Attachment E - APSIT 2025 Cyber Liability Insurance Policy.pdf

Alexandra Swift 399 Park Ave, Mezzanine New York, NY 10022

Marc Lysse AmWINS Insurance Brokerage, LLC

RE: State of Arkansas Public School System Policy Number: 1001213780251

Dear Marc, Enclosed please find an electronic copy of the above captioned policy. Please let me know if you would like the hard copies, as well.

Thank you for your business, and please do not hesitate to contact me with any questions or concerns.

Regards, Alexandra Swift

This contract is registered and delivered as a surplus lines coverage under the Surplus Line Insurance Law, and it may in some respects be different from contracts issued by insurers in the admitted markets, and, accordingly, it may, depending upon the circumstances, be more or less favorable to an insured than a contract from an admitted carrier might be. The protection of the

Arkansas Property and Casualty Guaranty Act does not apply to this contract. A tax of four percent (4%) is required to be collected from the insured on all surplus lines premiums.

Surplus Lines Licensee Name: Josh Ammons

Attachment E

SS PL 275001 CL (5/17)

Cyber Risk Response Policy

POLICY NUMBER: 1001213780251

RENEWAL OF: N/A

NOTICE: THIS POLICY CONTAINS COVERAGE SECTIONS WHICH MAY BE PURCHASED

SEPERATELY. CERTAIN COVERAGE SECTIONS ARE LIMITED TO LIABILITY FOR ONLY THOSE

CLAIMS THAT ARE FIRST MADE AGAINST THE INSUREDS DURING THE POLICY PERIOD AND

REPORTED IN WRITING TO THE INSURER PURSUANT TO THE TERMS HEREIN. UNDER SUCH

COVERAGE SECTIONS, THE LIMIT OF LIABILITY AVAILABLE TO PAY JUDGMENTS OR

SETTLEMENTS SHALL BE REDUCED BY AMOUNTS INCURRED FOR DEFENSE COSTS AND

AMOUNTS INCURRED FOR DEFENSE COSTS SHALL BE APPLIED AGAINST THE APPLICABLE

RETENTION AMOUNT.

PLEASE READ THIS POLICY CAREFULLY AND DISCUSS THE COVERAGE HEREUNDER WITH

YOUR INSURANCE AGENT OR BROKER.

DECLARATIONS

ITEM 1: NAMED INSURED: State of Arkansas Public School System ADDRESS: 1 Commerce Way, Suite 504

Little Rock, AR 72201-1904

ITEM 2: POLICY PERIOD: From: July 1, 2025 To: July 1, 2026 (12:01 a.m. Standard Time at the address stated in Item 1)

ITEM 3: LIMITS OF LIABILITY (INCLUSIVE OF DEFENSE COSTS)

A. $5,000,000 Aggregate Limit of Liability for each Policy Period

ITEM 4: INSURING AGREEMENT SUMMARY

Insuring Agreement Aggregate Sub-

Limit of Liability Retention Pending & Prior Date

A. Security & Privacy Liability

$ 1,000,000 Per Claim Per

Entity/$5,000,000 Aggregate $1,000,000 7/1/2025

B. Security & Privacy Incident Response Expenses

$ 1,000,000 Per Claim Per

Entity/$5,000,000 Aggregate $1,000,000 7/1/2025

C. Business Interruption Waiting Period: 24 hours

$ 1,000,000 Per Claim Per

Entity/$5,000,000 Aggregate $1,000,000 7/1/2025

D. Data Recovery

$ 1,000,000 Per Claim Per

Entity/$5,000,000 Aggregate $1,000,000 7/1/2025

SS PL 275001 CL (5/17)

E. Regulatory Proceedings

$ 1,000,000 Per Claim Per

Entity/$5,000,000 Aggregate $1,000,000 7/1/2025

F. Cyber Extortion

$ 1,000,000 Per Claim Per

Entity/$5,000,000 Aggregate $1,000,000 7/1/2025

DECLARATIONS (continued) POLICY NUMBER: 1001213780251

ITEM 5: PREMIUM: $89,794

ITEM 6: DISCOVERY PERIOD (applicable only to Insuring Agreements A and E)

A. One Year: 100 % of the premium set forth in Item 5 above

B. Two Years: Premium to be decided

ITEM 7: ADDRESS OF INSURER AND ITS AUTHORIZED CLAIMS AGENT FOR

NOTICES UNDER THIS POLICY

A. Claims-Related Notices (may be modified)

STARR ADJUSTMENT SERVICES, INC.

399 PARK AVENUE, 9TH FLOOR

NEW YORK, NY 10022

e-mail: StarrFLPLClaims@starrcompanies.com

B. All Other Notices To The Insurer:

STARR SURPLUS LINES INSURANCE COMPANY

ATTN: PROFESSIONAL LIABILITY DEPARTMENT

399 PARK AVE. 8TH FLOOR

NEW YORK, NY 10022

In Witness Whereof, the Insurer has caused this policy to be executed and attested. This policy shall not be valid unless countersigned by a duly authorized representative of the Insurer.

Nehemiah E. Ginsburg, General Counsel Steve Blakey, President and CEO

Arkansas Premium:

Fees:

Surplus Lines Tax:

$89,794.00

$500.00

$3,611.76

SS PL 275002 CL (5/17)

Cyber Risk Response Policy

In consideration of and subject to the payment of the premium and in reliance upon all information and documents contained in or submitted with the Application, which shall be deemed to be attached to and part of this policy, and further subject to all terms, conditions and other provisions in this policy, including endorsements hereto, Starr Surplus Lines Insurance Company (the “Insurer”) and the Named Insured, on behalf of all Insureds, agree as follows:

1. INSURING AGREEMENTS

A. Security & Privacy Liability

The Insurer shall pay on behalf of the Insured all Loss, in excess of the Retention, arising from a Claim first made during the Policy Period (or Discovery Period, if applicable) against such Insured for an actual or alleged Security Failure or Privacy Incident, and duly reported to the Insurer in accordance with Section 7 of this policy.

B. Security & Privacy Incident Response Expenses

The Insurer shall pay on behalf of the Company the Incident Response Expenses of the Company, in excess of the Retention, resulting from an actual or reasonably suspected Security Failure or Privacy Incident that is first discovered by the Insured during the Policy Period, and duly reported to the Insurer in accordance with Section 7 of this policy.

C. Business Interruption

The Insurer shall reimburse the Insured any Business Loss, in excess of the Retention and only after the specified Waiting Period has expired resulting from a Material Interruption incurred by the Insured directly as a result of a Security Failure which occurs during the Policy Period, and is duly reported to the Insurer in accordance with Section 7 of this policy.

D. Data Recovery

The Insurer shall reimburse the Insured for all Data Recovery Expenses, in excess of the Retention, the Insured incurs due to a Security Failure or Privacy Incident, provided that such Security Failure or Privacy Incident occurs during the Policy Period, and is duly reported to the Insurer in accordance with Section 7 of this policy.

E. Regulatory Proceedings

The Insurer shall pay on behalf of the Insured all Defense Costs and Penalties, in excess of the Retention, arising from a Regulatory Proceeding first made during the Policy Period (or Discovery Period, if applicable) against such Insured, resulting from an actual or alleged Security Failure or Privacy Incident by the Insured or any entity for whom the Insured is legally liable, and duly reported to the Insurer in accordance with Section 7 of this policy.

F. Cyber Extortion

The Insurer shall reimburse the Insured for all Extortion Costs, in excess of the Retention, paid by the Insured as a result of an Extortion Demand, provided that such Extortion Demand occurs during the Policy Period, and is duly reported to the Insurer in accordance with Section 7 of this policy.

2. DEFINITIONS

a) “Application” means all signed applications, including any attachments and other materials provided therewith or incorporated therein, submitted in connection with the underwriting of this policy or for any other policy of which this policy is a renewal, replacement or which it succeeds in time.

b) “Business Loss” means:

1. costs that would not have been incurred but for a Material Interruption;

2. the sum of all of following, which shall be calculated on an hourly basis:

a. Net Income (Net Profit or Loss before income taxes) that would have been earned; and

b. Continuing normal operating expenses incurred, including payroll, sustained by the Insured during the Period of Restoration, but only after the Waiting Period has expired

c) “Claim” means any:

1. written demand for monetary or non-monetary relief, or injunctive relief or services made against an Insured;

2. civil, judicial, administrative, or arbitral or regulatory proceeding for monetary relief commenced against an Insured, including any appeal therefrom, which is commenced by:

a. service of a complaint or similar pleading;

b. demand for or notice of arbitration; or

c. receipt or filing of a notice of charges;

3. with respect to coverage provided under Insuring Agreement 1.E. only, institution of a Regulatory Proceeding against any Insured; or

4. written request to toll or waive the applicable statute of limitations relating to a potential Claim against an Insured.

d) “Cleanup Costs” means expenses (including but not limited to legal and professional fees) incurred in testing for, monitoring, cleaning up, removing, containing, treating, neutralizing, detoxifying or assessing the effects of Pollutants.

e) “Company” means:

1. the Named Insured;

2. any Subsidiary of the Named Insured;

3. the Named Insured or any Subsidiary as a debtor, a debtor-in-possession or equivalent status;

and

f) “Computer System” means hardware, software, portable devices, peripheral devices, wireless and mobile devices, data storage, network equipment or electronic backup connected together through a network and under the care, custody or control of the Insured or a Third Party Computer System Service Provider.

g) “Cyberterrorism” means the premeditated use of disruptive activities against the Computer System by an individual or group of individuals, or the explicit threat by an individual or group of individuals to use such activities, with the intention to cause harm, further social, ideological, religious, political or similar objectives, or to intimidate any person(s) in furtherance of such objectives.

“Cyberterrorism” does not include Cyberwarfare. “Cyberwarfare” as used herein means actions by a nation-state to penetrate the Computer System for the purposes of causing damage or disruption.

h) “Data Recovery Expenses” means the reasonable and necessary fees, costs, charges or expenses, sustained with the prior written consent of the Insurer, such consent not be unreasonably withheld, resulting from a theft, loss, alteration, damage, deletion, or destruction of any electronic data or software which is under the care, custody or control of an Insured or for which an Insured is legally liable:

1. incurred to replace, restore, or recollect electronic data or software stored on the Computer System from written records or partially or fully matching data or software, including the capacity of the Computer System to store, process or transmit information; and

2. incurred to retain a third party computer security expert or forensic investigator to determine if electronic data or software can or cannot be replaced, restored or recollected; provided, however, that in the event that electronic data or software cannot be replaced, restored or recollected, Loss shall be limited to the reasonable and necessary fees, costs, charges or expenses incurred to reach this determination.

For the purposes of “Data Recovery Expenses” electronic data includes Private Information in an electronic or digitized format.

“Data Recovery Expenses” shall not include any salary or overhead expenses of the Insured.

i) “Defense Costs” means:

1. reasonable and necessary fees, costs, charges or expenses resulting from the investigation, defense or appeal of a Claim;

2. premium for an appeal, attachment or similar bond, but without any obligation to apply for and obtain such bond;

3. any fees, costs, charges or expenses incurred by the Insured at the specific request of the Insurer to assist the Insurer in the investigation, defense or appeal of a Claim.

“Defense Costs” does not include (i) amounts incurred prior to the date a Claim is first made and reported to the Insurer, pursuant to the terms of this policy, or (ii) compensation or benefits of any Insured Person or any overhead expenses of the Company.

j) “Executive Officer” means any person who is or was the Chief Executive Officer, Chief Financial Officer, Chief Security Officer, Chief Technology Officer, Chief Information Officer, Chief Information Security Officer, General Counsel, or Risk Manager of the Company or, with respect to a Subsidiary incorporated outside of the United States, the functional equivalent of such an officer.

k) “Extortion Costs” means:

1. reasonable and necessary costs sustained by the Company with the Insurer’s prior written consent, which shall not be unreasonably withheld, to utilize a computer security expert or a forensic investigator to determine who is responsible for an Extortion Demand; and

2. money, securities or other tangible or intangible property of value provided by the Company with the Insurer’s prior written consent, which shall not be unreasonably withheld, to a party responsible for an Extortion Demand for the purpose of terminating such Extortion Demand.

l) “Extortion Demand” means:

1. Privacy Extortion Demand; or

2. Security Extortion Demand

m) “Incident Response Expenses” means the reasonable and necessary expenses, sustained with the prior written consent of the Insurer, such consent shall not be unreasonably withheld:

1. to retain an attorney to advise the Company on minimizing the harm to such Company, including: (a) maintaining and restoring public confidence in such Company; (b) applicability of and actions necessary by the Company to comply with any Security & Privacy Law relating to an actual or suspected Security Failure or Privacy Incident; or (c) to determine whether the Insured has a right of indemnification from another party for an otherwise covered Loss;

2. to retain a computer security expert or a forensic investigator to determine the existence, cause and extent of any actual or suspected Security Failure or Privacy Incident;

3. to retain a public relations or crisis management consultant, including costs to provide advertising and public relations media and activities relating to an actual or suspected Security Failure or Privacy Incident;

4. to notify those whose Private Information is connected to an actual or suspected Security Failure or Privacy Incident and advise of any available remedy in connection with the Security Failure or Privacy Incident, including, those expenses and costs for advertising, printing and mailing of materials;

5. for identity theft education and assistance including credit freezes, identity theft call center services, credit file or identity monitoring and victim reimbursement insurance made available to those persons notified about a Security Failure or Privacy Incident pursuant to subparagraph (4) above.

6. for any other services approved by the Insurer at the Insurer’s sole and absolute discretion.

“Incident Response Expenses” shall not include any salary or overhead expenses of the Insured.

n) “Information Handler” means a third party that (i) the Insured has provided Private Information to; (ii) the Insured has given access to Private Information; or (iii) has received Private Information on behalf of the Insured.

o) “Insured(s)” means:

1. the Company;

2. any Insured Person;

3. the estates, heirs, executors, administrators, assigns or legal representatives of any Insured in the event of such Insured's death, incapacity, insolvency or bankruptcy, but only to the extent that such Insured would otherwise be provided coverage under this Insurance; and

4. the lawful spouse or domestic partner (whether such status is derived by reason of statutory law, common law or otherwise of any applicable jurisdiction in the world or any formal program established by the Company) of an Insured Person, but only to the extent that such Insured Person would otherwise be provided coverage under this Insurance.

5. any entity which the Named Insured or any Subsidiary is required by contract to add as an Insured solely under Insuring Agreement A. and E., Security & Privacy Liability and Regulatory Proceedings, but only for the acts of such Named Insured or any Subsidiary that result in a Security Failure or Privacy Incident.

p) “Insured Person(s)” means any person who is or was an Executive Officer, director, partner, member of a management committee or employee (including leased and contract employees) of the Company, but solely while acting within the scope of his or her employment and related to the conduct of the Company’s business.

q) “Loss” means:

1. damages, settlements or judgments;

2. pre-judgment or post-judgment interest;

3. court costs and attorney fees awarded in favor of a claimant and against the Insured;

4. Defense Costs;

5. Incident Response Expenses, solely under Insuring Agreement B.;

6. Business Loss, solely under Insuring Agreement C.;

7. Data Recovery Expenses, solely under Insuring Agreement D.;

8. Penalties, solely under Insuring Agreement E.; and

9. Extortion Costs, solely under Insuring Agreement F.

r) “Material Interruption” means the actual and measurable interruption or suspension of an Insured’s business directly caused by a Security Failure.

s) “Named Insured” means the entity named in Item 1 of the Declarations.

t) “Penalties” means any civil fine or money penalty payable to any federal, state, local or foreign governmental entity that was imposed in a Regulatory Proceeding by such governmental entity in its regulatory or official capacity.

The insurability of Penalties shall be in accordance with such applicable law that most favors coverage for such Penalties.

u) “Period of Restoration” means the period of time beginning immediately after the Material Interruption occurs, and continues until the Computer System is or could have been repaired or restored, with due diligence and promptness, to the same functionality and level of service that existed prior to the Material Interruption, and in no event exceeding one hundred and twenty (120) days.

v) “Personally Identifiable Information” means:

1. information from which an individual may be uniquely and reliably identified or contacted, including, but not limited to, an individual’s name, address, telephone number, social security number, account relationships, account numbers, account balances, account histories or passwords;

2. an individual’s “nonpublic personal information” as defined in the Gramm-Leach Bliley Act of 1999, as amended, and regulations issued pursuant to the Act;

3. an individual’s medical or heath care information, including “protected health information” or “electronic protected health information” as defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, or the Health Information Technology for Economic and Clinical Health Act (HITECH) and regulations issued pursuant to the Acts, or protected health related information under any similar federal, state, local or foreign law;

4. an individual’s private personal information as defined under Security & Privacy Law;

w) “Policy Period” means the period from the inception date shown in Item 2 of the Declarations to the earlier of the expiration date shown in Item 2 of the Declarations or the effective date of cancellation of this policy.

x) “Pollutants” means any substance located anywhere in the world exhibiting any hazardous characteristics as defined by, or identified on, any list of hazardous substances issued by the United States Environmental Protection Agency or any foreign, state, county, municipality, or locality counterpart thereof. Such substances shall include, without limitation, nuclear material or waste, any solid, liquid, gaseous or thermal irritant or contaminant, or smoke, vapor, soot, fumes, acids, alkalis, chemicals or waste materials. Pollutants shall also mean any other air emission, odor, wastewater, oil or products containing oil, lead or products containing lead, infectious or medical waste, and any noise.

y) “Pollution” means the actual, alleged or threatened discharge, dispersal, release, escape, seepage, transportation, emission, treatment, removal or disposal of Pollutants into or on real or personal property, water or the atmosphere. Pollution also means any Cleanup Costs.

z) “Privacy Extortion Demand” means any reasonably credible threat or demand or connected series of threats or demands to unlawfully use or disclose Private Information. The purpose of the threat or demand is to obtain money, securities or other tangible or intangible property of value from an Insured.

aa) “Privacy Incident” – means the following:

1. any failure to protect Private Information (whether by “phishing,” other social engineering technique or otherwise) including, that which could result in an identity theft or other wrongful emulation of the identity of an individual or corporation;

2. any failure to disclose an event referenced in Sub-paragraph (1) above in violation of any

Security & Privacy Law;

3. any unintentional failure of an Insured to comply with those parts of a Company’s privacy policy that (a) prohibit or restrict the disclosure or sale of Private Information by an Insured, or (b) require an Insured to allow an individual to access or correct Private Information about such individual; or

4. any violation of a federal, state, foreign or local privacy statute alleged in connection with a Claim for a failure described in Sub-paragraphs (1) or (2) above.

bb) “Private Information” means any of the following in an Insured’s or Information Handler’s care, custody or control or for which an Insured or Information Handler is legally responsible:

1. Personally Identifiable Information; or

2. Third Party Corporate Information

cc) “Regulatory Proceeding” means a request for information, civil investigative demand, or civil proceeding commenced by service of a complaint or similar proceeding brought by or on behalf of any federal, state, local or foreign governmental entity in such entity’s regulatory or official capacity in connection with such proceeding alleging a Security Failure or Privacy Incident.

dd) “Retention” means the applicable retention for each Insuring Agreement as set forth in Item 4. of the Declarations.

ee) “Security Extortion Demand” means any reasonably credible threat or demand or connected series of threats or demands to commit, continue or resume an intentional attack against the Computer System where the purpose of the threat or demand is to obtain money, securities or other tangible or intangible property of value from an Insured.

ff) “Security Failure” means any:

1. unauthorized access, unauthorized use, denial of service attack or receipt or transmission of a malicious code due to a failure or violation of the security of the Computer System or any other failure or violation of the Computer System;

2. failure to disclose an event referenced in Sub-paragraphs (1) above in violation of any Security & Privacy Law;

3. theft of a password or access code from an Insured’s premises, the Computer System, or an Insured Person by non-electronic means;

4. physical theft of hardware controlled by the Insured (or components thereof) on which electronic data is stored from a premises occupied and controlled by the Insured, including such failure or violation resulting from Cyberterrorism.

gg) "Security & Privacy Law" means any federal, state, local or foreign statute or regulation that requires the Insured:

1. to have protocols in place to protect the Computer System; or

2. to collect or store Private Information or has provided Private Information to an

Information Handler, to provide notice of any actual or reasonably suspected Security Failure or Private Incident, including the statute known as California SB 1386 (CIV §1798.82, et. seq. of the California Civil Code).

hh) “Subsidiary” means any entity, in which more than 50% of the outstanding securities or voting rights representing the present right to vote for the election of directors in such entity is owned or controlled, directly or indirectly, in any combination, by the Named Insured.

“Subsidiary” also means any not-for-profit entity, which is under the exclusive control of the Named Insured.

With respect to a Claim, Security Failure, Privacy Incident or Extortion Demand made against any Subsidiary or any Insured Person thereof, this policy shall only apply after the effective time such entity becomes a Subsidiary and prior to the effective time that such entity ceases to be a Subsidiary.

ii) “Third Party Computer System Service Provider” means:

1. a provider of “cloud computing” or other hosted computer resources to an Insured; or

2. a provider of information technology services required by an Insured to operate the Computer

System, as provided in a written contract between such third party and the Insured.

jj) “Third Party Corporate Information” means any trade secret, data, design, interpretation, forecast, formula, method, practice, process, record, report or other item of non-public information of a third party that is not an Insured, and which the Insured is legally required to maintain confidential.

kk) “Waiting Period” means the number of hours set forth in Item 4.C. of the Declarations that must elapse once a Material Interruption has begun.

3. EXCLUSIONS

This policy shall not cover any Loss in connection with any Claim, Security Failure, Privacy Incident or Extortion Demand:

a) alleging, arising from, based upon or attributable to any deliberate criminal or deliberate fraudulent act by an Insured if a final non-appealable adjudication establishes that such criminal or fraudulent act occurred;

b) alleging, arising from, based upon or attributable to the gaining in fact of any personal profit or advantage to which the Insured is not legally entitled;

In determining the applicability of the exclusions set forth in Section 3 (a) and (b), above, the facts pertaining to, the knowledge possessed by any Insured Person shall not be imputed to any other Insured Person; however, the facts pertaining to, the knowledge possessed by any Executive Officer shall be imputed to the Company;

c) for any Insured’s actual or alleged liability under any contract or agreement, except to the extent such liability would have attached to the Insured even in the absence of such contract or agreement; provided however with respect to an actual or alleged Security Failure or Privacy Incident, this exclusion shall not apply to any liability or obligation under the confidentiality or nondisclosure provisions of any agreement;

d) alleging, arising from, based upon or attributable to any actual or alleged liability of the Insured under any express or implied warranty or guarantee;

e) alleging, arising from, based upon or attributable to, as of the applicable Pending or Prior Date set forth in Item 4 of the Declarations, any pending or prior: (i) litigation; or (ii) administrative or regulatory proceeding or investigation of which an Insured had notice, including any Claim or other covered matter alleging or derived from the same or essentially the same facts, circumstance, situation, transaction, event, act or omission as alleged in such pending or prior litigation or administrative or regulatory proceeding or investigation;

f) alleging, arising out of, based upon or attributable to any facts or circumstances of which an Executive Officer had actual knowledge or information of, as of the applicable Pending or Prior Date set forth in Item 4 of the Declarations and that he or she reasonably believed may give rise to a Claim or other covered matter under this policy;

g) alleging, arising from, based upon or attributable to the same facts, circumstance, situation, transaction, event, act or omission alleged or contained in any Claim, Security Failure, Privacy Incident or Extortion Demand which has been reported, or in which notice has been given, before the inception date of this policy as set forth in Item 2 of the Declarations, under any policy, whether excess or underlying, of which this policy is a renewal or replacement or which it may succeed in time;

h) brought or maintained by any Insured against any other Insured, however, this exclusion shall not apply to Insuring Agreements A., B. or E. for Claims brought or Loss incurred by an employee of the Company;

i) for bodily injury, emotional distress, mental anguish (except emotional distress or mental anguish when associated with a Security Failure or Privacy Incident), sickness, disease or death of any person, or damage to or destruction of any tangible property, including the loss of use thereof;

j) alleging, arising from, based upon or attributable to Pollution in connection with any real property or facility which is or was at any time owned, operated, rented or occupied by the Insured or by any entity that wholly or partly owns, operates, manages or otherwise controls the Insured, or any entity that is wholly or partly owned, operated, managed or otherwise controlled by the Insured;

k) for the failure to procure or maintain, or to advise of the need to procure or maintain, insurance, suretyship or bonds;

l) alleging, arising from, based upon or attributable to:

1. exposure to or discharge, release, escape, seepage, migration, dispersal or disposal of mold, fungi, mildew, yeast, bacteria or spores; or

2. any demand, request or order that any Insured test for, monitor, clean up, remove or contain, or in any way respond to, or assess the effects of mold, fungi, mildew, yeast, bacteria or spores;

m) alleging, arising from, based upon or attributable to nuclear reaction, radiation or contamination, under any circumstances and regardless of cause, within or originating from a nuclear reactor or any facility where nuclear waste or material is processed, stored or disposed;

n) alleging, arising from, based upon or attributable to, or in any way involving the Employee Retirement Income Security Act of 1974, amendments thereto and regulations promulgated or adopted thereunder, or similar provisions of federal, state, provincial, local laws or common law or any of their amendments;

provided, however, this exclusion shall not apply to Insuring Agreements A., B. or E. for an actual or alleged Security Failure or Privacy Incident;

o) alleging, arising from, based upon or attributable to any violation of the Securities Act of 1933 as amended, the Securities Exchange Act of 1934 as amended, or any state Blue Sky or securities law or similar state or federal laws, including any regulation or order issued pursuant to any such law; provided however, this exclusion shall not apply to Insuring Agreements A., B. or E. for an actual or alleged Security Failure or Privacy Incident;

p) alleging, arising from, based upon or attributable to any infringement of, misappropriation of, violation of or assertion of any rights to or interest in a patent or trade secret: (i) by, or on behalf of, the Insured;

or (ii) by any other person or entity if such use or misappropriation is done with the knowledge, consent or acquiescence of an Insured Person;

q) alleging, arising from, based upon or attributable to any actual or alleged anti-trust violation, price fixing, monopolization, predatory pricing, price discrimination, restraint of trade, unfair competition, consumer fraud, false, deceptive or unfair trade practices, false, deceptive or misleading advertising, violation of the Interstate Commerce Act of 1887, The Sherman Antitrust of 1890, The Clayton Act of 1914, The Robinson- Patman Act of 1938, The Cellar Kefauver Act of 1950, The Competition Act, or the Federal Trade Commission Act of 1914, amendments thereto, rules or regulations thereunder and amendments thereto, or similar provisions of any federal, state, local statutory or foreign law or common law; provided however, this exclusion shall not apply to Insuring Agreements A., B. or E. for actual or alleged violations of a Security & Privacy Law;

r) alleging, arising from, based upon or attributable to, or in any way involving discrimination, harassment, termination of employment, or failure to hire or promote suffered by an Insured Person, regardless of whether related to employment; provided however, this exclusion shall not apply to Insuring Agreements A., B. or E. for an actual or alleged Security Failure or Privacy Incident;

s) alleging, arising from, based upon or attributable to, or in any way involving the return or restitution of fees or other compensation charged by or paid to the Insured for goods, products or services;

t) based upon or attributable to, or in any way involving the acts of or caused by an employee, other than a former employee, of any Insured; provided however that this exclusion shall not apply if an Executive Officer did not participate in, approve of, acquiesce to, have knowledge of, or have reason to know of such conduct;

u) alleging, arising from, based upon or attributable to, or in any way involving electrical or mechanical failures and/or interruption of infrastructure, including, but not limited to, any electrical disturbance, surge, spike, brownout or blackout, and outages to gas, water, telephone, cable, satellite, telecommunications or other infrastructure; provided however, this exclusion shall not apply to Insuring Agreements A. and B. for any Security Failure or Privacy Incident related to infrastructure of the Computer System that is under the care, custody or control of the Company;

v) alleging, arising from, based upon or attributable to, in any way involving or in consequence of war, invasion, military action (whether or not war is declared), civil war, rebellion, revolution, insurrection, military or usurped power, or any action taken by governmental, public or local authority to confiscate, nationalize, seize, destroy or damage property;

w) in the event that such coverage would not be in compliance with any United States of America economic or trade sanctions, laws or regulations, including but not limited to the U.S. Treasury Department’s Office of Foreign Assets Control, or any similar foreign, federal, state or statutory law or common law;

x) for taxes, fines and Penalties, except as provided with respect to Insuring Agreement E.;

y) for future profits, restitution, disgorgement of unjust enrichment or profits by an Insured, or the costs of complying with orders granting injunctive or equitable relief;

z) for matters that may be deemed uninsurable under applicable law and punitive, exemplary and multiplied damages; provided, however, if such damages are otherwise insurable under applicable law and regulation, coverage will be provided for an award of the damages made against the Insured, in excess of the Retention. The enforceability of the coverage provided by this provision shall be governed by such applicable law that most favors coverage for the insurability of such damages;

aa) for discounts, coupons, prizes, awards or other incentives offered to the Insured’s customers or clients;

bb) for liquidated damages to the extent that such damages exceed the amount for which the Insured would have been liable in the absence of such liquidated damages agreement;

cc) for the costs incurred:

1. to update, replace, restore, upgrade, maintain, enhance or improve data, software or any part of the Computer System beyond the level at which it existed prior to the Security Failure, Privacy Incident or Extortion Demand; and

2. to research and develop data or software, including intellectual property;

dd) for the economic or market value of data or software, including intellectual property;

ee) alleging, arising from, based upon or attributable to, or in any way involving an indirect or consequential loss of any nature; provided this exclusion shall not apply to Insuring Agreement C.;

Solely with respect to Insuring Agreements B. – D. and F., this policy shall not cover any Loss in connection with any, Security Failure, Privacy Incident or Extortion Demand:

ff) alleging, arising from, based upon or attributable to, or in any way involving performance of any obligation assumed by, on behalf of, or with the consent of any Insured;

gg) alleging, arising from, based upon or attributable to, or in any way involving any fees or expenses incurred or paid by any Insured in establishing the existence of or amount of Loss; however, this exclusion shall not apply to Insuring Agreement B.;

hh) alleging, arising from, based upon or attributable to, or in any way involving any potential income, including but not limited to interest and dividends not realized by any Insured or any third party;

provided that this exclusion shall not apply to Business Loss otherwise covered under Insuring C.

4. DEFENSE OF CLAIMS AND SETTLEMENTS

The Insurer has the right and duty to defend any Claim against an Insured covered under this policy, even if such Claim is false, fraudulent or groundless, or any Claim is in the form of a Regulatory Proceeding, provided such Claim is made and maintained within the United States of America, its territories or possessions; however, the Insurer shall not have the right or duty to defend any matters covered under Insuring Agreements B., C., D. or F. The Insurer’s duty to defend any Claim shall cease upon the exhaustion of the applicable limit of liability under this policy by payment of Loss.

With regard to any Claim made or maintained outside the United States of America, its commonwealths, districts, territories or possessions, the Insurer shall not have any duty to assume charge of the investigation, defense or settlement of the Claim, but rather shall have the right and shall be given the opportunity to effectively associate with the Insured in the investigation and defense of any such Claim.

In such cases, the Insured shall investigate and defend as is reasonable and necessary.

The Insured (s) shall not admit or assume any liability, incur any Defense Costs or other costs or expenses covered under the policy, enter into any settlement agreement or stipulate to any judgment without the prior written consent of the Insurer. Any Loss incurred by the Insured(s) and/or any settlements or judgments agreed to by the Insured(s) without such consent shall not be covered by this policy. However, the Insurer’s consent is not required for the Insured to settle a Claim for a Loss amount within the applicable Retention.

Each and every Insured shall give the Insurer full cooperation and such information as it may reasonably require relating to the defense and settlement of any Claim, or verification of any Security Failure, Privacy Incident or Extortion Demand and the prosecution of any counter-claim, cross-claim or third-party Claim, including without limitation the assertion of an Insured ’s indemnification or contribution rights.

The Insurer shall have the right to investigate and conduct negotiations and, with the Insured’s consent, which shall not be unreasonably withheld, enter into the settlement of any Claim that the Insurer deems appropriate. In the event the Insured refuses to consent to a settlement acceptable to the claimant in accordance with the Insurer’s recommendation, the Insurer’s liability for Loss on account of such Claim shall not exceed: (1) the amount for which the Insurer could have settled the Claim; plus (2) fifty percent (50%) of any Defense Costs incurred after the date such settlement or compromise was recommended to the Insured; plus (3) fifty percent (50%) of covered Loss, other than Defense Costs, in excess of the amount for which the Insurer could have settled the Claim.

The remaining fifty percent (50%) of such Defense Costs or Loss must be borne by the Insured at their own risk and uninsured. In no event shall the Insurer’s liability exceed the applicable Aggregate Sub- Limit of Liability as set forth in Item 4 of the Declarations.

The Insurer shall pay Defense Costs excess of the applicable Retention, subject to all other terms and conditions of this policy. In the event and to the extent that the Insureds shall not be entitled to payment of such Loss under the terms and conditions of this policy, such payments by the Insurer shall be repaid to the Insurer by the Insureds, severally according to their respective interests.

5. LIMITS OF LIABILITY

The aggregate Limit of Liability, as set forth in Item 3 of the Declarations, is the maximum limit of liability of the Insurer for all Loss on account of all Claims, Security Failures, Privacy Incidents or Extortion Demands covered under this policy.

Any sublimit(s) of Liability, whether set forth in Item 4 of the Declarations or as otherwise provided under the terms of this policy, shall be part of, and not in addition to, the aggregate Limit of Liability set forth in Item 3 of the Declarations. Each sublimit of Liability is the aggregate sublimit of Liability payable under the respective Insuring Agreement.

If the aggregate Limit of Liability as set forth in Item 3 of the Declarations is exhausted by the payment of Loss, all obligations of the Insurer under this policy will be completely fulfilled and the Insurer will have no further obligations under this policy of any kind, and the premium as respects the policy will be fully earned.

Defense Costs are part of, and not in addition to, the aggregate Limit of Liability as set forth in Item 3 of the Declarations and payment by the Insurer of Defense Costs shall reduce and may exhaust such Aggregate Limit(s) of Liability, or any sublimits of liability thereunder.

If a Discovery Period is purchased by the Insured pursuant to Section 9 of this policy, the Limit of Liability for the Discovery Period shall be part of, and not in addition to, the applicable Limits of Liability as set forth in Item 3 of the Declarations.

6. RETENTION CLAUSE

Subject to all other terms and conditions of this policy, the Insurer shall only be liable for the amount of Loss arising from each Claim (in respect of Insuring Agreements A. and E.) Security Failure or Privacy Incident (in respect Insuring Agreements B., C. and D.) or Extortion Demand (in respect of Insuring Agreement F.), which is in excess of the applicable Retention amount as set forth in Item 4 of the Declarations for each Insuring Agreement. The Retention amount shall be borne by the Insureds and remain uninsured.

The application of a Retention to Loss under one Insuring Agreement shall reduce the Retention that applies to Loss under any other Insuring Agreement. If different Retention amounts apply to different parts of a single Loss, the Retention amount shall be the single largest applicable Retention amount.

With respect to Insuring Agreement C., Business Interruption, any Business Loss incurred during the Waiting Period shall not be covered Business Loss except to the extent such shall solely apply towards the Insured satisfying the applicable Retention amount.

7. REPORTING OF CLAIMS, SECURITY FAILURES, PRIVACY INCIDENTS, EXTORTION

DEMANDS AND CIRCUMSTANCES

The Named Insured(s) shall, as a condition precedent to the obligations of the Insurer under this policy, give written notice as set forth below to the Insurer at the address set forth in Item 7.A. of the Declarations.

If mailed, the date of mailing shall constitute the date that such notice was given and proof of mailing shall be sufficient proof of notice.

a) With regards to all Insuring Agreements:

Such notice shall be given as soon as practicable after any Executive Officer becomes aware of a Claim, Security Failure, Privacy Incident or Extortion Demand, but in no event shall such notice to the Insurer be later than: (i) in respect of a Claim, sixty (60) after the end of the Policy Period (or Discovery Period, if applicable); or (ii) in respect of any Security Failure, Privacy Incident or Extortion Demand during the last thirty (30) days of the Policy Period, sixty (60) days after the end of the Policy Period. Furthermore, unless notice of such Claim, Security Failure, Privacy Incident or Extortion Demand is reported in accordance with this Clause, there shall be no coverage for Incident Response Expenses in connection with such incident.

b) With regards to all Insuring Agreements, if during the Policy Period an Insured becomes aware of any circumstances, which may reasonably be expected to give rise to a Claim, Security Failure, Privacy Incident or Extortion Demand (“Potential Claim, Security Failure, Privacy Incident or Extortion Demand”), the Insured must:

1. Provide written notice to the Insurer as soon as practicable which shall include:

a) the specific details of such Potential Claim, Security Failure, Privacy Incident or

Extortion Demand;

b) the injury or damage which may result or has resulted from the Potential Claim, Security Failure, Privacy Incident or Extortion Demand;

c) the facts by which the Insured first became aware of the Potential Claim, Security

Failure, Privacy Incident or Extortion Demand; and

d) a description of the Insured’s data or software which was or may have been altered, damaged, deleted, or destroyed;

2. Take all reasonable steps to protect the Computer System from further loss or damage;

3. Retain and isolate all electronic records related to the Potential Claim, Security Failure, Privacy Incident or Extortion Demand including system logs, security logs and backup media;

4. Permit inspections of the Computer System and any records upon request by the Insurer or the Insurer’s representatives;

5. Provide all information and assistance reasonably requested by the Insurer, and cooperate with the Insurer and the Insurer’s representatives in the investigation of any Potential Claim, Security Failure or Extortion Demand, and/or settlement of any Claim.

Any Claim or Security Failure, Privacy Incident or Extortion Demand reported under the above which arises out of, is based upon or is attributable to a previously noticed Claim or Potential Claim, Security Failure, Privacy Incident or Extortion Demand shall be considered related to the previously noticed Claim or Potential Claim, Security Failure, Privacy Incident or Extortion Demand and shall be deemed to: (i) in respect of a Claim, have been made at the time the previously noticed Claim was first made or a notice of circumstances regarding the related potential Claim was first provided to the Insurer;

or (ii) in respect of a Security Failure, Privacy Incident or Extortion Demand, discovered or occurred, as applicable, at the time the related Security Failure, Privacy Incident or Extortion Demand was first discovered or occurred or a related notice of circumstances regarding such a potential Security Failure, Privacy Incident or Extortion Demand was first provided to the Insurer.

c) With respect to Insuring Agreement C., Business Interruption, before coverage will apply for Business Loss, the Insured must also:

1. complete and sign a written, detailed and affirmed proof of loss within ninety (90) days after the discovery of a Business Loss which shall include:

a) a full description of such Business Loss and the circumstances surrounding such

Business Loss, which shall include, among any other necessary information, the time, place and cause of the Business Loss;

b) a detailed calculation of any Business Loss; and

c) the underlying documents and materials that reasonably relate to or form a part of the basis of the claim for such Business Loss;

2. submit to examination under oath at the Insurer’s request and give the Insurer a signed statement of its answers;

3. immediately record the specifics of any Business Loss or Security Failure and the date the Insured first became aware of such Business Loss or Security Failure;

4. provide the Insurer with any cooperation and assistance that the Insurer may request, including assisting the Insurer in:

a) any investigation of a Security Failure, loss or circumstance making settlements;

b) enforcing any legal rights, you or we may have against anyone who may be liable to you;

c) executing any documents that we deem are necessary to secure our rights under this policy; and

d) any inspection or survey conducted by the Insurer pursuant to Insuring Agreement

C., Business Interruption.

All adjusted claims shall be due and payable thirty (30) days after the presentation and written acceptance by the Insurer of satisfactory proof of Business Loss. The costs and expenses of establishing or proving the Insured’s Business Loss for this policy, including, without limitation, those connected with preparing a proof of loss, shall be the Insured’s obligation, and are not covered under this policy.

In determining the amount of net profit (or loss) and charges and expenses covered hereunder for the purpose of ascertaining the amount of Business Loss (and otherwise), due consideration shall be given to the prior experience of an Insured’s business before the beginning of the Security Failure and to the probable business the Insured could have performed had no Security Failure occurred. Provided, however, that such net profit (or loss) calculations shall not include, and this policy shall not cover, net income that would likely have been earned as a result of an increase in volume of business due to favorable business conditions caused by the impact of Security Failures on other businesses. All such net profit (or loss) and charges and expenses shall be calculated on an hourly basis and based on such the Insured’s actual net profit (or loss) and charges and expenses.

If the Insured and the Insurer disagree on the amount of Business Loss, either may make a written demand for an appraisal of such Business Loss. If such demand is made, each party will select a competent and impartial appraiser. The appraisers will then jointly select an umpire. If the appraisers cannot agree on an umpire, they may request that selection be made by a judge of a court having jurisdiction. The appraisers will state separately the amount of Business Loss. If they fail to agree, they will submit their differences to the umpire. A decision agreed to by any two will be binding.

8. ALLOCATION

In the event the Insured (s) incurs Loss that is both covered and not covered by this policy, either because the Claim, Security Failure, Privacy Incident or Extortion Demand includes both covered and uncovered matters or because the Claim, Security Failure, Privacy Incident or Extortion Demand includes both Insured and uninsured parties, all Loss incurred by the Insured from such Claim, Security Failure, Privacy Incident or Extortion Demand will be allocated by the Insurer between covered Loss and uncovered Loss based upon the relative legal and financial exposures of the parties to such matters.