FY26_TransUnion_Agreement_Fully_Executed.pdf

Data Security and Privacy Terms Page 1 of 9

Version 1.0 - 03/24

AMENDMENT

to Subscriber Agreement

THIS AMENDMENT (“Amendment”), effective as of the date it is signed by both parties (“Effective Date”), is entered into by and between TransUnion Risk and Alternative Data Solutions, Inc. (“TRADS”) and (“Subscriber”) and Ohio Department of Veteran Services. This Amendment serves to amend and supplement the Subscriber Agreement dated

11.1.2023 as amended and/or supplemented (the “Agreement”), by and between TRADS and Subscriber.

RECITALS

WHEREAS, TransUnion and Subscriber desire to amend the Agreement, as more fully stated herein.

NOW THEREFORE, in consideration of the mutual covenants and promises herein contained and other valuable consideration, the receipt and sufficiency of which is hereby acknowledged, and intending to be legally bound hereby, the parties agree as follows:

1. The forgoing Recitals are hereby incorporated by reference as a material part of this Amendment.

2. Capitalized terms not defined herein shall have the definition ascribed in the Agreement.

3. The Agreement is amended by adding “Exhibit D (Data Security and Privacy Terms)” to the Agreement which is attached hereto and incorporated herein as “Attachment 1”.

4. In the event of a conflict between any of the terms of this Amendment and those of the Agreement, the terms of this Amendment shall govern. The remaining terms of the Agreement shall at all times remain in full force and effect.

IN WITNESS WHEREOF, the parties, intending to be legally bound, have caused this Amendment to be executed by their duly authorized representatives as of the Effective Date.

TRANSUNION RISK AND ALTERNATIVE DATA OHIO DEPARTMENT OF VETERAN SERVICES

SOLUTIONS, INC.

By:__________________________________________

Name (Printed):________________________________

Title:_________________________________________

Date:________________________________________

By:_________________________________________

Name (Printed):_______________________________

Title:________________________________________

Date:_______________________________________

Docusign Envelope ID: EE8944D8-BD12-4827-8FF4-58265AD55069

Director

John C. Harris, Jr./by Jennifer L. Prindle

9/30/2025

Docusign Envelope ID: 64456FFE-43AE-458A-BE90-9DE2EF641A63

10/20/2025

John Hurley

VP Sales

Data Security and Privacy Terms Page 2 of 9

Attachment 1 Exhibit D

DATA SECURITY AND PRIVACY TERMS

These Data Security and Privacy Terms (“Terms”) describe the responsibilities for the Contractor relating to State information security and privacy standards and requirements for all proposed solutions, whether cloud, on-premises, or hybrid based. These Terms applies to all work and services across all environments, and State of Ohio (“State”) and Contractor locations (e.g., cloud (Software as a Service, Platform as a Service, or Infrastructure as a Service), on-premises, or hybrid) along with the computing elements that the Contractor will perform, provide, occupy, or utilize in performing the work, and any Contractor access to State resources in conjunction with the delivery of work.

The Contractor must comply with the State IT Security Policies and Standards and these Terms and must accept the security and privacy requirements outlined in these Terms in their entirety, as they apply to the services being provided to the State. The Contractor will be responsible for maintaining information security in any environments under the Contractor’s management in accordance with State IT Security Policies and Standards.

These Terms apply to the following:

A. Major and minor projects, upgrades, updates, fixes, patches, and other software and systems inclusive of all State elements or elements under the Contractor’s responsibility utilized by the State.

B. Any systems development, integration, operations, and maintenance activities performed by the Contractor.

C. Any authorized change orders, statements of work, renewals, or amendments to the Contract.

D. Contractor locations, equipment, and personnel that access State systems, networks, or State Data directly or indirectly.

E. Any Contractor personnel that have access to State Data.

These Terms are in addition to the Contract terms and conditions. In the event of a conflict between the Contract and these Terms, the most stringent standard will prevail.

Definitions

1. Contractor for purposes of these Terms, includes subcontractors or other personnel under the authority or control of the Contractor performing the work or providing the services under this Contract.

2. Personally Identifiable Information means information that can be used directly or in combination with other information to identify a particular individual. It includes:

A. A name, identifying number, symbol, or other identifier assigned to a person, Any information that describes anything about a person, B. Any information that indicates actions done by or to a person, C. Any information that indicates that a person possesses certain personal characteristics, D. The definitions of “personal information” in Revised Code chapters 1347.01, 1347.04 through

1347.99, and E. The various other definitions of “personal information” throughout the Ohio Revised Code.

3. Security Event has the meaning set forth in Section 7 of these Terms.

4. Security Incident has the meaning set forth in Section 7 of these Terms.

5. State Data means all data and information provided by, created by, created for, or related to the activities of the State and any information from, to, or related to all persons that conduct business or

Docusign Envelope ID: EE8944D8-BD12-4827-8FF4-58265AD55069Docusign Envelope ID: 64456FFE-43AE-458A-BE90-9DE2EF641A63

Data Security and Privacy Terms Page 3 of 9 personal activities with the State, including, but not limited to Sensitive Data. Notwithstanding any provision contained herein the parties agree that any data or information that Contractor provides to the State shall not be considered the State Data and the State does not retain any ownership rights to such data.

6. Sensitive Data means any type of data that presents a high or moderate degree of risk if released, disclosed, modified, or deleted without authorization. There is a high degree of risk when unauthorized release or disclosure is contrary to a legally mandated confidentiality requirement. There may be a moderate risk and potentially a high risk in cases of information for which an agency has discretion under the law to release data, particularly when the release must be made only according to agency policy or procedure.

Sensitive Data includes, but is not limited to:

A. Personally Identifiable Information (PII);

B. Family Educational Rights and Privacy Act (20 U.S.C. § 1232g);

C. Federal Tax Information (FTI) under IRS Publication 1075 - Tax Information Security Guidelines for federal, state, and local agencies;

D. Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act

(45 CFR Part 160 and Subparts A, C, and E of Part 164); United States Code 42 U.S.C. 1320d through 1320d-9 (HIPAA); and Code of Federal Regulations for Public Health and Public Welfare:

42 C.F.R. 431.300, 431.302, 431.305, 431.306, 435.945, 45 C.F.R. 164.502(e) and 164.504(e);

E. Criminal Justice Information (CJI) under the Federal Bureau of Investigation’s Criminal Justice Information Services (CJIS) Security Policy available at https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center;

F. Payment Card Industry Data Security Standards;

G. Social Security Administration (SSA) Data which is data received by the State from the Social

Security Administration in accordance with the current Computer Matching and Privacy Protection Act between the State of Ohio and the Social Security Administration; and

H. Other types of information not associated with an individual such as security and infrastructure records, trade secrets, and business bank account information.

7. State IT Security Policies and Standards means the policies and standards available at https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance.

Requirements

1. The Contractor’s Responsibilities Generally

The Contractor is responsible for maintaining the security of information in accordance with the applicable security baseline of the current published version of the National Institute of Standards and Technology (“NIST”) Special Publication (“SP”) 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations,” (“NIST 800-53”) commensurate with the type of State Data involved in the Contract as communicated by the State. If the State is providing the network layer, the Contractor must be responsible for maintaining the security of the information in environment elements that are accessed, utilized, developed, or managed by the Contractor. The Contractor’s information security and technology responsibilities with respect to the work and services the Contractor is providing to the State include the following, where applicable:

A. Support State IT security policies, standards and procedures development and maintenance activities. Assist in the implementation of associated security procedures with the State’s review and approval, including physical access requirements, User ID approval procedures, and a Security Incident action and response plan.

B. Support implementation and compliance monitoring as per State IT Security Policies and

Docusign Envelope ID: EE8944D8-BD12-4827-8FF4-58265AD55069Docusign Envelope ID: 64456FFE-43AE-458A-BE90-9DE2EF641A63 https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance

Data Security and Privacy Terms Page 4 of 9

Standards.

C. Upon identification of a potential issue with maintaining an “as provided” State infrastructure element in accordance with a more stringent State level security policy, the Contractor must identify and communicate the nature of the issue to the State, and, if possible, outline potential remedies for consideration by the State.

2. Protection and Handling of State Data

Contractor shall maintain an Information Security Program (“ISP”) made up of policies, procedures, technical and organizational safeguards, and training designed to protect State Data against unauthorized loss, destruction, alteration, access, or disclosure. To protect State Data, the Contractor must use due diligence to ensure computer and telecommunications systems and services involved in storing, using, or transmitting State Data are secure and to protect State Data from unauthorized disclosure, modification, use or destruction. To accomplish this, the Contractor must adhere to the following requirements regarding State Data in addition to the confidentiality requirements in the Contract:

A. Assume all State Data is both confidential and critical for State operations.

B. Maintain, in confidence, State Data it may obtain, maintain, process, or otherwise receive from or through the State during, and pursuant to, the provisions of the Contract and these Terms.

C. Use and permit its employees, officers, agents, and subcontractors to use any State Data received from the State solely to perform its obligations under the Contract.

D. Not sell, rent, lease, disclose, or permit its employees, officers, agents, and sub-contractors to sell, rent, lease, or disclose, any such State Data to any third party, except as permitted under the Contract or required by applicable law, regulation, or court order.

E. Take all commercially reasonable steps to (a) protect the confidentiality of State Data received from the State and (b) establish and maintain physical, technical, and administrative safeguards to prevent unauthorized access by third parties to State Data received by the Contractor from the State.

F. Apply appropriate risk management techniques to balance the need for security measures against the sensitivity of State Data.

G. Ensure that internal security policies, plans, and procedures address the basic security elements of confidentiality, integrity, and availability of State Data, and periodically review and update these policies, plans, and procedures as needed.

All State Data at rest in systems supporting the Contractor’s services must reside within the contiguous United States with a minimum of two data center facilities at two different and distant geographic locations and be handled in accordance with the requirements of these Terms at all Contractor locations.

If the Contractor will be handling Sensitive Data, the State may require additional documentation such as the Contractor’s information security policies and procedures, contingency plans, or incident response plans, FIPS-199 compliance documentation, a NIST-compliant System Security Plan (SSP), and Plans of Action and Milestones (POA&M) documentation.

3. Security Standards and Warranties

All solutions shall operate at the moderate level baseline as defined in the current published version of NIST 800-53, be consistent with Federal Information Security Management Act, 44 U.S.C. § 3551 et seq.

Docusign Envelope ID: EE8944D8-BD12-4827-8FF4-58265AD55069Docusign Envelope ID: 64456FFE-43AE-458A-BE90-9DE2EF641A63

Data Security and Privacy Terms Page 5 of 9

(“FISMA 2014”) requirements, and offer a customizable and extendable capability based on open-standards APIs that enable integration with third party applications.

Contractor’s information security program protects State Data by aligning with NIST 800-53 to implement an industry security and privacy standard including, at a minimum:

A. Security and confidentiality of State Data.

B. Protection against anticipated threats or hazards to the security or integrity of State Data.

C. Protection against the unauthorized access to, disclosure of, or use of State Data.

D. Give access to State Data only to those individual employees, officers, agents, and sub-contractors who need to know such information in connection with the performance of the obligations under the Contract.

E. Cooperate with any attempt by the State to monitor compliance with the foregoing obligations as reasonably requested by the State.

F. Promptly destroy or return to the State upon written request by the State all State Data received from or through the State upon completion of the work under the Contract or upon termination or expiration of the Contract. Contractor (a) shall not be required to return or destroy copies of State Data from its disaster recovery and/or business continuity databases, where doing so would be commercially impracticable, and (b) may retain a single archive copy of the State Data to the extent required to comply with applicable legal and regulatory requirements, provided that in either case Contractor maintains the State Data in compliance with the terms of the Contract until destroyed, which shall occur as soon as reasonably practicable.

G. Maintain appropriate and effective business continuity and disaster recovery plans to ensure resiliency of State Data and business operations.

H. Maintain a privacy policy that includes, at a minimum, processes for the State to obtain individual privacy consent for the use of PII, at the determination of the State, and to respond to individuals’ requests to access, correct, and delete their PII unless otherwise expressly agreed to in the Contract. All PII, is considered State Data and Confidential Information under this Contract.

Contractor must scan all source code for vulnerabilities, including before and after any source code changes are made, and must promptly remediate any and all vulnerabilities and provide the State with patches to address the vulnerabilities at no cost to the State. Contractor must follow best practices for application code review and the most current version of the Open Source Foundation for Application Security (OWASP) top 10.

4. Auditing

A. The Contractor must obtain an annual audit of the services being provided under this Contract that meets the American Institute of Certified Public Accountants (AICPA) Statements on Standards for Attestation Engagements (SSAE) No. 18, Service Organization Control 1 Type 2 and Service Organization Control 2 Type 2. The audit must cover all operations pertaining to the services covered by this Contract. The audit will be at the sole expense of the Contractor and the results must be provided to the State within 30 days of Contractor’s receipt of its audit results each year.

B. If required by law, rule, or regulation, the State may, with 30 days written notice, elect to perform a

Docusign Envelope ID: EE8944D8-BD12-4827-8FF4-58265AD55069Docusign Envelope ID: 64456FFE-43AE-458A-BE90-9DE2EF641A63

Data Security and Privacy Terms Page 6 of 9 virtual Security and Data Protection Audit subject to a mutually agreed upon agenda. This includes a thorough review of Contractor controls, security and privacy functions and procedures, data storage and encryption methods, and backup and restoration processes. The State may utilize a third-party contractor to perform such activities to demonstrate that all security, privacy, and encryption requirements are met. The State will provide its request in writing and will work with the Contractor to schedule time to conduct the audit. Contractor will cooperate by answering relevant questions and providing access to relevant policies, procedures, and documentation;

knowledgeable Personnel.; However, nothing by virtue of this Section shall require Contractor to disclose (i) any data of any other customer or information that would violate a duty of confidentiality toward another customer, (ii) any internal accounting or financial information, (iii) any trade secret of Supplier, and (iv) any other Supplier Confidential Information not included as part of the mutually agreed upon agenda. Any information the State or third-party auditor receives during an audit is Contractor Confidential Information, and such Confidential Information shall be used solely for the purpose of validating Contractor’s compliance with this Agreement. After the completion of the audit, the State shall destroy such Confidential Information except as necessary to comply with Applicable Laws. If applicable, Customer shall cause its third-party auditor to destroy all Contractor Confidential Information after completion of the audit.

At no cost to the State, the Contractor will promptly develop and implement a remediation plan for any issues, material weaknesses, or other items identified in each audit as they pertain to the services provided under this Contract.

5. Background Investigations of Contractor Personnel

Any employee who (a) has been convicted of any criminal offense making them ineligible for employment with TRADS, or, (b) is named by the Office of Foreign Asset Control (OFAC) as a Specially Designated National, may not perform certain services under the Contract.

6. Security Incidents

A. Definitions. A security incident threatens the confidentiality, integrity, or availability of State information resources. A “Security Incident” means there is a confirmed successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. A “Security Event” is any observable occurrence that is relevant to information security within normal operational noise levels and below pre-defined incident thresholds.

Security Incidents may fall into one or more of, but are not limited to, the following categories:

i. Loss or Theft

ii. Denial of Service (DoS)

iii. Improper Usage or Access

iv. Information Spillage

v. Malicious Code

vi. Phishing Messages

vii. Scans/Probes/Attempted Access

viii. Social Engineering

ix. Unauthorized Access

Security Events may fall into one or more of, but are not limited to, the following:

i. unsuccessful log-on attempts,

ii. unsuccessful denial of service attacks,

iii. unsuccessful phishing attacks, and

iv. unsuccessful network attacks such as pings, probes of firewalls, and port scans.

B. Security Incident Response and Reporting

Docusign Envelope ID: EE8944D8-BD12-4827-8FF4-58265AD55069Docusign Envelope ID: 64456FFE-43AE-458A-BE90-9DE2EF641A63

Data Security and Privacy Terms Page 7 of 9

The Contractor is responsible for Security Incident response, including containment, eradication, and recovery, to minimize the impact to the State. In addition to the requirements in the Contract, the Contractor must perform the following in response to a Security Incident involving State Data.

The Contractor is not required to report Security Events which do not adversely impact or potentially impact State Data or information systems unless a pattern of attacks significantly increases the risk of impact. Contractor must report in writing to the State within 48 hours of the Contractor confirms of any Security Incident and/or use or disclosure of State Data not authorized by the Contract, including any reasonable belief that unauthorized access to or acquisition of the State Data has occurred, and fully cooperate with the State to mitigate the consequences of the Security Incident.

Within five business days of the initial Security Incident report to the State, the Contractor must document and begin providing follow-up reports for all Security Incidents to the State. The Contractor must provide updates to the follow-up reports until the investigation is complete. At a minimum, the Security Incident reports will include:

i. Data elements involved, the extent of the State Data involved in the Security Incident, and the identification of affected individuals, if applicable.

ii. A description of the unauthorized persons known or reasonably believed to have improperly used or disclosed State Data, or to have been responsible for the Security Incident.

iii. A description of where the State Data is believed to have been improperly transmitted, sent, or utilized, if applicable.

iv. A description of the probable causes of the Security Incident and, in the final report, the root cause.

v. A description of the proposed plan for preventing similar future Security Incidents, including a recommended risk remediation plan.

vi. A description of the corrective actions taken, including repair (elimination of a defect or incident and/or restoration of system functionality requirements according to the Contract) and resolution (a temporary workaround to enable system function).

vii. Whether the Contractor believes any federal or state laws requiring notifications to individuals are triggered.

The Contractor must comply with all applicable laws that require the notification of individuals, or with other reasonable direction of the State for notification, in the event of a confirmed Security Incident involving personally identifiable information, or any other event requiring such notification.

The State may, in its sole discretion, choose to provide notice to any or all parties affected by a confirmed Security Incident, but the Contractor shall reimburse the State for the cost of providing such notification. Contractor further agrees to provide, or to reimburse the State for its costs in providing, any credit monitoring or similar services that are necessary as a result of Contractor’s confirmed Security Incident. Notwithstanding the foregoing, it is agreed that Contractor’s obligation to reimburse the State for the notification costs, and any cost for providing credit monitoring or any similar services in the event of a confirmed Security Incident shall not exceed a total of ten thousand dollars ($10,000). Under Ohio law, State Data is State property and any illegal activity involving State property is subject to a criminal investigation. The Contractor shall preserve sufficient evidence to ensure accurate Security Incident records, facilitate an investigation, and determine the extent of the confirmed Security Incident.

The Contractor shall work with the customer State agency to establish a Security Incident reporting communications procedure including Contractor and customer State agency contacts, Docusign Envelope ID: EE8944D8-BD12-4827-8FF4-58265AD55069Docusign Envelope ID: 64456FFE-43AE-458A-BE90-9DE2EF641A63

Data Security and Privacy Terms Page 8 of 9 communication methods and tools. If there is no procedure established, the Contractor must report Security Incidents to the primary contact listed in the Contract or that contact’s successor and Contractor must report the Security Incident to the State via email at Enterprise.SIRT@das.ohio.gov or call 614.728.7448.

The State reserves the right to cooperate in an investigation of the Security Incident.

[Sections 8-11 below to be included only when applicable. Remaining sections should be deleted if not applicable.]

Docusign Envelope ID: EE8944D8-BD12-4827-8FF4-58265AD55069Docusign Envelope ID: 64456FFE-43AE-458A-BE90-9DE2EF641A63