJ"), the US Securities and Exchange Commission ("SEC"), the UK Serious Fraud Office ("SFO"), or any other governmental authority in connection with any anti-corruption investigation or inquiry, within the past five (5) years.
SECTION VIII — ANTITRUST AND COMPETITION LAW COMPLIANCE
The following requests relate to the Cloudium Group's compliance with antitrust and competition laws and are critical to the assessment of regulatory risk associated with the Proposed Transaction. Coordination on this section will be conducted with Elaine Forsythe, Specialist Partner, Antitrust & Competition, at Calderwood & Harkness LLP (1601 K Street NW, Washington, DC 20006), and with Fiona McAllister at Albright & Kerr LLP (5 New Street Square, London EC4A 3TW), who is advising on UK competition matters.
Request 39. Please provide a description of any antitrust or competition law investigations, proceedings, inquiries, or examinations involving any member of the Cloudium Group or any current or former officer or director in the past five (5) years, including investigations, proceedings, or inquiries by any of the following authorities:
(a) the US Federal Trade Commission ("FTC");
(b) the Antitrust Division of the US Department of Justice;
(c) the European Commission Directorate-General for Competition ("DG Competition");
(d) the UK Competition and Markets Authority ("CMA");
(e) the German Federal Cartel Office (Bundeskartellamt); and
(f) the Competition Commission of India ("CCI").
For each such matter, please provide a description of the nature of the investigation or proceeding, the parties involved, the relevant market(s), the current status, and the potential or actual outcome.
Request 40. Please provide copies of any civil investigative demands ("CIDs"), subpoenas, requests for information, questionnaires, or other compulsory or voluntary requests received by any member of the Cloudium Group from any antitrust or competition authority within the past five (5) years, together with copies of all responses submitted.
Request 41. Please provide copies of any consent orders, consent decrees, settlement agreements, commitments, undertakings, or compliance obligations arising from any antitrust or competition law proceedings involving any member of the Cloudium Group, including:
(a) the terms and conditions of any such order, decree, agreement, commitment, or undertaking;
(b) the compliance monitoring mechanisms in place;
(c) the expiration date or term of any such obligation; and
(d) any reports or communications with the relevant authority regarding compliance.
Request 42. Please provide a description of the Cloudium Group's antitrust and competition law compliance program, including:
(a) copies of written antitrust and competition law compliance policies;
(b) a description of training programs provided to officers, directors, employees, and sales personnel on antitrust and competition law compliance, including the frequency and content of such training;
(c) a description of any monitoring, auditing, or self-assessment processes used to evaluate compliance; and
(d) copies of any guidelines or protocols governing interactions with competitors, trade associations, or industry groups.
Request 43. Please provide an analysis of competitive overlaps between the Cloudium Group's cloud-native enterprise resource planning ("ERP"), customer relationship management ("CRM"), and business-intelligence software-as-a-service ("SaaS") solutions and any product, service, or platform offered by any portfolio company currently owned or controlled by Solara Digital Infrastructure LP or any of its affiliated funds. This analysis should identify:
(a) the relevant product markets and geographic markets in which such overlaps exist;
(b) the market shares of the Cloudium Group and the relevant Solara portfolio company in each overlapping market, to the extent available;
(c) the identity and market shares of the principal competitors in each overlapping market;
(d) any vertical relationships between the Cloudium Group and any Solara portfolio company (e.g., supplier-customer relationships); and
(e) any potential theories of competitive harm that might be raised by the FTC, DOJ, CMA, European Commission, or other competition authority in connection with the Proposed Transaction.
This analysis should be prepared in coordination with Elaine Forsythe at Calderwood & Harkness LLP and the deal team at Osprey Bancroft & Co. (financial advisor to Solara), and should be treated as attorney work product and attorney-client privileged communication.
SECTION IX — INDUSTRY-SPECIFIC REGULATORY COMPLIANCE
Request 44. Please provide a description of all regulatory licenses, permits, registrations, or authorizations required for the conduct of the Cloudium Group's business operations in any jurisdiction, including but not limited to business licenses, professional services licenses, software or technology export licenses, and any industry-specific licenses or approvals. For each such license, permit, registration, or authorization, please provide:
(a) the issuing authority;
(b) the date of issuance and expiration or renewal date;
(c) a description of the activity or operations authorized;
(d) any conditions or restrictions; and
(e) copies of the relevant documentation.
Request 45. Please provide a description of any ongoing, pending, or anticipated regulatory examinations, audits, reviews, or inspections by any industry regulator applicable to any member of the Cloudium Group, including the nature of the examination, the regulator conducting it, the anticipated timeline, and any preliminary findings or concerns raised.
Request 46. With respect to financial-services customers of the Cloudium Group, please provide a description of any regulatory requirements imposed on the Cloudium Group as a technology service provider, software vendor, or cloud service provider to financial institutions, including:
(a) any obligations arising under guidance from the Office of the Comptroller of the Currency ("OCC"), the Federal Deposit Insurance Corporation ("FDIC"), the Board of Governors of the Federal Reserve System, or other US federal or state banking regulators regarding third-party risk management, outsourcing, or technology service provider oversight;
(b) any requirements arising under the European Banking Authority ("EBA") Guidelines on Outsourcing Arrangements (EBA/GL/2019/02) or the Digital Operational Resilience Act ("DORA") (Regulation (EU) 2022/2554), as applicable to the Cloudium Group's European financial institution customers;
(c) any "right to audit" clauses in contracts with financial institution customers that may give regulators access to the Cloudium Group's systems, facilities, or records;
(d) any regulatory examinations of the Cloudium Group conducted by or on behalf of financial institution regulators; and
(e) any service organization control reports (SOC 1, SOC 2) prepared specifically for financial institution customers.
Request 47. With respect to healthcare customers of the Cloudium Group, please provide:
(a) a description of all HIPAA Business Associate Agreements ("BAAs") in place between any member of the Cloudium Group and any covered entity or business associate, together with copies of a representative sample of such BAAs;
(b) a description of the Cloudium Group's HITRUST Common Security Framework ("CSF") certification status, including the scope of certification, the date of the most recent certification or assessment, and any findings or corrective actions;
(c) a description of the administrative, physical, and technical safeguards implemented by the Cloudium Group to comply with the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C); and
(d) a description of any HIPAA breach notifications, investigations, or compliance reviews involving the Cloudium Group within the past five (5) years.
Request 48. Please provide a description of any environmental, health, and safety ("EH&S") regulatory compliance matters applicable to the Cloudium Group's data center operations, office facilities, or other physical infrastructure, including:
(a) any environmental permits or authorizations held by the Cloudium Group;
(b) any pending or threatened environmental enforcement actions, violations, or remediation obligations;
(c) any hazardous materials management or disposal activities associated with data center equipment (e.g., batteries, diesel generators, cooling systems);
(d) any energy efficiency or sustainability reporting requirements applicable to data center operations; and
(e) any occupational health and safety citations, investigations, or compliance orders.
SECTION X — GOVERNMENT INVESTIGATIONS AND ENFORCEMENT ACTIONS
Request 49. Please provide a description of all pending or threatened government investigations, enforcement actions, proceedings, or inquiries involving any member of the Cloudium Group, or any current or former officer, director, or employee of any member of the Cloudium Group (in their capacity as such), by any governmental authority, in the past five (5) years. For each such matter, please describe:
(a) the governmental authority conducting the investigation or proceeding;
(b) the nature and subject matter of the investigation or proceeding;
(c) the date of initiation and current status;
(d) the identity of any individual officers, directors, or employees who are subjects or targets of the investigation;
(e) the potential exposure or penalties, if known;
(f) any impact on the Cloudium Group's operations, contracts, or regulatory status; and
(g) the identity of outside counsel representing the Cloudium Group in connection with such matter.
Request 50. Please provide copies of all subpoenas, civil investigative demands, information requests, document requests, interrogatories, or similar compulsory process received by any member of the Cloudium Group from any governmental body or agency within the past five (5) years, together with copies of all responses, objections, or correspondence related thereto.
Request 51. Please provide a description of all voluntary disclosures made by any member of the Cloudium Group to any governmental authority within the past five (5) years, including:
(a) the date and recipient of each disclosure;
(b) the subject matter and factual basis for the disclosure;
(c) the current status of the matter following the disclosure; and
(d) any resulting investigations, enforcement actions, or settlements.
Request 52. Please provide copies of all consent orders, consent decrees, deferred prosecution agreements ("DPAs"), non-prosecution agreements ("NPAs"), settlement agreements, corporate integrity agreements, monitoring agreements, compliance agreements, or similar dispositions entered into by any member of the Cloudium Group with any governmental body or agency within the past five (5) years, together with:
(a) a description of the underlying facts and circumstances;
(b) the terms and duration of any ongoing compliance obligations;
(c) any reports filed with the relevant authority regarding compliance with such agreements; and
(d) the anticipated date of termination or expiration of such agreements.
Request 53. Please provide a description of any debarment, suspension, or exclusion of any member of the Cloudium Group from government contracting, or any proposed debarment, suspension, or exclusion proceedings, under:
(a) FAR Subpart 9.4 (Debarment, Suspension, and Ineligibility);
(b) any equivalent state or local debarment or suspension rules;
(c) any equivalent foreign government debarment or exclusion rules; or
(d) any voluntary exclusion or agreement not to participate in government contracting.
In addition, please confirm whether any member of the Cloudium Group, or any current or former officer, director, or principal of any member of the Cloudium Group, is listed in the System for Award Management ("SAM.gov") Exclusions database or any similar government exclusion list.
SECTION XI — CHANGE OF CONTROL AND REGULATORY NOTIFICATIONS
The following requests are critical to the Buyer's assessment of the regulatory approvals and notifications required in connection with the Proposed Transaction and the anticipated timeline for obtaining such approvals.
Request 54. Please provide, or cooperate in the preparation of, a comprehensive analysis of all regulatory filings, notifications, consents, approvals, or clearances required in connection with a change of control of Cloudium, including without limitation:
United States:
(a) HSR Act Pre-Merger Notification: Analysis of the obligation to file a pre-merger notification under the Hart-Scott-Rodino Antitrust Improvements Act of 1976, as amended ("HSR Act"), with the Federal Trade Commission ("FTC") and the Antitrust Division of the Department of Justice ("DOJ"), including the applicable filing threshold, the size-of-person test, and the anticipated waiting period (initial 30-day period and the possibility of a Second Request).
(b) CFIUS Considerations: Analysis of whether the Proposed Transaction may be subject to review by the Committee on Foreign Investment in the United States ("CFIUS") under Section 721 of the Defense Production Act of 1950, as amended, and the implementing regulations at 31 C.F.R. Parts 800 and 802, including whether the transaction constitutes a "covered transaction" or a "covered real estate transaction," and whether a mandatory declaration may be required due to Cloudium's involvement with critical technology, critical infrastructure, or sensitive personal data related to US government personnel.
(c) Sector-Specific Notifications: Analysis of any sector-specific regulatory notifications or approvals required in the United States (e.g., FCC approval under Section 310(d) of the Communications Act, if applicable; notifications to sponsoring agencies under FedRAMP; novation requirements under FAR 42.12).
United Kingdom:
(d) CMA Merger Notification Requirements: Analysis of the CMA's jurisdiction to review the Proposed Transaction under the Enterprise Act 2002, including the share of supply test and the turnover test, and a recommendation regarding the filing strategy (voluntary pre-notification, formal notification, or no notification).
(e) UK National Security and Investment Act 2021: Analysis of whether the Proposed Transaction may trigger a mandatory notification or a call-in notice under the UK National Security and Investment Act 2021 ("NSI Act"), given the Cloudium Group's involvement in cloud computing, data infrastructure, and potentially defense-related services.
European Union:
(f) EU Merger Regulation: Jurisdictional analysis under Council Regulation (EC) No. 139/2004 (the "EUMR"), including the Community-dimension turnover thresholds and the Article 4(5) referral mechanism, to determine whether a notification to the European Commission is required or whether the transaction falls within the jurisdiction of one or more Member State competition authorities.
(g) EU Foreign Subsidies Regulation: Analysis of notification obligations under Regulation (EU) 2022/2560 (the "Foreign Subsidies Regulation" or "FSR"), including whether the Proposed Transaction exceeds the notification thresholds (concentration value of EUR 500 million and aggregate financial contributions from third-country governments of EUR 50 million over the prior three years).
Germany:
(h) German FDI Screening: Analysis of whether the acquisition of Cloudium Solutions GmbH (as a German subsidiary) may be subject to foreign direct investment screening under the German Foreign Trade and Payments Act (Außenwirtschaftsgesetz, "AWG") and the German Foreign Trade and Payments Regulation (Außenwirtschaftsverordnung, "AWV"), particularly given the Cloudium Group's activities in cloud computing and data processing, which may constitute critical infrastructure or a sector subject to cross-sectoral screening under Section 55 AWV.
India:
(i) Competition Commission of India (CCI) Notification: Analysis of the obligation to notify the Competition Commission of India ("CCI") under the Competition Act, 2002, including the applicable asset and turnover thresholds, the de minimis exemption, and the anticipated review timeline.
(j) FDI Approval for Downstream Change of Control: Analysis of whether the change of control of Cloudium Technologies India Pvt. Ltd. resulting from the Proposed Transaction requires approval from or notification to the Department for Promotion of Industry and Internal Trade ("DPIIT"), the Reserve Bank of India ("RBI"), or any other Indian governmental authority under applicable foreign direct investment ("FDI") policies, including the Consolidated FDI Policy and the Foreign Exchange Management (Non-debt Instruments) Rules, 2019.
Request 55. Please provide a description of all Government Contract clauses, provisions, or requirements that would require notification to, or consent from, a contracting officer, contracting agency, or other governmental authority in connection with a change of control, novation, or assignment of any Government Contract held by any member of the Cloudium Group. Please specifically address:
(a) the applicability of FAR 42.12 (Novation and Change-of-Name Agreements) and the procedures for re