The URL can be used to link to this page

Home My WebLink AboutR-2025-114 Purchase Cyber Liability Insurance from Node International InsuranceRESOLUTION NO. R-2025-114 A RESOLUTION AUTHORIZING THE PURCHASE OF CYBER LIABILITY INSURANCE FROM NODE INTERNATIONAL INSURANCE FOR THE ANNUAL PREMIUM IN AN AMOUNT NOT TO EXCEED $9,651.00 WHEREAS, the City of Riverside has a need for cyber liability insurance as this is no longer under the umbrella of our annual property and liability insurance carrier premium; and WHEREAS, the City of Riverside in the adoption of its purchasing policy requires all expenditures in excess of $10,000 to be presented to the Board of Aldermen for approval, and the City's insurance carrier MIRMA recommended Node International, through Barker Phillips Jackson, Inc., for cyber liability insurance and has presented an adequate policy in the amount of $9,651.00 for the FY 2025-2026 for such coverage; and WHEREAS, funds for such purpose is budgeted in the Fiscal Year 2024-2025 budget; and WHEREAS, the Board of Aldermen find it is in the best interest of the citizens of the City of Riverside to authorize purchase of such insurance coverage and approve the payment to Node International for cyber liability insurance coverage for the City of Riverside, in an amount not to exceed $9,651.00. NOW THEREFORE, BE IT RESOLVED BY THE BOARD OF ALDERMEN OF THE CITY OF RIVERSIDE, MISSOURI, AS FOLLOWS: THAT, the acquisition of such insurance coverages and payment to Node International through Barker Phillips Jackson, Inc for cyber liability insurance coverage for the City of Riverside, in an amount not to exceed $9,651.00 is hereby authorized and approved; and FURTHER THAT the Mayor, City Administrator, or either of their designees, are hereby authorized to execute all documents necessary or incidental to this transaction and the City Clerk is authorized to attest thereto. PASSED AND ADOPTED by the Board of Aldermen of the City of Riverside, Missouri, the 1st day of July 2025. /s/ Kathleen L. Rose Mayor Kathleen L. Rose ATTEST: /s/ Robin Kincaid Robin Kincaid, City Clerk #DigitalRisk node INTERNATIONAL Quote Attestation - NODE2553612 Insuring Factors and Assumptions Quote Reference NODE2553612 Named Insured City of Riverside, Missouri Address 2950 NW Vivion Rd, Riverside, Montana, USA, 64150 Industry Other General Government Support Number of Employees 100 Company Type Private Date Established 1951-01-01 Number of claims Zero value in the last 3 years Policy Period 01 July 2025 - 01 July 2026 Yourself and employees: • Encrypt all emails containing sensitive information sent to external parties. • Encrypt all sensitive information stored on mobile devices • Have an individual officially designated for overseeing information security • Verify vendor/supplier bank accounts before adding to your accounts payable systems • Authenticate funds transfer requests • Prevent unauthorized employees from initiating wire transfers. • Undertake mandatory information security training at least annually and information security personnel are provided with additional training to help them understand current security threats. • Perform at least annual backups of company data • Have in place at least one of the following, Business Continuity Plan, Disaster Recovery Plan, Incident Response Plan I affirm that I have read, and Node International has advised me to carefully read, the terms, conditions, limitations, exclusions and any applicable endorsements of the commercial cyber insurance policy that I am applying for, which have been made available to me. I affirm that the information that I have provided throughout the application for this insurance is, to the best of my knowledge, true, accurate, and complete. I understand that any non -disclosure, misrepresentation or non-payment of premium may result in cancellation of or non -renewal of this policy. I have read, understood and agreed to the fraud warning, terrorism notice and no know loss statement. I agree all policy documents will be distributed electronically. Required Option/Coverage Please refer to your quote for full coverage details. OPTION | POLICY LIMIT | PREMIUM | NODE DETECT FEES | TOTAL | SELECTED Option 1 USD $1,000,000 USD $9,101.00 USD $200 USD $9,301.00 O Node #DigitalRisk Admitted US Attestation v1.0 2021 1 of 7 #DigitalRisk node INTERNATIONAL Applicant's Signature /s/ Robin Kincaid Robin Kincaid Applicant's Name 6-17-2025 Date rkincaid@riversidemo.gov Applicant's Email Address 816-741-3993 Applicant's Phone Number July 1, 2025 Insurance Start Date You can fill this form out online, use the link below: https://node.insure/NODE2553612/49WYN3XW74R5 Risk Manager Please list below the relevant parties who would like to receive security updates, information and communications regarding your digital wellbeing. Jason Ketter IT Manager jketter@riversidemo.gov 816-451-8251 Name | Position/Title | Email | Phone Eddie Seasholtz IT Manager Asst eddie@enetkc.com 913-207-1130 Name | Position/Title | Email | Phone Name | Position/Title | Email | Phone FRAUD WARNING General Fraud Warning: Any person who knowingly presents a false or fraudulent claim for payment of a loss or benefit or knowingly presents false information in an application for insurance is guilty of a crime and may be subject to fines and confinement in prison. (Not applicable in AL, AK, AZ, AR, CA, CO, DE, DC, FL, ID, IN, HI, KS, KY, LA, ME, MD, MN, NH, NJ, NM, NY, OH, OK, OR, PA, PR, TN, VA, WA) POLICYHOLDER DISCLOSURE NOTICE OF TERRORISM INSURANCE COVERAGE Coverage for acts of terrorism is included in your policy. You are hereby notified that under the Terrorism Risk Insurance Act, as amended in 2015, the definition of act of terrorism has changed. As defined in Section 102(1) of the Act: The term " act of terrorism" means any act or acts that are certified by the Secretary of the Treasury —in consultation with the Secretary of Homeland Security, and the Attorney General of the United States —to be an act of terrorism; to be a violent act or an act that is dangerous to human life, property, or infrastructure; to have resulted in damage within the United States, or outside the United States in the case of certain air carriers or vessels or the premises of a United States mission; and to have been committed by an individual or individuals as part of an effort to coerce the civilian population of the United States or to influence the policy or affect the conduct of the United States Government by coercion. Under your coverage, any losses resulting from certified acts of terrorism may be partially reimbursed by the United States Government under a formula established by the Terrorism Risk Insurance Act, as amended. However, your policy may contain other exclusions which might affect your coverage, such as an exclusion for nuclear events. Under the formula, the United States Government Node #DigitalRisk Admitted US Attestation v1.0 2021 2 of 7 #DigitalRisk node INTERNATIONAL generally reimburses 85% through 2015; 84% beginning on January 1, 2016; 83% beginning on January 1, 2017; 82% beginning on January 1, 2018; 81% beginning on January 1, 2019 and 80% beginning on January 1, 2020, of covered terrorism losses exceeding the statutorily established deductible paid by the insurance company providing the coverage. The Terrorism Risk Insurance Act, as amended, contains a $100 billion cap that limits U.S. Government reimbursement as well as insurers' liability for losses resulting from certified acts of terrorism when the amount of such losses exceeds $100 billion in any one calendar year. If the aggregate insured losses for all insurers exceed $100 billion, your coverage may be reduced. The portion of your annual premium that is attributable to coverage for acts of terrorism is _$0_, and does not include any charges for the portion of losses covered by the United States government under the Act. I ACKNOWLEDGE THAT I HAVE BEEN NOTIFIED THAT UNDER THE TERRORISM RISK INSURANCE ACT, AS AMENDED, ANY LOSSES RESULTING FROM CERTIFIED ACTS OF TERRORISM UNDER MY POLICY COVERAGE MAY BE PARTIALLY REIMBURSED BY THE UNITED STATES GOVERNMENT AND MAY BE SUBJECT TO A $100 BILLION CAP THAT MAY REDUCE MY COVERAGE, AND I HAVE BEEN NOTIFIED OF THE PORTION OF MY PREMIUM ATTRIBUTABLE TO SUCH COVERAGE. STATEMENT OF NO KNOWN LOSS To: Node International TA RB Jones Policyholder Name: City of Riverside, Missouri Quote Number: NODE2553612 RE: Statement of No Known Loss I represent that between time of quote and time of bind I am not currently aware of any accidents, facts or circumstances occurring during that time that may result in future claims covered under Node International TA RB Jones. If I do become aware I must inform Node International immediately. Node #DigitalRisk Admitted US Attestation v1.0 2021 3 of 7 #Digital NODE PREVENT PARTNERS node INTERNATIONAL At Node International, we have formed a strategic alliance with a team of top -tier cyber experts to fortify your digital presence and ensure comprehensive risk mitigation while you remain under our protection. Our Node Prevent Cyber Partners bring an abundance of industry experience in privacy and data security, conducting thorough risk assessments, implementing effective cyber risk mitigation strategies, and safeguarding against data breaches. Your online safety is our utmost priority, and with our expert partners by your side, you can rest assured that your cyber defenses are in the best possible hands. Upon activation of your Cyber insurance policy, a host of exclusive services will become available to you. Including: Legal Consultation; Incident Response and Ransomware Negotiation Vendors; Security and Forensics Vendors; Notifications and Credit Monitoring Vendors. Experience the following exceptional benefits included in your Cyber insurance policy: Consultation Complimentary consultation with a cyber expert to review your current cyber risk landscape Newsletter Monthly cyber security newsletter to your risk manager, detailing current threat trends Pre-Claim Assistance Free 24/7 Pre-Claim assistance to contain your attack, breach or ransomware Perirneter Security Complimentary Perimeter Security review and vulnerability baseline risk assessment Endpoint Detection Free EDR (Endpoint Detection & response) service * Training * Complimentary Security Awareness Node #DigitalRisk Admitted US Attestation v1.0 2021 * Please schedule a call with the BTA team to learn more 4 of 7 #DigitalRisk node INTERNATIONAL BLUE TEAM ALPHA PARTNERSHIP Node International has formed a partnership with Blue Team Alpha (BTA) to enhance the benefits available for our cyber insurance policyholders. This collaboration empowers Node International's policyholders to tap into Blue Team Alpha's extensive expertise in cybersecurity tailored for small and mid -sized organizations. By seamlessly integrating with Blue Team Alpha's cybersecurity services, Node International elevates its insurance coverage to a new level. Blue Team Alpha, drawing on expertise from the Department of Defense, FBI, NSA, and other federal agencies, extends its cybersecurity services and solutions to fortify the protection of small to midsize businesses. With the goal of minimizing the likelihood of insurance claims, Blue Team Alpha assists businesses at any stage of their cybersecurity journey, providing valuable insights to enhance their security posture. How Blue Team Alpha interacts with each Node International cyber insurance policy holder: 1. Welcome Email Node International will provide a welcome email with your cyber insurance policy, upon activation of your cyber insurance. At this time, ahost of exclusive services will become available to you from Node International and BTA. 2. BTA Complimentary Consultation Each policy holder should arrange a complimentary cyber security consultation with BTA to review your current cyber risk posture. Sign up for a meeting by sending an email to: node@blueteamalpha.com 3. Request Threat Profile BTA, upon request from the policy holder, provides a complimentary Threat Profile highlighting network risks, compromised passwords from the Dark Web and other vulnerabilities. The Threat Profile is compiled by cybersecurity experts using a variety of open source databases and is intended to give the policy holder insight as to how a hacker would gather reconnaissance to identify vulnerabilities that can be used to launch a cyber attack. 4. Monthly Newsletter You will receive a monthly BTA newsletter to educate you on the current cyber landscape and how to mitigate risk as a small business. BTA can also be contacted directly to support your ongoing monthly Node Detect scans (see page 7). #DigitalRisk node INTERNATIONAL Leverage the expertise of our Node Prevent Partners as your dedicated privacy and security team. Seamlessly integrate them with your in-house security or outsource entirely. Reach out to our Node Prevent Partners for expert assistance and guidance in the following situations: • Establishing comprehensive security awareness training programs. • Implementing robust encryption solutions. • Developing a strong incident response plan for enhanced preparedness. • Considering risk assessment services and budgeting for top-notch EDR or MDR solutions. Incident Response Carbon Black DIGITALGUARDIAN halcyon vmw corelight CROWDSTRIKE Apptega Microsoft Defender Vulnerability Nessus DARKWEB ID DarkWeb Monitoring Security Awareness Training KnowBe4 WIZER Cloud AWS Azure Node #DigitalRisk Admitted US Attestation v1.0 2021 6 of 7 #DigitalRisk node INTERNATIONAL NODE DETECT In addition to our Node Prevent Partners you will also gain exclusive access to our cyber security report via Node Detect for a hassle free domain security solution. Non -intrusive security tests and scans offer invaluable insights, analysis, and recommendations to fortify your domain with the convenience of monthly reports sent directly to your inbox. 1. Hassle-Free Activation Once you take out an insurance policy with us, Node Detect will automatically initiate the necessary scans without any additional effort on your part. No complicated setup or configurations are required. Just sit back and relax as Node Detect gets to work. 2. Monthly Domain Security Reports Node Detect constantly monitors your domain security, capturing monthly snapshots to keep track of any changes of potential vulnerabilities. Stay ahead of potential threats and keep your digital assets safe with your comprehensive report delivered directly to your company. 3. Instant Chat With Node Detect, you have direct access to our team of security professionals through an instant chat feature. Should you have any concerns or questions about the report or any potential issues identified, you can reach out to them for assistance and guidance. 4. Collaboration with Node Prevent Partners Node Detect seamlessly links with our Node Prevent partners, enhancing our capability to address and resolve any identified security issues. This collaborative approach ensures that any potential threats are tackled effectively, further bolstering your company's security measures. Our Node Prevent Partners, along with exclusive Node Detect reports, offer unparalleled guidance, support, and strategic recommendations to strengthen and optimize your cyber defenses effectively. Node Detect Cyber Report example (image) NODE INTERNATIONAL CYBER INSURANCE Cyber Insurance Attestation - NODE2553612 Thank you for considering Node International to provide your cyber insurance. Before you can purchase coverage, we need you to confirm you have read and understood our terms and conditions and completed the form with your details and signature. COMPANY DETAILS Business Name: City of Riverside, Missouri Business Address: 2950 NW Vivion Rd Riverside MT 64150 Industry: Other General Government Support Number Of Employees: 100 Date Established: 1951-01-01 Company Type: Private Number of claims: Zero value in the last 3 years Policy Inception (Start date): 01 July 2025 DECLARATIONS Yourself and employees:  Encrypt all emails containing sensitive information sent to external parties.  Encrypt all sensitive information stored on mobile devices  Have an individual officially designated for overseeing information security  Verify vendor/supplier bank accounts before adding to your accounts payable systems  Authenticate funds transfer requests  Prevent unauthorized employees from initiating wire transfers.  Undertake mandatory information security training at least annually and information security personnel are provided with additional training to help them understand current security threats.  Perform at least annual backups of company data  Have in place at least one of the following, Business Continuity Plan, Disaster Recovery Plan, Incident Response Plan non-renewal of this policy. I understand and agree that my application for this Commercial Cyber Policy will be submitted electronically and the policy documents related to this insurance, including any notices and updates thereto (collectively, the "Policy Documents"), will be made available to me electronically. Node International is authorized to send, and I agree to accept delivery of, all Policy Documents electronically; accordingly, I understand that I will not be receiving copies of tha Pnliry flnri imantc by ctanrlarrl mail i inlacc rani iirari by tha rlanartmant of COMPLETED Thank you for completing the attestation. Please notify your broker you wish to go ahead with your cyber insurance policy with Node International. Signed By: Robin Kincaid authorized by City of Riverside, Missouri #DigitalRisk node INTERNATIONAL APPLICATION FOR A COMMERCIAL CYBER INSURANCE POLICY 1 | Your details Name Of Organization (Applicant): City of Riverside Mailing Address: 2950 NW Vivion Road, Riverside Mo 64150 Type of Ownership Structure: □ Private □ Public Government □ Investment Fund □ Not for Profit Description of Business & NAICS code city government administration offices, police & fire Date Established: June 21, 1951 Number of Employees: 100 Annual Revenue ($): 35,768,000 Website Address(es): www.riversidemo.gov Policy Period Requested: From: 7-1-2025 To: 6-30-2026 2 | Risk Manager Contact Details Please list below the relevent parties whom would like to receive security updates, information and communications regarding your digital wellbeing. Name: Jason Ketter - IT Manager Email: jketter@riversidemo.gov Name: Eddie Seasholtz - IT Assistant Email: eddie@enetkc.com Name: Brian Koral - City Administrator Email: bkoral@riversidemo.gov If you require more users on file please attach them to an email and send them to: it@nodedetect.com Public Facing URLs: files.riversidemo.gov, rspd.riversidemo.gov If.riversidemo.gov publiclf.riversidemo.gov Commerical cyber insurance policy application V1.0 2 of 4 #DigitalRisk node INTERNATIONAL 3 | Underwriting Questions If you find that you do not have sufficient space below to thoroughly answer a question, please continue your responses on a separate sheet of paper and attach to this Application. 1. Encryption a. Does Your organization encrypt all emails containing sensitive information (including, but not limited to, Personally Identifiable Information (PII), Personal Health Information (PHI), Payment Card Information (PCI)) sent to external parties? YES b. Does Your organization encrypt all sensitive information (including, but not limited to, PII, PHI, PCI) stored on computing and/or mobile devices (including, but not limited to, phones, tablets, laptops, wearable computers, flash drives)? YES 2. Information Security Leadership a. Does Your organization have an individual officially designated for overseeing information security? YES 3. Employee Management a. Does Your organization provide mandatory information security training to all employees at least annually? YES b. If yes, are Your information security personnel provided with additional training to help them understand current security threats? YES 4 | Past Activites 1. Please attach Your organization's Loss History for the past five (5) years, if applicable. 2. Has your organization ever been a party to any of the following a. Civil or criminal action or administrative proceeding alleging violation of any federal, state, local or common law? NO b. Is there currently any pending litigation, administrative proceeding or claim against the named applicant, organization and/or any of the prospective insured? NO 3. During the last three (3) years, has Your organization suffered a security breach requiring customer or third -party notification according to state or federal regulations? NO Commerical cyber insurance policy application V1.0 3 of 4 #DigitalRisk node INTERNATIONAL 5 | Optional Endorsement 1. Do You want to add Additional Insured? NO If you answered Yes, please fill out the following for the Additional Insured: i. Name of Organization: City of Riverside ii. Mailing Address: 2950 NW Vivion Rd, Riverside MO 64150 iii. Description of Business & NIACS code: Government 6 | Cyber Crime Questions 1a. Do You or Your employees verify vendor/supplier bank accounts before adding to your accounts payable systems? YES b. Do You or Your employees authenticate funds transfer requests (e.g. by calling a customer to verify the request at a predetermined phone number)? YES c. Do You or Your employees prevent unauthorized employees from initiating wire transfers? YES 7 | Important Notice THIS INSURANCE POLICY PROVIDES COVERAGE ON A CLAIMS -MADE AND REPORTED BASIS AND APPLIES ONLY TO CLAIMS FIRST MADE AND REPORTED TO THE INSURER DURING THE POLICY PERIOD OR ANY APPLICABLE EXTENDED PERIOD. DEFENSE EXPENSES, WHERE APPLICABLE, ARE INCLUDED IN THE LIMITS OF INSURANCE, AND PAYMENT THEREOF WILL ERODE, AND MAY EXHAUST THE LIMITS OF INSURANCE. IF ISSUED, PLEASE READ YOUR POLICY CAREFULLY. The words "You" and "Your" in this Application refers to the Applicant's organization and any entity for whom this insurance is intended. Note: It is recommended that the person completing this Application consult with the person(s) within the company who is responsible for information/technology. Signed: /s/ Robin Kincaid Position Held: City Clerk Email address: rkincaid@riversidemo.gov Full Name: Robin Kincaid Date: June 5, 2025 Phone number: 816-372-9008 Commerical cyber insurance policy application V1.0 4 of 4 #Digital node INTERNATIONAL Node International provides a unique package of comprehensive coverage, leading cyber, security prevention measures and expert monitoring of your systems 24/7. INSURANCE PREVENTION DETECTION Node International - One Minster Court, Mincing Lane, London EC3R 7AA Email: info@nodeinternational.com Telephone: (+44) 207 337 3524 Node International Ltd Authorised and Regulated by the Financial Conduct Authority // .c:2020 Node International Ltd. All Rights Reserved. PREVENTION node INTERNATIONAL COMMERCIAL CYBER INSURANCE POLICY THIS POLICY IS A CONTRACT OF INSURANCE BETWEEN YOU AND US. YOUR POLICY CONTAINS ALL THE DETAILS OF THE COVER THAT WE PROVIDE. THIS POLICY CONSISTS OF AND MUST BE READ TOGETHER WITH THE DECLARATIONS PAGE AND ANY ENDORSEMENTS. THE INSURANCE PROVIDED UNDER THIS POLICY FOR CLAIMS MADE AGAINST YOU IS ON A CLAIMS MADE AND REPORTED BASIS, AND APPLIES TO CLAIMS ONLY IF THEY ARE FIRST DISCOVERED BY YOU DURING THE POLICY PERIOD AND REPORTED TO US DURING THE POLICY PERIOD OR ANY APPLICABLE EXTENDED REPORTING PERIOD. THE SECURITY BREACH LIABILITY INSURING AGREEMENT CONTAINED IN THIS POLICY PROVIDES COVERAGE FOR DEFENSE EXPENSES WHICH ARE PAYABLE WITHIN, AND NOT IN ADDITION TO, THE LIMIT OF INSURANCE. PAYMENT OF DEFENSE EXPENSES UNDER THIS POLICY WILL REDUCE THE LIMIT OF INSURANCE. PLEASE READ THE ENTIRE POLICY CAREFULLY. Various provisions in this Policy restrict coverage. Read the entire Polic refully to determine rights, duties and what is and is not covered. Throughout this Policy, the words "You" and "Your" refer to the Named words "We," "Us," and "Our" refer to the company providing thi •surance. shown in the Declarations. The All terms that appear in bold print are defined terms and ec . ning as set forth in Section I — Insuring Agreements and Section VII — Definitions. SECTION I — INSURING AGREEMENTS Coverage is provided under the following Insuring Agreements up to the Limits of Insurance shown in the Declarations. Any Cyber Incident, Extortion Threat, Security Breah, or Claim that arises out of the same facts or circumstances and results in Loss under one or more of the following Insuring Agreements will be deemed to be related and, as such, will be deemed to have been Discovered during the earliest policy period that any such related Cyber Incident, Extortion Threat, Security Breach, or Claim was Discovered. 1. Security Breach Expense Breach, or Claim that arises out of the same facts or or more of the following Insuring Agreements will be deemed to be been Discovered during the earliest policy period that any such Security Breach, or Claim was Discovered. We will pay for Loss resulting directly from a Security Breach or Cyber Incident Discovered during the Policy Period or any Extended Reporting Period, if applicable. With respect to this Insuring Agreement 1, Loss means: a. Forensics Expenses — Including Breach Counsel Expenses The costs incurred with Our approval to establish whether a Security Breach or Cyber Incident has occurred or is occurring. If a Security Breach has occurred, the following costs are also included: costs to investigate the cause, scope and extent of a Security Breach and to identify any affected parties; and SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 20 node INTERNATIONAL ii. costs to determine any action necessary to remediate the conditions that led to or resulted from a Security Breach including, but not limited to, fees paid for legal and other professional advice on how to respond to the Security Breach. b. Notification Expenses — Including Breach Counsel Expenses Costs to notify all parties affected by a Security Breach including, but not limited to, notice to be transmitted through media: as required by Privacy Regulations; or ii. subject to Our prior approval, as appropriate on a voluntary basis. c. Overtime Salaries Reasonable overtime salaries paid to Employees assigned to handle inquiries from the parties affected by a Security Breach. d. Call Center Expenses Fees and costs of a company hired by You with Our prior approval for the purpose of operating a call center to handle inquiries from the parties affected by a Security Breach. e. Post-event Monitoring Expenses Costs to provide credit and identity monitoring services to the affected parties of a Security Breach for up to one year, or longer if required by applicable law, from the date of notification to those affected parties of such Security Breach. f. Public Relations Expense Fees and costs of a public relations firm and any other reasonable expenses incurred by You with Our prior written consent to protect or restore Your reputation solely in response to "negative publicity". As used in this provision, "negative publicity" means information which has been made public that has caused, or is reasonably likely to cause, a decline or deterioration in the reputation of the Named Insured or one or more of its products or services. g. Other Expenses Any other reasonable expenses incurred by You in connection with a Security Breach or Cyber Incident with Our prior written consent. With respect to this Insuring Agreement 1, Loss does not include any costs or expenses associated with upgrading or improving a Computer System as a result of a Security Breach. 2. Extortion Threats We will pay for Loss resulting directly from an Extortion Threat that is Discovered during the Policy Period or any extended reporting period, if applicable. With respect to this Insuring Agreement 2, Loss means: a. Fees and costs of: i. a security firm; or SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 20 node INTERNATIONAL ii. a person or organization; hired with Our consent to determine the validity and severity of an Extortion Threat made against You. b. Interest costs paid by You for any loan from a financial institution taken by You to pay a ransom demand. c. Reward payments paid by You to an "informant" which lead to the arrest and conviction of parties responsible for Loss. As used in this provision, "informant" means a person, other than an Employee, providing information not otherwise obtainable, solely in return for a reward offered by You. d. Any other reasonable expenses incurred by You with Our written consent, including, but not limited to: i. fees and costs of independent negotiators; and ii. fees and costs of a company hired by You, upo '- recommendation of the security firm, to determine how to protect Your Electronic from further threats. e. Monetary value of any Ransom Payment made by You to a third party for Random Demands. 3. Replacement or Restoration of Electronic Data We will pay for Loss of Your Electronic Data or "computer programs" stored within a Computer System resulting directly from a Cyber Incident that is Discovered during the Policy Period or any extended reporting period, if applicable. With respect to this Insuring Agreement 3, Loss means the costs to replace or restore Your Electronic Data or "computer programs" as well as the cost of data entry, reprogramming and computer consultation services. With respect to this Insuring Agreement 3, Loss does not include the cost to duplicate research that led to the development of Your Electronic Data or "computer programs". To the extent that any of Your Electronic Data cannot be replaced or restored, We We will pay the cost to replace the media on which such Electronic Data was stored with blank media of substantially identical type. As used in this Insuring Agreement 3, "computer programs" means a set of related electronic instructions, which direct the operation and function of a computer or devices connected to it, which enables the computer or devices to receive, process, store or send Your Electronic Data. 4. Business Income, Contingent Business Income and Extra Expense We will pay for Loss due to an Interruption resulting directly from a Cyber Incident or an Extortion Threat that is Discovered during the Policy Period or during any extended reporting period, if applicable. With respect to this Insuring Agreement 4, Loss means the actual Loss of: (1) "business and contingent business income" You sustain; and/or (2) "extra expense" You incur. As used in this Insuring Agreement 4: a. "Business and contingent business income" means the: net income (net profit or loss before income taxes) that would have been earned or incurred; and SP CW 99 02 23 Includes copyrighted material of Insurance Services Office. Inc., with its permission Page 3 of 20 node INTERNATIONAL ii. continuing normal operating expenses incurred, including payroll. "Business and contingent business" income does not include: (1) Net Profit that may or would likely have been earned as a result of an increase in volume due to favorable business conditions caused by the impact of network security failures impacting other businesses, loss of market, or any other consequential loss b. "Extra expense" means necessary and reasonable expenses You incur: during an Interruption that You would not have incurred if there had been no interruption; or ii. to avoid or minimize the suspension of Your E-Commerce Activities. "Extra expense" does not include: (1) any costs or expenses associated with upgrading, maintaining, repairing, remediating or improving a Computer System as a result of a Cyber Incident or Extortion Threat; or (2) Extortion Expenses covered under Insuring A. -ment 2 — Extortion Threats. 5. Security Breach Liability Including Payment Card Industry (PCI) Fines and Penalties We will pay for: a. Loss that the Insured becomes legally obligated to pay and Defense Expenses as a result of a Claim that is Discovered during the Policy Period or any Extended Reporting Period, if applicable, for a Wrongful Act or a series of Interrelated Wrongful Acts taking place on or after Your first date of continuous coverage with Us and before the end of the Policy Period. b. Loss and Defense Expenses as a result of a Claim in the form of a Regulatory Proceeding that is Discovered during the Policy Period or any extended reporting period, if applicable, in response to a Wrongful Act or a series of Interrelated Wrongful Acts taking place on or after Your first date of continuous coverage with Us and before the end of the Policy Period. c. Loss and Defense Expenses as a result of a Claim in the form of an action by a Card Company for non-compliance with the Payment Card Industry (PCI) Data Security Standards that is Discovered during the Policy Period or any extended reporting period, if applicable, in response to a Wrongful Act or a series of Interrelated Wrongful Acts taking place on or after Your first date of continuous coverage with Us and before the end of the Policy Period. With respect to this Insuring Agreement 5: Loss means: (1) compensatory damages, settlement amounts and costs awarded pursuant to judgments or settlements; (2) punitive and exemplary damages to the extent such damages are insurable by law; (3) fines or penalties assessed against the Insured to the extent such fines or penalties are insurable by law; or (4) the monetary amount owed by You under the terms of a PCI merchant services agreement with a Card Company as a direct result of a Security Breach. Loss does not include: (a) civil or criminal fines or penalties imposed by law, except civil fines or penalties as provided under Paragraph i.(3) above; SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 4 of 20 node INTERNATIONAL (b) the multiplied portion of multiplied damages; (c) taxes; (d) royalties; (e) the amount of any disgorged profits; (f) matters that are uninsurable pursuant to law; (9) any fees resulting from the recall, re -performance or correction of services, content, goods or activities; (h) the costs to comply with injunctive or other non -monetary relief; or (i) liquidated damages pursuant to a contract, to the extent such amount exceeds the amount for which You would have been liable in the absence of such contract, except for amounts under Paragraph i.(4) above. ii. Defense Expenses means the reasonable and necessary fees (attorneys' and experts' fees) and expenses incurred in the defense or appeal of a Claim, including the cost of appeal, attachment or similar bonds (without any obligation on Our part to obtain such bonds) but excluding wages, salaries, benefits or expenses of Your Employees. iii. Wrongful Act means any actual or alleged: (1) Security Breach; (2) failure to prevent unauthorized access to, or use of, elecronic or non-electronic data containing Personal Information; (3) failure to prevent the transmission of a Virus through a Computer System into a computer network, any application software, or a computer operating system or related network that is not rented, owned, leased by, licensed to or under the direct operational control of the Insured; or (4)) failure to provide notification of any actual or potential Security Breach if such notification is required by any security breach notification law; by, or asserted against an Insured. iv. Interrelated Wrongful Acts means all Wrongful Acts that have as a common nexus any i) fact, circumstance, situation, event, transaction or cause; or ii) series of causally connected facts, circumstances, situations, events, transactions or causes. v. Regulatory Proceeding means an investigation, demand or proceeding brought by, or on behalf of, the Federal Trade Commission, Federal Communications Commission, the Department of Health and Human Services or other administrative or regulatory agency, or any federal,s tate, local or foreign governmental entity in such entity's regulatory or official capacity, including, but not limited to any investigation, demand, or proceeding, brought by administrative or regulatory agency whether involving the California Consumer Privacy Act (CCPA), the General Data Protection Regulation (GDPR), or similar privacy regulations. SECTION II — LIMITS OF INSURANCE 1. Policy Aggregate Limit of Insurance The most We will pay for all covered Loss and Defense Expenses is the Policy Aggregate Limit of Insurance shown in the Declarations. The Policy Aggregate Limit of Insurance shall be reduced by any payment, including Defense Expenses, made under the terms of this Policy. Upon exhaustion of the Policy Aggregate Limit of Insurance by such payments, We will have no further obligations or liability of any kind under this Policy. SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 5 of 20 node INTERNATIONAL 2. Aggregate Sublimit(s) of Insurance The Aggregate Sublimit(s) of Insurance set forth in the Declarations are part of, and not in addition to, the Policy Aggregate Limit of Insurance. Any such Aggregate Sublimit(s) of Insurance shall be reduced by any payment for Loss and, if applicable, Defense Expenses, under the Insuring Agreement to which such Aggregate Sublimit of Insurance applies. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments, We will have no further obligations or liability of any kind with respect to Loss or Defense Expenses, subject to such Sublimit of Insurance. SECTION III — DEDUCTIBLE Subject to Section II — Limits of Insurance: 1. Under Insuring Agreements 1 — Security Breach Expense, 2 — Extortion Threats and 3 — Replacement or Restoration of Electronic Data, We will pay only the amount of Loss which is in excess of the Policy Deductible amount shown in the Declarations. 2. Under Insuring Agreement 4 — Business Income, Contingent Business Income and Extra Expense: We will pay only the amount of Loss which exceeds the greatest of the following deductible amounts: a. The Policy Deductible Amount shown in the Declarations; or b. The amount of Loss incurred during the Time Deductible shown in the Declarations. 3. Under Insuring Agreement 5 — Security Breach Liability including Payment Card Industry (PCI) Fines and Penalties: We will pay only the amount of Loss and Defense Expenses, which is in excess of the Policy Deductible Amount shown in the Declarations, resulting from the same Wrongful Act or Interrelated Wrongful Acts. Such Policy Deductible Amount will be borne by You, self-insured, and at Your own risk. 4. The Policy Deductible applies separately to each Cyber Incident, Extortion Threat, Security Breach, Wrongful Act, Interrelated Wrongful Acts, or Claim. In the event a Loss is covered under more than one Insuring Agreement, only the single highest deductible amount applicable to the Loss shall be applied. SECTION IV — DEFENSE A The provisions contained within this - on apply only to Insuring Agreement 5 — Security Breach Liability Including Payment Card Industry (PCI) Fines and Penalties: We shall have the right and duty to select counsel and defend the Insured against any Claim covered under Paragraph 5.a of Insuring Agreement 5 — Security Breach Liability Including Payment Card Industry (PCI) Fines and Penalties, even if the allegations of such Claim are groundless, false or fraudulent. However, We shall have the right but not the duty to defend the Insured against a Claim covered under Paragraph 5.b of Insuring Agreement 5 - Security Breach Liability Including Payment Card Industry (PCI) Fines and Penalties and We shall have no duty to defend the Insured against any Claim which is not covered under such Insuring Agreement. We may, upon the written consent of the Insured, make any settlement of a Claim which We deem reasonable. If the Insured withholds consent to such settlement, Our liability for all Loss resulting from such Claim will not exceed the amount for which We could have settled such Claim, plus Defense Expenses incurred, as of the date We proposed such settlement in writing to the Insured. Upon refusing to consent to a settlement We deem reasonable, the Insured shall, at its sole expense, assume all further responsibility for its defense, including all additional Defense Expenses, costs associated with the investigation, defense and/or settlement of such Claim. SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 6 of 20 node INTERNATIONAL SECTION V — EXCLUSIONS We will not be liable for Loss or Defense Expenses directly or indirectly based upon, attributable to or arising out of: 1. Lightning, earthquake, hail, volcanic action, wind, smoke, explosion, tidal wave or flood, landslide, electromagnetic pulse, or other electromagnetic disturbances and/or any Space Weather as classified by NOAA, tornado, or any other act of God or nature. 2. Any of the following: a. War, including undeclared or civil war or civil unrest; b. Warlike action by military force, including action hindering or defending against an actual or expected attack, by any government, sovereign or other authority using military personnel or other agents; c. Insurrection, rebellion, revolution, usurped power or action taken by government authority in hindering or defending against any of these; d. Any Cyber Incident, Security Breach, or other Wrongful Act by or on behalf of any government, sovereign, state, or other authority sponsored actor or group that results in, or is carried out in the course of, any of the events in part a, b, or c above. 3. The dispersal or application of pathogenic or poisonous biological or chemical materials, nuclear reaction, nuclear radiation or radioactive contamination, or any related act or incident, however caused. 4. Bodily Injury or physical damage to or destruction of tangible property, including loss of use thereof. Bodily Injury means bodily injury, sickness or disease sustained by a person, including death resulting from any of these at any time. It also means mental injury, mental anguish, mental tension, emotional distress, pain or suffering or shock sustained by any person. However, Bodily Injury does not mean anguish or emotional distress resulting directly from a Security Breach or Cyber Incident. 5. Any disruption in normal computer function or network service or function due to insufficient capacity to process transactions or due to an overload of activity on a Computer System or network. However, this exclusion shall not apply if such disruption is caused by a Cyber Incident or Security Breach. 6. Any disruption of i) internet e; or ii) any external telecommunication network, regardless of the cause; or iii) failure or termination of any core element of internet, telecommunications, or GPS infrastructure that results in a regional, countrywide, or global outage of such infrastructure; or iv) failure of power supply and other utilities unless the provision of power and other utility services is under the Named Insured's direct control. However, parts i) and ii) of this exclusion shall not apply if such disruption is caused by a denial of service attack under Paragraph b. of Definition 5. Cyber Incident. 7. Any failure of, reduction in or surge of power, regardless of the cause. 8. Any actual or alleged violation of the Racketeer Influenced and Corrupt Organizations Act (RICO) and its amendments, or similar provisions of any federal, state or local statutory or common law. 9. Any malfunction or failure of any satellite. 10. Any actual or alleged oral or written publication of material, if done by an Insured or at an Insured's direction with knowledge of its falsity. SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 7 of 20 node INTERNATIONAL 11. An Insured's assumption of liability by contract or agreement, whether oral or written. However, this exclusion shall not apply to any liability that an Insured would have incurred in the absence of such contract or agreement. 12. Any actual or alleged patent or trade secret violation, including any actual or alleged violation of the Patent Act, the Economic Espionage Act of 1996 or the Uniform Trade Secrets Act and their amendments. 13. Any of the following: a. The actual, alleged or threatened discharge, dispersal, seepage, migration, release or escape of Pollutants at any time; b. Any request, demand, order or statutory or regulatory requirement that any Insured or others test for, monitor, clean up, remove, contain, treat, detoxify or neutralize, or in any way respond to, or assess the effects of, Pollutants; or c. Any Claim or Suit brought by, or on behalf of, any governmental authority for damages because of testing for, monitoring, cleaning up, removing, containing, treating, detoxifying or neutralizing, or in any way responding to, or assessing the effects of, Pollutants. 14. Any Claim, Suit or other proceeding against an Insured which pending or existed prior to the Policy Period or arising out of the same or substantially the same acts, facts, circumstances or allegations which are the subject of, or the basis for, such Claim, Suit or other proceeding. 15. Any actions or activities related to an Insured's practices as an employer including, but not limited to, refusal to employ, termination of employment, coerction, demotion, evaluation, reassignment, discipline, defamation, harassment, humiliation, discrimination or malicious prosecution. This exclusion applies: a. Whether the injury-causing event described above occurs before employment, during employment or after employment of that person; b. Whether the Insured may be liable as an employer or in any other capacity; and c. To any obligation to share damages with or repay someone else who must pay damages because of the injury. However, this exclusion will not apply to any Claim resulting directly from a Privacy Breach related to the Personal information of an Employee. 16. Any Cyber Incident, Extortion Threat, Security Breach, Wrongful Act, or Interrelated Wrongful Acts that any Insured became aware prior to the effective date of the Policy. 17. The same facts, Cyber Incident, Extortion Threat, Security Breach, Wrongful Act, or Interrelated Wrongful Acts alleged or contained in any Claim which has been reported, or in any circumstances of which notice has been given, under any insurance policy of which this Policy is a renewal or replacement. 18. Any criminal, dishonest, malicious or fraudulent act, error or omission or any willful violation of any statute or regulation committed by an Insured, acting alone or in collusion with others. However, with the exception of Claims excluded under Exclusion 12., this exclusion shall not apply to any dishonest, malicious or fraudulent act, error or omission committed by an Employee which gives rise to a Claim or Loss covered under Insuring Agreement 1 — Security Breach Expense or Insuring Agreement 5 — Security Breach Liability Including Payment Card Industry (PCI) Fines and Penalties. This exception does not apply to any Employee who is a Chief Executive Officer, Chief Financial Officer, Chief Security Officer, Chief Technology Officer, Chief Information Officer, Risk Manager, General Counsel, owner, general manager or any functionally equivalent positions of the Insured or any Subsidiary, regardless of title. With the exception of Claims excluded under Exclusion 12, We will defend the Insured against any Claim alleging such acts or violations until final adjudication is rendered against that Insured. Final adjudication SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 8 of 20 node INTERNATIONAL rendered against one Insured shall not be imputed to any other Insured. We will not provide indemnification for any Claim to which any Insured enters a guilty plea or pleads no contest and We will not provide a defense from the time We become aware that any Insured intends to so plead. 19. Any action or proceeding brought by, or on behalf of, any governmental authority or regulatory agency including, but not limited to: a. The seizure or destruction of property by order of a governmental authority; b. Regulatory actions or proceedings brought by, or on behalf of, the Federal Trade Commission, Federal Communications Commission or other regulatory agency, except when covered under Paragraph c. a of Insuring Agreement 5 — Security Breach Liability Including Payment Card Industry (PCI) Fines and Penalties; or c. The shutdown or seizure of systems or services by a government or regulatory body. However, this exclusion shall not apply to actions or proceedings brought by a governmental authority or a regulatory agency acting solely in its capacity as a customer of the Named Insured or of a Subsidiary. 20. Any costs or expenses associated with upgrading or improving a Computer System regardless of the reason. 21. Any Claim brought or alleged by one Insured against another, except for a Claim brought or alleged by an Employee against an Insured as a result of a Security Breach or Cyber Incident. 22. Fines, penalties or assessments imposed pursuant to contract or agreement, whether oral or written, including, but not limited to, Payment Card Industry (PCI) fines, penalties or assessments. This exclusion shall not apply to the coverage provided under Paragraph c. of Insuring Agreement 5 - Security Breach Liability Including Payment Card Industry (PCI) Fines and Penalties. 23. Any costs related to loss of any virtual currency. 24. Any actual or alleged restraint of trade, monopolization, unfair trade, price fixing, violation of the Federal Trade Commission Act, the Sherman Antitrust Act, the Clayton Act, including any amendment thereto or any rule or regulation promulgated under any such statute, or any similar foreign, federal, state or local statute, rule or regulation. However, this exclusion shall not apply to a Claim alleging unfair or deceptive acts or practices in or affecting commerce under Section 5(a) of the Federal Trade Commission Act (15 U.S.C. 45(a)). 25. any of the following: a. Unlawful or unauthorized collection, harvesting, processing, storage, transfer, distribution or sale of Personal Information or other data; b. Wiretapping, eavesdropping, improper consent practices, unlawful or unauthorized use of tracking/monitoring/surveillance software tools, or audio or video recording; or c. Violation of the Illinois Biometric Information Privacy Act or similar provisions of any federal, state, local, or foreign statutory or common law, directive or regulation regulating the collection, handling, use, or storage of biometric data and/or any required disclosures thereof. However, section 25.b of this exclusion will not apply to Defense Expenses incurred for the failure to prevent unauthorized access to, or use of, electronic or non -electronic data containing identity information. 26. a. The purchase or sale of or offer to purchase or sell any securities or any violation of the Securities Exchange Act of 1934 or the Securities Act of 1933 and any amendments thereto or any other foreign, federal, state or local statute, or any rule or regulation promulgated under such statutes, that regulates the offering, sale or purchase of securities. SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 9 of 20 node INTERNATIONAL b. Any Claim brought by any security holder of the Insured, in their capacity as such, whether directly, by class action, or derivatively on behalf of the Insured. 27. Any Claim arising out of, caused by or related to a "Technology Errors & Omissions Wrongful Act." For purposes of this exclusion, the following definitions apply: a. "Technology Errors & Omissions Wrongful Act" means any negligent act, error or omission, including any negligent act, error or omission resulting in a breach of contract or in a failure of "Technology Products" to perform the function or serve the purpose intended by an Insured or by a person or entity for whom the Insured is legally liable, in the performance of "Technology Services." b. "Technology Services" means the following services performed for others for compensation by an Insured or by any other person or entity for whom the Insured is legally liable: i. analysis, design, integration, wiring, cabling, or conversion of computer and electronic technology systems or networks; ii. designing, developing, programming, servicing, distributing, licensing, installing, maintaining and repairing computer software, computer code and computer firmware or hardware; iii. education and training in the use of computer dw- - or software; iv. information services; v. computer consulting; vi. computer and network security servie not limited to providing content c. filtering, patch administration and s vii. internet services; or viii. data processing in connection to storing, collecting, comp analysis of data. "Technology Products" mean product, equipment or devic "Technology Services," telecom manufactured, develop by others acting under th SECTION VI — CONDITION 1. Cancellation a. includin udits; ve listed services, including but not limited ssing, mining, conversion, encryption, recording or rdware, firmware, software, or related electronic y -signed or intended for use in connection with any systems or telecommunication service that is created, licensed, leased or sold by the Insured or for any Insured rade name. The first Named Insured shown in the Declarations may cancel this Policy by mailing or delivering to Us advance written notice of cancellation. b. We may cancel this Policy by mailing or delivering to the first Named Insured written notice of cancellation at least: c. 10 days before the effective date of cancellation if We cancel for nonpayment of premium; or ii. 30 days before the effective date of cancellation if We cancel for any other reason. We will mail or deliver Our notice to the first Named Insured's last mailing address known to Us. d. Notice of cancellation will state the effective date of cancellation. The Policy Period will end on that date. e. If this Policy is canceled, We will send the first Named Insured any premium refund due. If We cancel, the refund will be prorated. If the first Named Insured cancels, the refund may be less than pro rata. The cancellation will be effective even if We have not made or offered a refund. SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 10 of 20 node INTERNATIONAL f. If notice is mailed, proof of mailing will be sufficient proof of notice. 2. Changes This Policy contains all the agreements between You and Us concerning the insurance afforded. The first Named Insured shown in the Declarations is authorized to make changes in the terms of this Policy with Our consent. This Policy's terms can be amended or waived only by endorsement issued by Us and made a part of this Policy. 3. Examination of Your Books and Records We may examine and audit Your books and records as they relate to this Policy at any time during the Policy Period shown in the Declarations and up to three years afterward. 4. Inspections and Surveys We have the right to i) make inspections and surveys at any time; ii) give You reports on the conditions We find; and iii) recommend changes. We are not obligated to make any inspections, surveys, report rec• • mendations, and any such actions We do undertake relate only to insurability and the premiu t. .e ch rged. We do not make safety inspections. We do not undertake to perform the duty of any pers. .r or• . ization to provide for the health or safety of workers or the public. And We do not warran at condit . are safe or healthful; or ii) comply with laws, regulations, codes or standards. Paragraph 2 of this condition applies not only tny rating, advisory, rate service or similar organization which makes insurance inspec ' s, -ys, reports or recommendations. 5. Premiums The first Named Insured shown in the s: i) is responsible for the payments of all premiums; and ii) will be the payee for any retu pay. 6. Transfer of Your Rights; Dut nder This Policy Your rights and duties - s o y may not be transferred without Our written consent, except in the case of death of an indivi•ual N. ed Insured. If You are a sole proprietor and You die, Your rights and duties will be transferred to Your legal representative but only while acting within the scope of duties as Your legal representative. Until Your legal representative is appointed, anyone having proper temporary custody of Your property will have Your rights and duties but only with respect to that property. 7. Subrogation With respect to any payment made under this Policy, We shall be subrogated to the Insureds rights of recovery to the extent of such payment. The Insured shall execute all papers required and shall do everything necessary to secure and preserve such rights, including the execution of such documents necessary to enable Us to bring suit in the Insured's name. Any recoveries, less the cost of obtaining them, will be distributed as follows: a. To You, until You are reimbursed for any Loss You sustain that exceed the sum of the Policy Limit of Insurance and the Deductible Amount, if any; b. Then to Us, until We are reimbursed for the payment made under this Policy; and c. Then to You, until You are reimbursed for that part of the payment equal to the Deductible Amount, if any. SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 11 of 20 node INTERNATIONAL 8. Bankruptcy Your bankruptcy, or the bankruptcy of Your estate if You are a sole proprietor, will not relieve Us of Our obligations under this Policy. 9. Representations You represent that all information and statements contained in the Application are true, accurate and complete. All such information and statements are the basis for Our issuing this Policy. Misrepresentation of any material fact may be grounds for the rescission of this Policy. 10. Changes in Exposure a. Acquisition or Creation of Another Organization If before or during the Policy Period: i. You acquire securities or voting rights in - • . her organization or create another organization which, as a result of such acquis ' . or -ation, becomes a Subsidiary; or ii. You acquire any organization through merge c• olidion; then such organization will be covered under t Policy bu with respect to Wrongful Acts or Loss which occurred after the effective date acgt ition or creation provided, with regard to Paragraphs a.(i) and a.(ii) above, You: (1) give Us written notice of th- q�or creation of such organization within ninety (90) days after the effective date ` c tion; (2) obtain Our written c. sent l e the coverage provided by this Policy to such organization; and (3) upon obtaining Our con- •t, s an additional premium. b. Acquisition of Named I If during the Po, the Name Ins d merges into or consolidates with another organization, such that the Named In is not the surviving organization; or ii. another organization, or person or group of organizations and/or persons acting in concert, acquires securities or voting rights which result in ownership or voting control by the other organization(s) or person(s) of more than fifty percent (50%) of the outstanding securities or voting rights representing the present right to vote for the election of directors, trustees or managers (if a limited liability company) of the Named Insured; then the coverage afforded under this Policy will continue until the end of the Policy Period, but only with respect to Claims arising out of Wrongful Acts which occurred prior to the effective date of such merger, consolidation or acquisition. The full annual premium for the Policy Period will be deemed to be fully earned immediately upon the occurrence of such merger, consolidation or acquisition of the Named Insured. The Named Insured must give written notice of such merger, consolidation or acquisition to Us as soon as practicable, together with such information as We may reasonably require. c. If, before or during the Policy Period, an organization ceases to be a Subsidiary, the coverage afforded under this Policy with respect to such Subsidiary will continue until the end of the Policy SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 12 of 20 node INTERNATIONAL Period but only with respect to Claims arising out of Wrongful Acts which occurred prior to the date such organization ceased to be a Subsidiary. 11. Other Insurance Under Insuring Agreements 1 — Security Breach Expense, 2 — Extortion Threats or 3 — Replacement or Restoration of Electronic Data: If any covered Claim or Loss is insured by any other valid policy, then this Policy shall apply only in excess of the amount of any deductible, retention and limit applicable to such other insurance, whether such other policy is stated to be primary, contributory, excess, contingent or otherwise, unless such other policy is written specifically excess of this Policy by reference in such other policy to this Policy's policy number. When this Policy is excess, We shall have no duty under Insuring Agreement 5 — Security Breach Liability Including Payment Card Industry (PCI) Fines and Penalties to defend the Insured against any Suit if any other insurer has a duty to defend the Insured against that Suit. If any covered Claim or Loss is insured by any other valid policy issued by Us, our liability under this Policy and such other policy combined shall not exceed the amount of thglargest applicable Aggregate Limits or Sublimit(s) of Insurance. 12. Legal Action Against Us No person or organization has a right: i) to join Us as arty or otIse bring Us into a Suit asking for damages from an Insured; or ii) to sue Us under thiiQII riles II of its terms have been fully complied with. A person or organization may sue Us to rec Insured, but We will not be liable for damag Breach Liability Including Payment C. • Indu Policy Aggregate Limit of Insurance. signed by Us, the first Named Inured agreed settlement or on a final judgment against an of payable under Insuring Agreement 5 — Security Fines and Penalties, or that are in excess of the lement means a settlement and release of liability mant or the claimant's legal representative. You may not bring any legal acti Us involving Loss: i) unless You have complied with all the terms of this Policy; ii) un ty ( days after You have filed proof of loss with Us; and iii) unless brought within two (2) years fro reported the Loss to Us. If any limitation in this condition i rohibited by law, such limitation is amended so as to equal the minimum period of limitation provide ch law. 13. Separation of Insureds Except with respect to the Policy Aggregate Limit of Insurance, and any rights or duties specifically assigned in Insuring Agreement 5 — Security Breach Liability Including Payment Card Industry (PCI) Fines and Penalties to the first Named Insured, this Policy applies separately to each Insured against whom a Claim is made. 14. Duties in the Event of Claim or Loss After a situation that results in, or may result in, a Loss covered under this Policy is Discovered, You must notify Us in writing as soon as practicable, but not to exceed thirty (30) days from the date Discovered, and cooperate with Us in the investigation and settlement of the Claim or Loss. Additionally: a. Under Insuring Agreements 1 — Security Breach Expense, 2 — Extortion Threats, 3 — Replacement or Restoration of Electronic Data, and 4 — Business Income and Extra Expense, You must: notify local law enforcement officials; SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 13 of 20 node INTERNATIONAL ii. submit to examination under oath at Our request and give Us a signed statement of Your answers; and iii. At Our request give Us a detailed, sworn proof of loss within one hundred twenty (120) days. In addition, under Insuring Agreement 2 — Extortion Threats, You must also: (1) (2) (3) (4) b. Under determine that the Extortion Threat has actually occurred; and with respect to Ransomware, make every reasonable effort to access Your Electronic Data from backup, if any, and to remediate the cause of the Ransomware; and make every reasonable effort to immediately notify Us before making any ransom payment based upon the Extortion Threat; and approve any ransom payment based upon the Extortion Threat. Insuring Agreement 5 — Security Breach Liability Including Payment Card Industry (PCI) Fines and Penalties, You must: i. immediately record the specifics of the Claim and the date Discovered; ii. immediately send Us copies of any demands, n. ' -s, summonses or legal papers received in connection with the Claims; authorize Us to obtain records and other info i. , and iv. assist Us, upon Our request, in the enforcemen . ny s t against any person or organization which may be liable to YoJecause apply. oss to which this Policy may also You will not, except at Your own cost, makpayment, assume any obligation or incur any expense without Our consent. 15. Extended Reporting Periods a. Automatic Extended If the Named Insured c Policy, or if there is decr retention, new on, o have an autom renews this Policy, the Insurer cancels or non -renews this n its, reduction of coverage, increased deductible or self -insured ny other change less favorable to the Insured, then the Insured will able 60-day Extended Reporting Period. b. Supplemental Ext d Reporting Period If the Named Insured cancels or non -renews this Policy, the Insurer cancels or non -renews this Policy, or if there is a decrease in limits, reduction of coverage, increased deductible or self -insured retention, new exclusion, or any other change less favorable to the Insured, the Named Insured will have the right to purchase an optional Extended Reporting Period of up to three (3) years to immediately follow the automatic Extended Reporting Period. The optional Extended Reporting Periods and their respective additional premiums are stated in the Declarations or by endorsement. The premium for such Extended Reporting Period is based on the rating of the canceled or terminated Policy. We must receive written notice of the optional Extended Reporting Period elected together with payment of the applicable additional premium, within either 1) sixty (60) days after the end of the Policy Period or 2) thirty (30) days from the effective date of mailing or deliver of the notification advising You of the availability of, the premium for, and the importance of purchasing optional Extended Reporting Period. If the Insurer does not receive payment within such period, the Insurer will not be required to provide any optional Extended Reporting Period. SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 14 of 20 node INTERNATIONAL If an optional Extended Reporting Period is purchased, we will provide an Additional Extended Reporting Period Additional Limit of Insurance equal to the remaining applicable Limit of Insurance of the canceled or terminated Policy. 16. Valuation — Settlement All premiums, limit(s) of insurance, deductible amounts, Loss and any other monetary amounts under this Policy are expressed and payable in the currency of the United States of America. If judgment is rendered, settlement is agreed to or another component of Loss under this Policy is expressed in any currency other than United States of America dollars, payment under this Policy shall be made in United States dollars at the rate of exchange published in The Wall Street Journal on the date the final judgment is entered, settlement amount is agreed upon or the other component of Loss is due, respectively. a. With respect to Loss covered under Insuring Agreement 4 — Business Income, Contingent Business Income and Extra Expense, the amount of "business and contingent business income" will be determined based on consideration of: the net income generated from Your E-commerce Activities before the Interruption occurred; ii. the likely net income generated by Your E-cer-,• Activities if no Interruption had occurred, but not including any net income th . . like have been earned as a result of an increase in the volume of business due to ora. business conditions caused by the impact of the Cyber Incident on c omers or • er businesses; the operating expenses, includin• •a , nec sary to resume Your E-commerce Activities with the same quality . _e a ted before the Interruption; and iv. other relevant sources of inf. •atio nclu g Your financial records and accounting procedures, bills, invoices - o •uchers, and debts, liens and contracts. However, the amount of "bust -ss an in. nt business income" will be reduced to the extent that the reduction in the volu • si -s om the affected E-commerce Activities is offset by an increase in the volume of b 'e 'm other channels of commerce such as via telephone, mail or other sources. b. With respect to Lvernder Insuring Agreement 4 — Business Income, Contingent Business Income and Ex : Exp . e, e amount of "extra expense" will be determined based on: necessary expe._'es that exceed the normal operating expenses that would have been incurred in urse of Your E-commerce Activities during the period of coverage if no Interruption had occurred. We will deduct from the total of such expenses the salvage value that remains of any property bought for temporary use during the period of coverage once Your E-commerce Activities are resumed; and ii. necessary expenses that reduce the "business and contingent business income" Loss that otherwise would have been incurred during the period of coverage. 17. Confidentiality Under Insuring Agreement 2 — Extortion Threats, Insureds must make every reasonable effort not to divulge the existence of this coverage. 18. Territory This Policy covers Wrongful Acts, Security Breaches, Cyber Incidents and Extortion Threats which occur anywhere in the world. However. Suits must be brought in the United States of America (including its territories and possessions). SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 15 of 20 node INTERNATIONAL 19. Policy Bridge — Discovery Replacing Loss Sustained If this Policy replaces insurance that provided You with an extended period of time after cancellation or nonrenewal in which to Discover Loss resulting directly from any Cyber Incident, Extortion Threat, Security Breach, or Claim and which did not terminate when this Policy became effective: We will not pay for any Loss resulting directly from any Cyber Incident, Extortion Threat, Security Breach, or Claim that occurred during the Policy Period of that prior insurance which is Discovered during such extended period of time, unless the amount of that Loss exceeds the Limit of Insurance and Deductible Amount of that prior insurance. In that case, We will pay for the excess Loss subject to the terms and conditions of this Policy. Condition 11 — Other Insurance does not apply to this condition. 20. Nonrenewal We may non -renew this Policy for any reason allowable by applicable law. If We decide not to renew this Policy, We will mail or deliver to the first Named Insured written notice of the nonrenewal not less than thirty (30) days before the expiration date. If notice is mailed, proof of mailing will be sufficient proof of n SECTION VII — DEFINITIONS 1. Application means the signed application for thi materials submitted in conjunction with the sig 2. Card Company means American Express, Worldwide, Visa Inc. or any other credi -rd c Card Industry (PCI) Data Security Sta 3. Claim means: \fitny attachments, attestations, and other ,ital or otherwise. inancial Services, JCB International, MasterCard at requires its merchants to adhere to the Payment a. A written deman• moiVry or nonmonetary damages, including but not limited to injunctive relief; b. A civil proceedi m: cad by the service of a complaint or similar proceeding; c. Under Paragraph .. of 1 . ring Agreement 5 — Security Breach Liability Including Payment Card Industry (PCI) Fine . penalties, a Regulatory Proceeding commenced by the filing of a notice of charges, formal investigative order, service of summons or similar document; or d. Under Paragraph c. of Insuring Agreement 5 — Security Breach Liability Including Payment Card Industry (PCI) Fines and Penalties an action brought by a Card Company of the Payment Card Industry (PCI); against any Insured for a Wrongful Act, including any appeal therefrom. 4. Computer System means any computer, including transportable or handheld devices, electronic storage devices and related peripheral components; any systems and applications software, or any related telecommunications networks connected to or used in connection with such computer or devices: i) which collects, transmits, processes, stores or retrieves Your Electronic Data; and ii) which is: a. Owned by You; b. Leased by You and operated by any Insured; c. Owned and operated by an Employee who has agreed in writing to Your personal device use policy; or d. Operated by an authorized Third Party, but only with respect to Your Electronic Data. SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 16 of 20 node INTERNATIONAL 5. Cyber Incident means: a. Any i) Hacker attack; ii) malicious code; or iii) Virus that is directed at, enacted upon or introduced into a Computer System (including Your Electronic Data) and is designed to access, alter, corrupt, damage, delete, destroy, disrupt, encrypt, use or prevent or restrict access to or the use of any part of a Computer System (including Your Electronic Data) or otherwise disrupt its normal functioning or operation. Recurrence of the same Virus after a Computer System has been restored shall constitute a separate Cyber Incident. b. Any denial of service attack specifically directed at You which disrupts, prevents or restricts access to or use of a Computer System or otherwise disrupts the normal functioning or operation of a Computer System. 6. Discovery or Discovered means the time when any Employee who is a Chief Executive Officer, Chief Financial Officer, Chief Security Officer, Chief Technology Officer, Chief Information Officer, Risk Manager, General Counsel, owner, general manager, or any functionally equivalent positions of the Insured or any Subsidiary, regardless of title first becomes aware of facts wh' would cause a reasonable person to believe that a Loss covered by this Policy has been or will be ' urre regardless of when the act or acts causing or contributing to such Loss occurred, even though e t am unt or details of Loss may not then be known. Discovery or Discovered also means the time w potential Claim in which it is alleged that You ar would constitute a Loss under this Policy. 7. E-commerce Activities means those activit via Your web site or Your e-mail syste Insur first receives notice of an actual or 'r arty under circumstances which, if true, ed by You in the normal conduct of Your business 8. Electronic Data means information, fa. -s or sounds stored as or on, created or used on, or transmitted to or from comput: are cluding systems and applications software) on electronic storage devices including, but n, hard or floppy disks, CD-ROMs, tapes, drives, cells, data processing devices or oth- 77rr edia which are used with electronically controlled equipment. Electronic Data is not gible�o. y. Electronic Data does no our Electronic Data that is licensed, leased, rented or loaned to others. 9. Employee means any natural person who was, now is, or will be: a. Employed on a full- or part-time basis; b. Furnished temporarily to You to substitute for a permanent employee on leave or to meet seasonal or short-term workload conditions; c. Leased to You by a labor leasing firm under an agreement between You and the labor leasing firm to perform duties related to the conduct of Your business but does not mean a temporary employee as defined in Paragraph 9.b. above; d. An officer; e. A director, trustee or manager (if a limited liability company); f. A volunteer worker; g. A partner or member (if a limited liability company); or h. An Independent Contractor, of the Named Insured and those of any organization qualifying as a Subsidiary under the terms of this Policy, but only while acting within the scope of their duties as determined by the Named Insured or such Subsidiary. SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 17 of 20 node INTERNATIONAL 10. Extended Reporting Period means a designated period immediately following cancellation, nonrenewal, decrease in limits, reduced coverage, increased deductible or self -insured retention, newly added exclusions, or any other changes which are less favorable to the Insured of the Policy, during which Claims first made against the Insured will be deemed made during the Policy Period, but only for Wrongful Acts or Interrelated Wrongful Acts that first occurred on or after the Retroactive Date, if any, and prior to the effective date of cancellation, nonrenewal, decrease in limits, reduced coverage, increased deductible or self -insured retention, newly added exclusions, or any other changes which are less favorable to the Insured, of the Policy. 11. Extortion Threat means a threat or series of related threats: a. To perpetrate a Cyber Incident; b. To disseminate, divulge or utilize: i) Your proprietary information; or ii) weakness in the source code within a Computer System by gaining unauthorized access to a Computer System; c. To destroy, corrupt or prevent normal access to a Computer System (including Your Electronic Data) by gaining or having gained unauthorized access to a Computer System; d. To inflict Ransomware on a Computer System; or e. To publish Your client's or Employee's Personal Information. Extortion Threat does not include a threat or series of threat any ird Party. 12. Hacker means a person who accesses a Computer System (i not authorized to have such access; or ii) authorized to ve such unauthorized manner. 13. Independent Contractor means any person same business operations as the Named In business operations on behalf of, or at the di our Electronic Data) who is: i) s but who uses such access in an ontra'd by the Named Insured to perform the my while in the course of their performance of such the Named Insured. 14. Insured means any Named Insured . . 1 • - es. 15. Interrelated Wrongful Acts II ' • ngful Acts that have as a common nexus any: i) fact, circumstance, situation, event, • or cause; or ii) a series of casually connected facts, circumstances, situationsts, sactions or causes. 16. Interruption means: a. With respect to a CIncident: an unanticipated cessation or slowdown for Your E-Commerce Activities; or ii. Your suspension of Your E-Commerce Activities for the purpose of avoiding or mitigating the possibility of transmitting a Virus or malicious code to another person or organization; and, with regard to Paragraphs 16a.i and 16.a.ii. above, shall be deemed to begin when Your E-Commerce Activities are interrupted and ends at the earliest of: (1) (2) (3) one hundred -eighty (180) days after the Interruption begins; the time when Your E-Commerce Activities are resumed; or the time when service is restored to You. b. With respect to an Extortion Threat, Your voluntary suspension of Your E-Commerce Activities: i. based upon clear evidence of a credible threat; or ii. based upon the recommendation of a security firm, if any; and, with regard to Paragraphs 16.b.i and 16.b.ii. above, shall be deemed to begin when SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 18 of 20 node INTERNATIONAL Your E-Commerce Activities are interrupted and ends at the earliest of: (1) (2) (3) one hundred -eighty (180) days after the Interruption begins; the time when Your E-Commerce Activities are resumed; or the time when service is restored to You. 17. Loss means the definitions set forth in each of the respective Insuring Agreements of this Policy. 18. Named Insured means the entity or entities shown in the Declarations and any Subsidiary. 19. Personal Information means any information not available to the general public for any reason through which an individual may be identified including, but not limited to, an individual's: a. Social security number, driver's license number or state identification number; b. Protected health information; c. Financial account numbers; d. Security codes, passwords, PINs associated with credit, debit or charge card numbers which would permit access to financial accounts; or e. Any other nonpublic information as defined in Privacy R Iations. 20. Policy Period means the period of time from the inception da ';.f Po y shown in the Declarations to the expiration date shown in the Declarations, or its earlier cance on . rmination date, and specifically excludes any Extended Reporting Period. 21. Pollutants means any solid, liquid, gaseous or it contaminant, including smoke, vapor, soot, fumes, acids, alkalis, chemicals and was incl s materials to be recycled, reconditioned or reclaimed. 22. Privacy Regulations means any of associated with the control and use o including, but not limited to: a. b. c. d. The Health Insurance Po The Health Infor.- •n T Recovery and The Gramm-L Section 5(a) of the Fede he f. . . atutes and regulations, and their amendments, tifiable financial, health or other sensitive information ccountability Act of 1996 (HIPAA) (Public Law 104-191); ology for Economic and Clinical Health Act (HITECH) (American ct of 2009); c of 1999; Trade Commission Act (15 U.S.C. 45(a)), but solely for alleged unfair or deceptive acts o ices in or affecting commerce; e. The Identity Theft Red Flags Rules under the Fair and Accurate Credit Transactions Act of 2003; or f. Any other similar local, state, federal or foreign identity theft or privacy protection statute or regulation. 23. Ransomware means any software that is used to demand a ransom payment by: i) restricting access to a Computer System; or ii) encrypting Your Electronic Data held within a Computer System. 24. Ransom Demand means a demand by a third -party actor communicated in an electronic format to You as a request for payment in any form, including virtual currency, to rectify an Extortion Threat that is Discovered during the Policy Period. Ransom Payment means a monetary payment made during the Policy Period in any form, including virtual currency, to a third -party actor with Our prior written consent to resolve an Extortion Threat. Security Breach means a privacy breach that includes the acquisition of Personal Information held within a Computer System or in non -electronic form at or while in the care, custody or control of the Insured or authorized Third Party by a person: i) not authorized to have access to such information; or ii) authorized SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 19 of 20 node INTERNATIONAL to have access to such information but whose access results in the unauthorized disclosure of such information. 25. Subsidiary means any organization in which more than fifty percent (50%) of the outstanding securities or voting rights representing the present right to vote for the election of directors, trustees, managers (if a limited liability company) or persons serving in a similar capacity is owned, in any combination, by one or more Named Insureds. 26. Suit means a civil proceeding in which damages to which this Policy applies are claimed against the Insured. Suit includes: a. An arbitration proceeding in which such damages are claimed and to which the Insured submits with Our consent; or b. Any other alternative dispute resolution proceeding in which such damages are claimed and to which the Insured submits with Our consent. Suit does not include a civil proceeding seeking recognition and/or enforcement of a foreign money judgment. 27. Third Party means any entity that You engage under the term You. ten contract to perform services for 28. Virus means any kind of malicious code designed to d age or d any part of a Computer System (including Your Electronic Data) or disrupt its norm it ' ning. 29. Wrongful Act means any actual or alleged: a. Security Breach; b. Failure to prevent unauthorizeOre of, electronic or non -electronic data containing identity information; c. Failure to prevent the transmis Virus through a Computer System into a computer network, any applicatio re, computer operating system or related network that is not rented, owned, leased b .. + or under the direct operational control of the Insured; or d. Failure to provid ifica of any actual or potential Security Breach if such notification is required by an ecuJ r= h notification law; by, or asserted against, an SP CW 99 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 20 of 20 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. COMPUTER AND FUNDS TRANSFER FRAUD Computer And Funds Transfer Fraud Coverage Limit: Computer And Funds Transfer Fraud Deductible: See coverage sheet See coverage sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY With regard to this Computer And Funds Transfer Fraud endorsement, the provisions of the Policy to which this endorsement is attached remain unchanged and apply, unless modified by this endorsement. In consideration of the premium charged for the Policy, it is hereby understood and agreed that: I. The following Insuring Agreement is added to SECTION I — INSU G An1REEMENTS: Computer And Funds Transfer Fraud a. Subject to the Computer and Funds Transfer will pay for: i. Loss resulting directly from a frau imit and Deductible set forth above, We 1. Entry of Electronic Data ter System into; or 2. Change of Electra omputer System within a Compute y tem, a person or organization without authorization to access such Computer '' s ed the fraudulent entry or fraudulent change causes, with regard to Paragraphs a. an. .i.(2): a. Your money, securities or other property to be transferred, paid or delivered; or b. Your account at a financial institution to be debited or deleted, or ii. Loss resulting directly from a Fraudulent Instruction directing a financial institution to debit your Transfer Account and transfer, pay or deliver money or securities from that account that is first Discovered during the Policy Period and reported in accordance with Condition 14. Duties in the Event of Claim or Loss in SECTION VI — CONDITIONS. b. As used in Paragraph a.i., "fraudulent entry" or `fraudulent change" of Electronic Data or Computer Program shall include such entry or change made by an Employee acting, in good faith, upon a Fraudulent Instruction received from a computer software contractor who has a written agreement with You to design, implement or service Computer Programs for a Computer System covered under this Insuring Agreement. I1. Solely with respect to the coverage afforded under this endorsement: SP CW 80 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 4 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL a. Computer Program means a set of related electronic instructions, which direct the operation and function of a computer or devices connected to it, which enables the computer or devices to receive, process, store or send your Electronic Data. b. Loss means: 1. In Paragraph I.a.i.: (a) Your money, securities or other property fraudulently transferred, paid or delivered; or (b) Money or securities fraudulently debited or deleted from Your account at a financial institution. 2. In Paragraph I.a.ii., transferring, paying or delivering money or securities from Your Transfer Account. c. Fraudulent Instruction means: (1) With regard to Paragraph I.a.ii.: (a) A computer, telegraphic instruction directing a fi transfer, pay or deli instruction purports to issued by som . e el (b) A written instru to debit Tran from tha specified ety'lefacsimile, telephone or other electronic stitution to debit Your Transfer Account and to or securities from that Transfer Account, which issued by You, but which in fact was fraudulently Your knowledge or consent. to a financial institution directing the financial institution count and to transfer, pay or deliver money or securities count, through an electronic funds transfer system at der specified conditions, which instruction purports to have y You, but which in fact was issued, forged or altered by someone ur knowledge or consent. (2) With re • o Paragraph I.b.: A computer, telegraphic, cable, teletype, telefacsimile, telephone or other electronic, written or voice instruction directing an Employee to enter or change Electronic Data or Computer Programs within a Computer System covered under this Insuring Agreement, which instruction in fact was fraudulently issued by Your computer software contractor. d. Transfer Account means an account maintained by you at a financial institution from which You can initiate the transfer, payment or delivery of Money and Securities: (1) By means of computer, telegraphic, cable, teletype, telefacsimile, telephone or other electronic instructions; or (2) By means of written instructions establishing the conditions under which such transfers are to be initiated by such financial institution through an electronic funds transfer system. III. The following is added to SECTION II — LIMITS OF INSURANCE, 2. Aggregate Sublimit(s) of Insurance: SP CW 80 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 4 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL The most We will pay for all Loss covered under the Computer and Funds Transfer Fraud Insuring Agreement is the Computer and Funds Transfer Fraud Sublimit of Insurance shown above, which is part of, not in addition to the Policy Aggregate Limit of Insurance set forth in the Declarations to this Policy. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments, We will have no further obligations or liability of any kind with respect to Loss subject to such Sublimit of Insurance. IV. Paragraph 1. of Section I11— Deductible is deleted in its entirety and replaced with the following: 1. Under Insuring Agreements 1. Security Breach Expense, 2. Extortion Threats, 3. Replacement Or Restoration Of Electronic Data, and Paragraph I.a. of this endorsement: We will pay only the amount of Loss which is in excess of the Policy Deductible Amount shown above. V. The following is added to SECTION V — EXCLUSIONS: 1. We will not be liable for Loss based upon, attributable to, rt ing out of or resulting from: i. A fraudulent: 1. Entry of Electronic Data or r Pr•, : ram into; or 2. Change of Electronic D or • mp - rogram within a Computer System, by a perso .r. zation with authorized access to such Computer System, except when cover-. and .g .ph I.b. ii. The use or pur. -. us- c -dit, debit, charge, access, convenience, identification, stored -value or of o e information contained on such cards. iii. The givi or . ing of property in any exchange or purchase. iv. An Employ nancial institution acting upon any instruction to: 1. Transfer, pay or deliver money, securities or other property; or 2. Debit or delete Your account; which instruction proves to be fraudulent, except when covered under Paragraph I.b. 2. We will not be liable for Loss, or that part of any Loss, the proof of which as to its existence or amount is dependent upon: i. An inventory computation; or ii. A profit and loss computation. VI. The introductory statement to paragraph a. of Condition 14. Duties in the Event of Claim or Loss in SECTION VI — CONDITIONS is deleted in its entirety and replaced with the following: a. Under Insuring Agreements 2. Extortion Threats, 3. Replacement Or Restoration Of Electronic Data and SP CW 80 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 3 of 4 Policy Number: Endorsement Issued Date: Endorsement Effective Date: riode INTERNATIONAL this Computer Funds Transfer Fraud Insuring Agreement, you must: All other terms and conditions remain unchanged. SP CW 80 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 4 of 4 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. HARDWARE REPLACEMENT COSTS ENDORSEMENT Hardware Replacement Costs Coverage Limit: See coverage sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Hardware Replacement Costs Endorsement, all provisions of the Policy to which this endorsement is attached, as all terms and conditions, remain unchanged and applicable. This endorsement extends certain coverages. The headers in this endorsement are only for convenience. Read the entire policy carefully to determine rights, duties and what is and is not covered. In consideration of the premium charged for the Policy, it is hereby understood and agreed that: I. The following Insuring Agreement is added to SECTION I — INSURING AGREEMENTS: Hardware Replacement Costs: Subject to the Hardware Replacement Costs Coverage Limit set forth above and any Deductible specified in the Declarations to this policy, We will pay for Loss directly resulting from a Cyber Incident first Discovered during the Policy Period and reported in accordance with Condition 14. Duties in the Event of Claim or Loss in SECTION VI — CONDITIONS, to mitigate the potential of a future Cyber Incident or Security Breach. With respect to this Hardware Replacement Costs Insuring Agreement: a. Loss means the cost to replace hardware, including but not limited to, computers or any associated devices or equipment operated by, and either owned by or leased to, the Insured that are unable to function as intended due to corruption or destruction of software or firmware. b. Loss does not include any sums related to labor costs associated with installing, connecting or setting up the hardware. II. The following is added to SECTION II — LIMITS OF INSURANCE, 2. Aggregate Sublimit(s) of Insurance: The most We will pay for all Loss covered under the Hardware Replacement Costs Insuring Agreement is the Hardware Replacement Costs Aggregate Sublimit of Insurance, if any, shown above or in the Declarations, which are part of, and not in addition to, the Policy Aggregate Limit of Insurance. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments, We will have no further obligations of liability of any kind with respect to Loss subject to such Sublimit of Insurance. SP CW 86 05 22 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. III. The following is added to SECTION III — DEDUCTIBLE: Under the Hardware Replacement Costs Insuring Agreement, We will pay only the amount of Loss which is in excess of the Policy Deductible shown in the Declarations. IV. Exclusion 4 in SECTION V — EXCLUSIONS is deleted in its entirety and replaced with the following: 4. Bodily Injury Bodily Injury means bodily injury, sickness or disease sustained by a person, including death resulting from any of these at any time. It also means mental injury, mental anguish, mental tension, emotional distress, pain or suffering or shock sustained by any person. However, Bodily Injury does not mean mental anguish or emotional distress resulting directly from a Security Breach. SP CW 86 05 22 All other terms and conditions remain unchanged. Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. POST BREACH REMEDIATION COVERAGE ENDORSEMENT Post Breach Remediation Coverage Limit: See coverage sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Post Breach Remediation Coverage Endorsement, all provisions of the Policy to which this endorsement is attached, as well as all terms and conditions, remain unchanged and applicable. This endorsement extends certain coverages. The headers in this endorsement are only for convenience. Read the entire policy carefully to determine rights, duties and what is and is not covered. In consideration of the premium charged for the Policy, it is hereby understood and agreed that: I. The following Insuring Agreement is added to SECTION I — INSURING AGREEMENTS: Post Breach Remediation: Subject to the Post Breach Remediation Coverage Limit set forth above and any Deductible specified in the Declarations to this policy, We will pay Loss incurred with Our prior written approval during the Policy Period and reported in accordance with Condition 14. Duties in the Event of Claim or Loss in SECTION VI — CONDITIONS, to resolve any vulnerabilities or weaknesses in your Computer System that are identified by an independent security firm after a Cyber Incident or Security Breach. The upgrades or improvements must be determined by the independent security firm to reduce the probability or potential damage from a Cyber Incident or Security Breach in the future. With respect to this Post Breach Remediation Insuring Agreement: a. Loss solely means: i. labor costs incurred by an independent security firm to determine whether any vulnerabilities or weaknesses exist in Your Computer System that are identified by an independent security firm after a Cyber Incident or Security Breach; and ii. labor costs incurred to resolve any vulnerabilities or weaknesses in your Computer System that are identified by an independent security firm after a Cyber Incident or Security Breach. II. The following is added to SECTION II — LIMITS OF INSURANCE. 2. Aggregate Sublimit(s) of Insurance: SP CW 87 05 22 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. The most We will pay for all Loss covered under the Post Breach Remediation Insuring Agreement is the Post Breach Remediation Aggregate Sublimit of Insurance, if any, shown above or in the Declarations, which are part of, and not in addition to, the Policy Aggregate Limit of Insurance. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments, We will have no further obligations of liability of any kind with respect to Loss subject to such Sublimit of Insurance. III. The following is added to SECTION III — DEDUCTIBLE: Under the Post Breach Remediation Insuring Agreement, We will pay only the amount of Loss which is in excess of the Policy Deductible amount shown in the Declarations. All other terms and conditions remain unchanged. SP CW 87 05 22 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. SOCIAL ENGINEERING ENDORSEMENT Social Engineering Coverage Limit: See coverage sheet Social Engineering Deductible: See coverage sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Social Engineering Endorsement, all provisions of the Policy to which this endorsement is attached, as well as all terms and conditions, remain unchanged and applicable. In consideration of the premium charged for the Policy, it is hereby un.-rstood and agreed that: I. The following Insuring Agreement is added to SECTION I — I A EEMENTS: Social Engineering Subject to the Social Engineering Coverage Social Engineering Loss resulting dire Discovered during the Policy Period a Event of Claim or Loss in SECTION VI With respect to this Social Engineng a. Money means currency, checks, register s ks a not include dig' representing ei b. Securities mean n Money or property. e set forth above, We will pay for I Engineering Incident that is first in accordance with Condition 14. Duties in the IONS. greement: notes in current use and having a face value, travelers' oney orders held for sale to the public. The term Money does r other negotiable and nonnegotiable instruments or contracts o property. ble and non-negotiable instruments or contracts representing either Securities does not include Money. c. Social Engineering Incident means the intentional misleading of an Insured to transfer Money to a person, place or account beyond the Named Insured's control resulting directly from the Named Insured's employee's good faith reliance upon an instruction transmitted via email, purporting to be from: i. a natural person or entity who exchanges, or is under contract to exchange, goods or services with the Named Insured for a fee (other than a financial institution, asset manager, broker -dealer, armored motor vehicle "named insured" or any similar entity); or ii. an employee of the Named Insured; but which contained a fraudulent and material misrepresentation and was sent by an imposter. SP CW 91 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 3 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. As a condition precedent to coverage under this Social Engineering Endorsement, the Named Insured must have an established and documented funds transfer request verification procedure and that procedure must have been followed before acting upon any instruction. d. Social Engineering Loss means the loss of Money as a result of a Social Engineering Incident. Social Engineering Loss does not include indirect and/or consequential loss. II. The following is added to SECTION 11 — LIMITS OF INSURANCE, 2. Aggregate Sublimit(s) of Insurance: The most We will pay for all Loss covered under the Social Engineering Insuring Agreement is the Social Engineering Aggregate Sublimit of Insurance, if any, shown above or in the Declarations., which are part of, and not in addition to, the Policy Aggregate it of Insurance. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments e will have no further obligations of liability of any kind with respect to Loss subject to such Insurance. III. The following is added to SECTION III — DEDUCTI = LE: Under the Social Engineering Insuring Agree . ill p only the amount of Loss which is in excess of the Policy Deductible shown a• ' , or th- ` arations. IV. SECTION V — EXCLUSIONS is amended to We will not be liable for Social Engine 't - resulting from a Social Engineering Incident based upon, attributable to or arising o : 1. An actual or alleged infringeation of, misappropriation of or assertion of any right to or interest in any: a. Patent, copyrig .de rk, trade dress, certification mark, collective mark, service mark, expression, idea, li - i - name, slogan, style of doing business, symbol, title, trade secret or other intellectual pro. -rty right by or on behalf of any Insured; or b. Software or computer code or its source content or material by or on behalf of any Insured. 2. A fraudulent, dishonest or criminal act by any Employee or authorized representative of the Named Insured, whether acting alone or in collusion with others. 3. The establishment of any credit or similar promise to pay, or to any party's use of or acceptance of any credit card, debit card or similar instrument, whether or not genuine. 4. Any investment or ownership in any corporation, partnership, real property, or similar instrument, whether or not such investment is genuine. 5. A kidnap, ransom or other extortion payment surrendered as a result of a threat to do bodily harm to any natural person or a threat to harm, take, or transfer property. SP CW 91 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 3 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. All other terms and conditions remain unchanged. SP CW 91 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 3 of 3 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. TELECOMMUNICATIONS FRAUD ENDORSEMENT Telecommunications Fraud Coverage Limit: See coverage sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Telecommunications Fraud Endorsement, all provisions of the Policy to which this endorsement is attached, as well as all terms and conditions, remain unchanged and applicable. This endorsement extends certain coverages. The headers in this endorsement are only for convenience. Read the entire policy carefully to determine rights, duties and what is and is not covered. In consideration of the premium charged for the Policy, it is hereby understood and agreed that: I. The following Insuring Agreement is added to SECTION I — INSURING AGREEMENTS: Telecommunications Fraud: Subject to the Telecommunications Fraud Coverage Limit set forth above and any Deductible specified in the Declarations to this policy, We will pay for any monetary Loss sustained by You, including but not limited to phone bills, first Discovered during the Policy Period and reported in accordance Condition 14. Duties in the Event of Claim or Loss in SECTION VI - CONDITIONS, directly resulting from an intentional unauthorized access to Your Telephone System by a third party. With respect to this Telecommunications Fraud Insuring Agreement: a. Loss solely means the monetary cost of unauthorized calls or unauthorized use of Your Telephone System's bandwidth. b. Telephone System means the VolP phone system directly under Your control. II. The following is added to SECTION II — LIMITS OF INSURANCE, 2. Aggregate Sublimit(s) of Insurance: The most We will pay for all Loss covered under the Telecommunications Fraud Insuring Agreement is the Telecommunications Fraud Aggregate Sublimit of Insurance, if any, shown above or in the Declarations., which are part of, and not in addition to, the Policy Aggregate Limit of Insurance. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments, We will have no further obligations of liability of any kind with respect to Loss subject to such Sublimit of Insurance. SP CW 85 05 22 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. in. The following is added to SECTION III — DEDUCTIBLE Under the Telecommunications Fraud Insuring Agreement, We will pay only the amount of Loss which is in excess of the Policy Deductible shown in the Declarations. All other terms and conditions remain unchanged. SP CW 85 05 22 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. WEBSITE MEDIA CONTENT LIABILITY ENDORSEMENT Website Media Content Liability Coverage Limit: See coverage sheet Website Media Content Liability Deductible: See coverage sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Website Media Content Liability Endorsement, this endorsement is attached, as well as all terms and conditions, re In consideration of the premium charged for the Policy, it is hereb 1. The following Insuring Agreement is added to SECTION— INSU Website Media Content Liability Subject to the Website Media Content We will pay for Loss that the Insured be as a result of a Claim that is Di with Condition 14. Duties in the one or more of the followin• - s end of the Policy Period in t social media web pagecrea T d II provisions of the Policy to which n unchanged and applicable. too nd agreed that: AGREEMENTS: overage Limit and Deductible set forth above, Ily obligated to pay and Defense Expenses the Policy Period and reported in accordance aim or Loss in SECTION VI — CONDITIONS, for ted on or after the retroactive date and before the our display of Media Material on Your website or on ntained by or on behalf of You: a. invasion of n with an individual's right of publicity, including commercial appropriation of na persona, voice or likeness; or b. plagiarism, piracy or misappropriation of ideas under implied contract; or c. infringement of copyright; or d. infringement of domain name, trademark, trade name, trade dress, logo, title, metatag, slogan, service mark, service name; or e. improper deep -linking or framing within electronic content. With respect to this Website Media Content Liability Insuring Agreement: a. Media Material means any information in electronic form, including words, sounds, numbers, images, or graphics and shall also include advertising, video, streaming content, webcasting, online forums, bulletin boards and chat room content, but does not mean computer software or the actual goods, products or services described, illustrated or displayed in such Media Material. II. Exclusions Applicable to the Website Media Content Liability Insuring Agreement: SP CW 83 05 22 Page 1 of 2 Spinnaker Insurance Company Includes copyrighted material of Insurance Services Office, Inc., with its permission Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. We will not be liable for any Claim resulting from an act based upon, attributable to or arising out of: 1. An actual or alleged infringement of, violation of, misappropriation of or assertion of any right to or interest in any: a. Patent, copyright, trademark, trade dress, certification mark, collective mark, service mark, expression, idea, likeness, name, slogan, style of doing business, symbol, title, trade secret or other intellectual property right by or on behalf of any Insured, provided that this Exclusion does not apply to a claim resulting from an act based upon, attributable to or arising out of infringement of copyright, or infringement of domain name, trademark, trade name, trade dress, logo, title, metatag, slogan, service mark, service name in the course of Your display of Media Material on Your website or on social media web pages created and maintained by or on behalf of You; or b. Software or computer code or its source content or rial . `% or on behalf of any Insured. III. The following is added to SECTION II — LIMITS Insurance: The most We will pay for all Loss cove Agreement is the Website Media Conte of, not in addition to the Policy Aggrega Policy. Upon exhaustion of any at no further obligations or liability Insurance. SURA s , 2. Aggregate Sublimit(s) of the Website Media Content Liability Insuring Sublimit of Insurance shown above, which is part nsurance set forth in the Declarations to this it of Insurance by such payments, We will have with respect to Loss subject to such Sublimit of All otheie�fs'a116 conditions remain unchanged. SP CW 83 05 22 Page 2 of 2 Spinnaker Insurance Company Includes copyrighted material of Insurance Services Office, Inc., with its permission Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. SERVICE FRAUD INCLUDING CRYPTOJACKING ENDORSEMENT Service Fraud Coverage Limit: See policy cover sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Service Fraud Endorsement, all provisions of the Policy to which this endorsement is attached, as well as all terms and conditions, remain unchanged an ' : pplicable. This endorsement extends certain coverages. The headers in thi Read the entire policy carefully to determine rights, duties and wha In consideration of the premium charged for the Policy, it is 1. The following Insuring Agreement is added Service Fraud: Subject to the Service Fraud the Declarations to this but not limited to phon during the Policy Period Claim or Los unauthorized a ment are only for convenience. is covered. eby unde ood and agreed that: ON I — INSURING AGREEMENTS: set forth above and any Deductible specified in for any monetary Loss sustained by You, including sed service bills, and Cryptojacking, first Discovered d in accordance Condition 14. Duties in the Event of N VI - CONDITIONS, directly resulting from an intentional elephone System by a third party. With respect to this el mmunications Fraud Insuring Agreement: a. Loss means the additional monetary costs incurred by You as a direct result of: 1. unauthorized calls or unauthorized use of Your Telephone System's bandwidth; 2. unauthorized access or use of Your Cloud Based Services; and 3. unauthorized access or use of a Computer System for the purpose of mining for Virtual Currency with the use of any of the following services or resources: • electricity • natural gas • oil • Internet. b. Monetary Costs include only those additional amounts billed to You by the respective service provider, including usage or consumption information, incurred in a periodic billing statement pursuant to a written contract executed before the Loss first occurred with You, and does not SP CW 70 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: rode INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. include any amounts charged at a flat fee that does not scale with the rate or use of the respective service due for payment during the Policy Period. c. Telephone System means the Voice over Internet Protocol (VoIP) phone system directly under Your control. d. Cloud Based Services means Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). e. Virtual Currency means a type of digital representation of currency or asset which is stored, transferred, and transacted in electronic form, utilizes cryptography to secure its network, regulate its generation, and verify its transfer, and operated independently of a central bank or other central authority in the majority of financial jurisdictions.* II. The following is added to SECTION II — LIMITS OF INSURAJICE, 2. Aggregate Sublimit(s) of Insurance: The most We will pay for all Loss covered under the S e Fr Insuring Agreement is the Service Fraud Aggregate Sublimit of lnsuranc if any, s bove or in the Declarations., which are part of, and not in addition to, the licy A gate Limit of Insurance. Upon exhaustion of any Aggregate Sublimit of I e s payments, We will have no further obligations of liability of any kind with r os ject to such Sublimit of Insurance. III. The following is added to SECTION III — • • IBLE Under the Service Fraud Ins t •re' We will pay only the amount of Loss which is in excess of the Policy Deductible ' o :':the Declarations. and conditions remain unchanged. SP CW 70 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. DEDICATED BREACH COSTS ENDORSEMENT Security Breach Expense Coverage Limit: See policy cover sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Security Breach Expense Outside of Limit Endorsement, all provisions of the Policy to which this endorsement is attached, as well as all terms and conditions, remain unchanged and applicable. This endorsement extends certain coverages. The headers in this •ors= ent are only for convenience. Read the entire policy carefully to determine rights, duties and w s . . is n.t covered. In consideration of the premium charged for the Policy, it isereby un. •d and agreed that: I. Paragraph 1. Policy Aggregate Limit of I J� of 9�fION II — LIMITS OF INSURANCE is deleted in its entirety and replaced with t 1. Policy Aggregate Limit of Insura Except as provided below and the most We will pay f Limit of Insurance show Paragraph 3. Security B Insurance shall J 6uce terms of this P applicable, the obligations or Iiabili h . Security Breach Expense Limit of Insurance, L. s and Defense Expenses is the Policy Aggregate rations. Furthermore, except as provided below under ense Limit of Insurance, the Policy Aggregate Limit of y any payment, including Defense Expenses, made under the austion of the Policy Aggregate Limit of Insurance and, only if reach Expense Limit of Insurance, We will have no further y kind under this Policy. II. Paragraph 2. Aggregate Sublimit(s) of Insurance of SECTION II — LIMITS OF INSURANCE is deleted in its entirety and replaced with the following: The Aggregate Sublimit(s) of Insurance set forth in the Declarations are part of, and not in addition to, the Policy Aggregate Limit of Insurance. Any such Aggregate Sublimit(s) of Insurance shall be reduced by any payment for Loss and, if applicable, Defense Expenses, under the Insuring Agreement to which such Aggregate Sublimit of Insurance applies. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments, We will have no further obligations or liability of any kind with respect to Loss or Defense Expenses, subject to such Sublimit of Insurance. 2. Aggregate Sublimit(s) of Insurance Except as provided below under Paragraph 3. Additional Security Breach Expense Limit of Insurance, Subject to the Policy Aggregate Limit of Insurance, the most We will pay for all Loss covered under: SP CW 71 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. a. Insuring Agreement 2 — Extortion Threats, is the Ransom Payments Aggregate Sublimit Of Insurance, if any, shown in the Declarations; and b. Insuring Agreement 4 — Business Income and Extra Expense, is the Business Income and Extra Expense Aggregate Sublimit Of Insurance, if any, shown in the Declarations. The Aggregate Sublimit(s) of Insurance described in Paragraphs 2.a. and 2.b. above are part of, and not in addition to, the Policy Aggregate Limit of Insurance. Any such Aggregate Sublimit(s) of Insurance shall be reduced by any payment for Loss and, if applicable, Defense Expenses, under the Insuring Agreement to which such Aggregate Sublimit of Insurance applies. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments, We will have no further obligations or liability of any kind with re ct to Loss or Defense Expenses, subject to such Sublimit of Insurance. III. The following is added to SECTION II — LIMITS OSURAN 3. Additional Security Breach Expens , m 4•f jihce Solely with respect to SECTION I — a. All Loss covered and Expense incurred by shown in the Declaratio Discovered du shall only apply Insuranll s lnsura U AGREEMENTS, 1. Security Breach Expense: SURING AGREEMENTS, 1. Security Breach ured in excess of the Policy Deductible amount directly from a Security Breach or Cyber Incident Period or any extended reporting period, if applicable, e, the Additional Security Breach Expense Limit of oss shall not apply to or reduce the Policy Aggregate Limit of b. Upon exhaustio f the Additional Security Breach Expense Limit of Insurance We will have her obligations or liability of any kind SECTION I — INSURING AGREEMENTS, 1. Security Breach Expense under the Policy. All other terms and conditions remain unchanged. SP CW 71 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. REVERSE SOCIAL ENGINEERING ENDORSEMENT Reverse Social Engineering Coverage Limit: See cover sheet Reverse Social Engineering Deductible: See cover sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Reverse Social Engineering Endorsement, all provisions of the Policy to which this endorsement is attached, as well as all terms and conditions, remain unchanged and applicable. This endorsement extends certain coverages. The headers in this endorsement are only for convenience. Read the entire policy carefully to determine rights, duties and what is and is not covered. In consideration of the premium charged for the Policy, it is hereby understood and agreed that: I. The following Insuring Agreement is added to SECTION I — INSURING AGREEMENTS: Reverse Social Engineering: Subject to the Reverse Social Engineering Coverage Limit and Deductible set forth above, We will pay for a Reverse Social Engineering Loss resulting directly from a Reverse Social Engineering Event that is first Discovered during the Policy Period and reported in accordance with Condition 14. Duties in the Event of Claim or Loss in SECTION VI — CONDITIONS. With respect to this Reverse Social Engineering Insuring Agreement: a. Client means any person or entity with whom You have entered into a written contract to provide services or deliverables. b. Money means currency, coins or banknotes in current use and having a face value, travelers' checks, register checks and money orders held for sale to the public. The term Money does not include digital currency or other negotiable and nonnegotiable instruments or contracts representing either Money or property. c. Reverse Social Engineering Event means the intentional use of Your Computer System by a person or organization that is not an Insured to mislead or deceive Your Client or Vendor into transferring Money intended for You to another person or entity. d. Reverse Social Engineering Loss means the loss of Money as a result of a Reverse Social Engineering Event. e. Vendor means any person or entity with whom You have entered into a written contract to provide services to You provided that entity is not owned, operated or controlled by You. Vendor does not include any financial institutions with which you directly or indirectly do business. SP CW 82 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. II. The following is added to SECTION II — LIMITS OF INSURANCE, 2. Aggregate Sublimit(s) of Insurance: The most We will pay for all Loss covered under the Reverse Social Engineering Insuring Agreement is the Reverse Social Engineering Aggregate Sublimit of Insurance, if any, shown above, which is part of, not in addition to the Policy Aggregate Limit of Insurance set forth on the Declarations to this Policy. Any such Aggregate Sublimit(s) of Insurance shall be reduced by the amount of any payment for Loss under the Insuring Agreement to which such Aggregate Sublimit of Insurance applies. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments, We will have no further obligations or liability of any kind with respect to Loss subject to such Sublimit of Insurance. III. The following is added to SECTION III - DEDUCTIBLE Under the Reverse Social Engineering Insuring Agreement, We will pay only the amount of Loss which is in excess of the Reverse Social Engineering Deductible amount shown above. All other terms and conditions remain unchanged. SP CW 82 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. ENHANCED BUSINESS INCOME, CONTINGENT BUSINESS INCOME AND EXTRA EXPENSE COVERAGE ENDORSEMENT - INCLUSIVE OF SYSTEMS FAILURE This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Endorsement, all provisions of the Policy to which this endorsement is attached, as well as all terms and conditions, remain unchanged and applicable. This endorsement extends certain coverages. The headers in this end• me• are only for convenience. Read the entire policy carefully to determine rights, duties and what is and is not In consideration of the premium charged for the Policy, it is hereb dersto.• nd agreed that: I. Insuring Agreement 4. Business Income, Continge t Income and Extra Expense is deleted in its entirety and replaced with the following: 4. Business Income, Contingent Busin nco e d xtra Expense We will pay for Loss due to an I . ruptiresing directly from a Cyber Incident, Extortion Threat or System Failure that is Discove '•• Policy Period or during any extended reporting period, if applicable. With respect to this Ins4, Loss means the actual Loss of: (1) "business and contingent business income" You s As used in this Insuring Agreer4fent 4: a. "Business and contingent business income" means the: (2) "extra expense" You incur. net income (net profit or loss before income taxes) that would have been earned or incurred; and ii. continuing normal operating expenses incurred, including payroll. "Business and contingent business" income does not include: (1) Net Profit that would likely have been earned as a result of an increase in volume due to favorable business conditions caused by the impact of network security failures impacting other businesses, loss of market, or any other consequential loss b. "Extra expense" means necessary and reasonable expenses You incur during the period of restoration as a result of the measurable Interruption of the Insured's business operations, in order to reduce the period of restoration and minimize or reduce Business and Contingent Business income. "Extra expense" does not include: SP CW 76 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 3 Policy Number: Endorsement Issued Date: Endorsement Effective Date: riode INTERNATIONAL (1) any costs or expenses associated with upgrading, maintaining, repairing, remediating or improving a Computer System as a result of a Cyber Incident, Extortion Threat or System Failure; or (2) Extortion Expenses covered under Insuring Agreement 2 — Extortion Threats. II. The following definition in SECTION VII — DEFINITIONS is deleted in its entirety and replaced with the following: Interruption means: a. With respect to a Cyber Incident or System Failure: an unanticipated cessation or slowdown for Your business operations; or ii. Your suspension of Your business operations for the purpose of avoiding or mitigating the possibility of transmitting a Virus or malicious code to another person or organization; and, with regard to Paragraphs 14.a.i and 14.a.ii. •ve, shall be deemed to begin when Your business operations are interrupted and ends a iest of: (1) one hundred -eighty (180) days after the I r on begins; (2) the time when Your business o tions are .umed; or (3) the time when service is re b. With respect to an Extortion Threat, Yo of ary suspension of Your business operations: based upon clear evidence o -di. threat; or ii. based upon the recom• -.dati. . s-curity firm, if any; and, with regard .i and 14.b.ii. above, shall be deemed to begin when Your business operatied and ends at the earliest of: (1) o ndre -ighty (180) days after the Interruption begins; (2) e ti e Your business operations are resumed; or (3) e n service is restored to You. I11. The following definition is ado SECTION VII — DEFINITIONS: System Failure means: any sudden, unintentional, or unexpected and continuous Interruption of your Computer System which disrupts, prevents, or restricts the normal functioning of your business operations which would otherwise have been handled in whole or in part by the Computer System and is directly caused by a Cyber Incident, malfunction in normal computer function or network service, or hardware failure. System Failure does not include: any hardware failure due to design/manufacturing defects or use of hardware past End of Life Announcements (EOLA) or Last Date of Support (LODS); failure of hosted computer systems that results in an outage that extends beyond the services being provided to you by hosted Computer Systems; failure to adequately anticipate or capacity plan for expected and/or above -normal operational demand for Computer Systems except where this demand is a denial of service attack; any Interruption of a Computer System resulting from a Security Breach; or any Interruption of a Computer System operated by any Third Party. SP CW 76 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 3 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL IV. Condition 16. Valuation — Settlement in SECTION VI — CONDITIONS is deleted in its entirety and replaced with the following: 16. Valuation — Settlement All premiums, limit(s) of insurance, deductible amounts, Loss and any other monetary amounts under this Policy are expressed and payable in the currency of the United States of America. If judgment is rendered, settlement is agreed to or another component of Loss under this Policy is expressed in any currency other than United States of America dollars, payment under this Policy shall be made in United States dollars at the rate of exchange published in The Wall Street Journal on the date the final judgment is entered, settlement amount is agreed upon or the other component of Loss is due, respectively. a. With respect to Loss covered under Insuring Agreement 4 — Business Income, Contingent Business Income and Extra Expense, the amount of "business and contingent business income" will be determined based on consideration of: b. the net income generated from Your business activ ii. the likely net income generated by Your busines but not including any net income that would lik in the volume of business due to favorable bus Cyber Incident or System Failure on customers iii. the operating expenses, including payr the same quality of service that exis iv. other relevant sources of infor procedures, bills, invoices and o However, the amount of "business an the reduction in the volume of in the volume of business fro sources. es before the Interruption occurred; ctivities if no Interruption had occurred, en earned as a result of an increase ns caused by the impact of the er businesses; esume Your business activities with erruption; and Your financial records and accounting nd debts, liens and contracts. t business income" will be reduced to the extent that h - affected business activities is offset by an increase Is of commerce such as via telephone, mail or other With respect to Loss cove suring Agreement 4 — Business Income, Contingent Business Income and Extra nse, a amount of "extra expense" will be determined based on: i. necessahat exceed the normal operating expenses that would have been incurred in e rse of Your business activities during the period of coverage if no Interruption occurred. We will deduct from the total of such expenses the salvage value that remains of any property bought for temporary use during the period of coverage once Your business activities are resumed; and ii. necessary expenses that reduce the "business and contingent business income" Loss that otherwise would have been incurred during the period of coverage. All other terms and conditions remain unchanged. SP CW 76 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 3 of 3 Policy Number: Issued Date: Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. INCREASE OF OR ELIMINATION OF BUSINESS AND CONTINGENT BUSINESS INCOME AND EXTRA EXPENSE SUBLIMIT This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY SCHEDULE Effective Date of Endorsement: Inception Date Business and Contingent Business Income and Extra Expens5k ublimit: See coverage sheet Premium: TBC In consideration of the premium charged for the Policy, -by un. -r tood and agreed that: The following sentence is added to Para II — LIMITS OF INSURANCE, 2. Aggre Insuring Agreement 4 — Busines Business Income and Extra Expe Schedule of this endorsem gregate Sublimit(s) of Insurance of SECTION mit(s) of Insurance: nt Business Income and Extra Expense: is the gate Sublimit of Insurance, if any, shown in the s and conditions remain unchanged. SP CW 72 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 1 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. COMPUTER AND FUNDS TRANSFER FRAUD Computer And Funds Transfer Fraud Coverage Limit: Computer And Funds Transfer Fraud Deductible: See coverage sheet See coverage sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY With regard to this Computer And Funds Transfer Fraud endorsement, the provisions of the Policy to which this endorsement is attached remain unchanged and apply, unless modified by this endorsement. In consideration of the premium charged for the Policy, it is hereby understood and agreed that: I. The following Insuring Agreement is added to SECTION I — INSUEEMENTS: Computer And Funds Transfer Fraud a. Subject to the Computer and Funds Transfer will pay for: i. Loss resulting directly from a frau 1. Entry of Electronic Data ter System into; or 2. Change of Elects to omputer System within imit and Deductible set forth above, We a Compute y tem, a person or organization without authorization to access such Computer ' s - ed the fraudulent entry or fraudulent change causes, with regard to Paragraphs a. an. .i.(2): a. Your money, securities or other property to be transferred, paid or delivered; or b. Your account at a financial institution to be debited or deleted, or ii. Loss resulting directly from a Fraudulent Instruction directing a financial institution to debit your Transfer Account and transfer, pay or deliver money or securities from that account that is first Discovered during the Policy Period and reported in accordance with Condition 14. Duties in the Event of Claim or Loss in SECTION VI — CONDITIONS. b. As used in Paragraph a.i., "fraudulent entry" or "fraudulent change" of Electronic Data or Computer Program shall include such entry or change made by an Employee acting, in good faith, upon a Fraudulent Instruction received from a computer software contractor who has a written agreement with You to design, implement or service Computer Programs for a Computer System covered under this Insuring Agreement. II. Solely with respect to the coverage afforded under this endorsement: SP CW 80 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 4 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL a. Computer Program means a set of related electronic instructions, which direct the operation and function of a computer or devices connected to it, which enables the computer or devices to receive, process, store or send your Electronic Data. b. Loss means: 1. In Paragraph I.a.i.: (a) Your money, securities or other property fraudulently transferred, paid or delivered; or (b) Money or securities fraudulently debited or deleted from Your account at a financial institution. 2. In Paragraph I.a.ii., transferring, paying or delivering money or securities from Your Transfer Account. c. Fraudulent Instruction means: (1) With regard to Paragraph I.a.ii.: (a) A computer, telegraphic instruction directing a fi transfer, pay or deli instruction purports t issued by som- ae el (b) A written instru to debit Tran from tha specified sue ety efacsimile, telephone or other electronic stituti n to debit Your Transfer Account and to or securities from that Transfer Account, which issued by You, but which in fact was fraudulently u Your knowledge or consent. to a financial institution directing the financial institution count and to transfer, pay or deliver money or securities count, through an electronic funds transfer system at der specified conditions, which instruction purports to have y You, but which in fact was issued, forged or altered by someone ur knowledge or consent. (2) With re o Paragraph I.b.: A computer, telegraphic, cable, teletype, telefacsimile, telephone or other electronic, written or voice instruction directing an Employee to enter or change Electronic Data or Computer Programs within a Computer System covered under this Insuring Agreement, which instruction in fact was fraudulently issued by Your computer software contractor. d. Transfer Account means an account maintained by you at a financial institution from which You can initiate the transfer, payment or delivery of Money and Securities: (1) By means of computer, telegraphic, cable, teletype, telefacsimile, telephone or other electronic instructions; or (2) By means of written instructions establishing the conditions under which such transfers are to be initiated by such financial institution through an electronic funds transfer system. III. The following is added to SECTION 1I — LIMITS OF INSURANCE, 2. Aggregate Sublimit(s) of Insurance: SP CW 80 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 4 Policy Number: Endorsement Issued Date: Endorsement Effective Date: riode INTERNATIONAL The most We will pay for all Loss covered under the Computer and Funds Transfer Fraud Insuring Agreement is the Computer and Funds Transfer Fraud Sublimit of Insurance shown above, which is part of, not in addition to the Policy Aggregate Limit of Insurance set forth in the Declarations to this Policy. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments, We will have no further obligations or liability of any kind with respect to Loss subject to such Sublimit of Insurance. IV. Paragraph 1. of Section III — Deductible is deleted in its entirety and replaced with the following: 1. Under Insuring Agreements 1. Security Breach Expense, 2. Extortion Threats, 3. Replacement Or Restoration Of Electronic Data, and Paragraph I.a. of this endorsement: We will pay only the amount of Loss which is in excess of the Policy Deductible Amount shown above. V. The following is added to SECTION V — EXCLUSIONS: 1. We will not be liable for Loss based upon, attributable to,. ing out of or resulting from: i. A fraudulent: 1. Entry of Electronic Data or 2. Change of Electronic D r Pr am into; or mp rogram within a Computer System, by a perso .r. •'zation with authorized access to such Computer System, except when cover-. und: g .ph I.b. ii. The use or pur. -. us- c -dit, debit, charge, access, convenience, identification, stored -value or of i• o e information contained on such cards. iii. The givi or ing of property in any exchange or purchase. iv. An Employ nancial institution acting upon any instruction to: 1. Transfer, pay or deliver money, securities or other property; or 2. Debit or delete Your account; which instruction proves to be fraudulent, except when covered under Paragraph I.b. 2. We will not be liable for Loss, or that part of any Loss, the proof of which as to its existence or amount is dependent upon: i. An inventory computation; or ii. A profit and loss computation. VI. The introductory statement to paragraph a. of Condition 14. Duties in the Event of Claim or Loss in SECTION VI — CONDITIONS is deleted in its entirety and replaced with the following: a. Under Insuring Agreements 2. Extortion Threats, 3. Replacement Or Restoration Of Electronic Data and SP CW 80 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 3 of 4 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL this Computer Funds Transfer Fraud Insuring Agreement, you must: All other terms and conditions remain unchanged. SP CW 80 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 4 of 4 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. HARDWARE REPLACEMENT COSTS ENDORSEMENT Hardware Replacement Costs Coverage Limit: See coverage sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Hardware Replacement Costs Endorsement, all provisions of the Policy to which this endorsement is attached, as all terms and conditions, remain unchanged and applicable. This endorsement extends certain coverages. The headers in this endorsement are only for convenience. Read the entire policy carefully to determine rights, duties and what is and is not covered. In consideration of the premium charged for the Policy, it is hereby understood and agreed that: I. The following Insuring Agreement is added to SECTION I — INSURING AGREEMENTS: Hardware Replacement Costs: Subject to the Hardware Replacement Costs Coverage Limit set forth above and any Deductible specified in the Declarations to this policy, We will pay for Loss directly resulting from a Cyber Incident first Discovered during the Policy Period and reported in accordance with Condition 14. Duties in the Event of Claim or Loss in SECTION VI — CONDITIONS, to mitigate the potential of a future Cyber Incident or Security Breach. With respect to this Hardware Replacement Costs Insuring Agreement: a. Loss means the cost to replace hardware, including but not limited to, computers or any associated devices or equipment operated by, and either owned by or leased to, the Insured that are unable to function as intended due to corruption or destruction of software or firmware. b. Loss does not include any sums related to labor costs associated with installing, connecting or setting up the hardware. II. The following is added to SECTION II — LIMITS OF INSURANCE, 2. Aggregate Sublimit(s) of Insurance: The most We will pay for all Loss covered under the Hardware Replacement Costs Insuring Agreement is the Hardware Replacement Costs Aggregate Sublimit of Insurance, if any, shown above or in the Declarations, which are part of, and not in addition to, the Policy Aggregate Limit of Insurance. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments, We will have no further obligations of liability of any kind with respect to Loss subject to such Sublimit of Insurance. SP CW 86 05 22 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: riod€ INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. III. The following is added to SECTION III — DEDUCTIBLE: Under the Hardware Replacement Costs Insuring Agreement, We will pay only the amount of Loss which is in excess of the Policy Deductible shown in the Declarations. IV. Exclusion 4 in SECTION V— EXCLUSIONS is deleted in its entirety and replaced with the following: 4. Bodily Injury Bodily Injury means bodily injury, sickness or disease sustained by a person, including death resulting from any of these at any time. It also means mental injury, mental anguish, mental tension, emotional distress, pain or suffering or shock sustained by any person. However, Bodily Injury does not mean mental anguish or emotional distress resulting directly from a Security Breach. SPCW860522 All other terms and conditions remain unchanged. Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. POST BREACH REMEDIATION COVERAGE ENDORSEMENT Post Breach Remediation Coverage Limit: See coverage sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Post Breach Remediation Coverage Endorsement, all provisions of the Policy to which this endorsement is attached, as well as all terms and conditions, remain unchanged and applicable. This endorsement extends certain coverages. The headers in this endorsement are only for convenience. Read the entire policy carefully to determine rights, duties and what is and is not covered. In consideration of the premium charged for the Policy, it is hereby understood and agreed that: I. The following Insuring Agreement is added to SECTION I — INSURING AGREEMENTS. Post Breach Remediation: Subject to the Post Breach Remediation Coverage Limit set forth above and any Deductible specified in the Declarations to this policy, We will pay Loss incurred with Our prior written approval during the Policy Period and reported in accordance with Condition 14. Duties in the Event of Claim or Loss in SECTION VI — CONDITIONS, to resolve any vulnerabilities or weaknesses in your Computer System that are identified by an independent security firm after a Cyber Incident or Security Breach. The upgrades or improvements must be determined by the independent security firm to reduce the probability or potential damage from a Cyber Incident or Security Breach in the future. With respect to this Post Breach Remediation Insuring Agreement: a. Loss solely means: i. labor costs incurred by an independent security firm to determine whether any vulnerabilities or weaknesses exist in Your Computer System that are identified by an independent security firm after a Cyber Incident or Security Breach; and ii. labor costs incurred to resolve any vulnerabilities or weaknesses in your Computer System that are identified by an independent security firm after a Cyber Incident or Security Breach. II. The following is added to SECTION II — LIMITS OF INSURANCE. 2. Aggregate Sublimit(s) of Insurance: SP CW 87 05 22 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: riode INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. The most We will pay for all Loss covered under the Post Breach Remediation Insuring Agreement is the Post Breach Remediation Aggregate Sublimit of Insurance, if any, shown above or in the Declarations, which are part of, and not in addition to, the Policy Aggregate Limit of Insurance. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments, We will have no further obligations of liability of any kind with respect to Loss subject to such Sublimit of Insurance. III. The following is added to SECTION III — DEDUCTIBLE: Under the Post Breach Remediation Insuring Agreement, We will pay only the amount of Loss which is in excess of the Policy Deductible amount shown in the Declarations. All other terms and conditions remain unchanged. SP CW 87 05 22 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. SOCIAL ENGINEERING ENDORSEMENT Social Engineering Coverage Limit: See coverage sheet Social Engineering Deductible: See coverage sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Social Engineering Endorsement, all provisions of the Policy to which this endorsement is attached, as well as all terms and conditions, remain unchanged and applicable. In consideration of the premium charged for the Policy, it is hereby un. -rstood and agreed that: I. The following Insuring Agreement is added to SECTION I — I - A ' EEMENTS: Social Engineering Subject to the Social Engineering Coverage Social Engineering Loss resulting dire Discovered during the Policy Period a Event of Claim or Loss in SECTION VI With respect to this Social Engine ng a. Money means currency, checks, register secs a not include dig representing ei le set forth above, We will pay for SoI Engineering Incident that is first in accordance with Condition 14. Duties in the ONS. greement: notes in current use and having a face value, travelers' oney orders held for sale to the public. The term Money does r other negotiable and nonnegotiable instruments or contracts o property. b. Securities mean nt3ble and non-negotiable instruments or contracts representing either Money or property. Securities does not include Money. c. Social Engineering Incident means the intentional misleading of an Insured to transfer Money to a person, place or account beyond the Named Insured's control resulting directly from the Named Insured's employee's good faith reliance upon an instruction transmitted via email, purporting to be from: i. a natural person or entity who exchanges, or is under contract to exchange, goods or services with the Named Insured for a fee (other than a financial institution, asset manager, broker -dealer, armored motor vehicle "named insured" or any similar entity); or ii. an employee of the Named Insured; but which contained a fraudulent and material misrepresentation and was sent by an imposter. SP CW 91 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 3 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. As a condition precedent to coverage under this Social Engineering Endorsement, the Named Insured must have an established and documented funds transfer request verification procedure and that procedure must have been followed before acting upon any instruction. d. Social Engineering Loss means the loss of Money as a result of a Social Engineering Incident. Social Engineering Loss does not include indirect and/or consequential loss. II. The following is added to SECTION II — LIMITS OF INSURANCE, 2. Aggregate Sublimit(s) of Insurance: The most We will pay for all Loss covered under the Social Engineering Insuring Agreement is the Social Engineering Aggregate Sublimit of Insurance, if any, shown above or in the Declarations., which are part of, and not in addition to, the Policy Aggregate it of Insurance. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments a will have no further obligations of liability of any kind with respect to Loss subject to such imi Insurance. III. The following is added to SECTION III — DEDUCT! : LE: Under the Social Engineering Insuring Agree ill p only the amount of Loss which is in excess of the Policy Deductible shown a., orth "` larations. IV. SECTION V — EXCLUSIONS is amended to We will not be liable for Social Engine- •L• - - resulting from a Social Engineering Incident based upon, attributable to or arising off. 1. An actual or alleged infringeation of, misappropriation of or assertion of any right to or interest in any: a. Patent, copyrigrk, trade dress, certification mark, collective mark, service mark, expression, idea, li , name, slogan, style of doing business, symbol, title, trade secret or other intellectual pro rty right by or on behalf of any Insured; or b. Software or computer code or its source content or material by or on behalf of any Insured. 2. A fraudulent, dishonest or criminal act by any Employee or authorized representative of the Named Insured, whether acting alone or in collusion with others. 3. The establishment of any credit or similar promise to pay, or to any party's use of or acceptance of any credit card, debit card or similar instrument, whether or not genuine. 4. Any investment or ownership in any corporation, partnership, real property, or similar instrument, whether or not such investment is genuine. 5. A kidnap, ransom or other extortion payment surrendered as a result of a threat to do bodily harm to any natural person or a threat to harm, take, or transfer property. SP CW 91 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 3 Policy Number: Endorsement Issued Date: Endorsement Effective Date: riode INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. All other terms and conditions remain unchanged. SP CW 91 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 3 of 3 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. TELECOMMUNICATIONS FRAUD ENDORSEMENT Telecommunications Fraud Coverage Limit: See coverage sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Telecommunications Fraud Endorsement, all provisions of the Policy to which this endorsement is attached, as well as all terms and conditions, remain unchanged and applicable. This endorsement extends certain coverages. The headers in this endorsement are only for convenience. Read the entire policy carefully to determine rights, duties and what is and is not covered. In consideration of the premium charged for the Policy, it is hereby understood and agreed that: I. The following Insuring Agreement is added to SECTION I — INSURING AGREEMENTS: Telecommunications Fraud: Subject to the Telecommunications Fraud Coverage Limit set forth above and any Deductible specified in the Declarations to this policy, We will pay for any monetary Loss sustained by You, including but not limited to phone bills, first Discovered during the Policy Period and reported in accordance Condition 14. Duties in the Event of Claim or Loss in SECTION VI - CONDITIONS, directly resulting from an intentional unauthorized access to Your Telephone System by a third party. With respect to this Telecommunications Fraud Insuring Agreement: a. Loss solely means the monetary cost of unauthorized calls or unauthorized use of Your Telephone System's bandwidth. b. Telephone System means the VoIP phone system directly under Your control. II. The following is added to SECTION II — LIMITS OF INSURANCE, 2. Aggregate Sublimit(s) of Insurance: The most We will pay for all Loss covered under the Telecommunications Fraud Insuring Agreement is the Telecommunications Fraud Aggregate Sublimit of Insurance, if any, shown above or in the Declarations., which are part of, and not in addition to, the Policy Aggregate Limit of Insurance. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments, We will have no further obligations of liability of any kind with respect to Loss subject to such Sublimit of Insurance. SP CW 85 05 22 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. III. The following is added to SECTION III — DEDUCTIBLE Under the Telecommunications Fraud Insuring Agreement, We will pay only the amount of Loss which is in excess of the Policy Deductible shown in the Declarations. All other terms and conditions remain unchanged. SP CW 85 05 22 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. WEBSITE MEDIA CONTENT LIABILITY ENDORSEMENT Website Media Content Liability Coverage Limit: See coverage sheet Website Media Content Liability Deductible: See coverage sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Website Media Content Liability Endorsement, this endorsement is attached, as well as all terms and conditions, re In consideration of the premium charged for the Policy, it is hereb I. The following Insuring Agreement is added to SECTION— INSU Website Media Content Liability Subject to the Website Media Content We will pay for Loss that the Insured be as a result of a Claim that is Di with Condition 14. Duties in the one or more of the followin. s end of the Policy Period in t social media web page crea 7 d II provisions of the Policy to which n unchanged and applicable. nd agreed that: AGREEMENTS: overage Limit and Deductible set forth above, Ily obligated to pay and Defense Expenses the Policy Period and reported in accordance aim or Loss in SECTION VI — CONDITIONS, for ted on or after the retroactive date and before the our display of Media Material on Your website or on ntained by or on behalf of You: a. invasion of[n e with an individual's right of publicity, including commercial appropriation of na persona, voice or likeness; or b. plagiarism, piracy or misappropriation of ideas under implied contract; or c. infringement of copyright; or d. infringement of domain name, trademark, trade name, trade dress, logo, title, metatag, slogan, service mark, service name; or e. improper deep -linking or framing within electronic content. With respect to this Website Media Content Liability Insuring Agreement: a. Media Material means any information in electronic form, including words, sounds, numbers, images, or graphics and shall also include advertising, video, streaming content, webcasting, online forums, bulletin boards and chat room content, but does not mean computer software or the actual goods, products or services described, illustrated or displayed in such Media Material. II. Exclusions Applicable to the Website Media Content Liability Insuring Agreement: SP CW 83 05 22 Page 1 of 2 Spinnaker Insurance Company Includes copyrighted material of Insurance Services Office, Inc., with its permission Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. We will not be liable for any Claim resulting from an act based upon, attributable to or arising out of: 1. An actual or alleged infringement of, violation of, misappropriation of or assertion of any right to or interest in any: a. Patent, copyright, trademark, trade dress, certification mark, collective mark, service mark, expression, idea, likeness, name, slogan, style of doing business, symbol, title, trade secret or other intellectual property right by or on behalf of any Insured, provided that this Exclusion does not apply to a claim resulting from an act based upon, attributable to or arising out of infringement of copyright, or infringement of domain name, trademark, trade name, trade dress, logo, title, metatag, slogan, service mark, service name in the course of Your display of Media Material on Your website or on social media web pages created and maintained by or on behalf of You; or b. Software or computer code or its source content or m ria]'or on behalf of any Insured. III. The following is added to SECTION II — LIMITS Insurance: The most We will pay for all Loss cove Agreement is the Website Media Conte of, not in addition to the Policy Aggrega Policy. Upon exhaustion of any no further obligations or liability Insurance. 2. Aggregate Sublimit(s) of ed�id the Website Media Content Liability Insuring Sublimit of Insurance shown above, which is part nsurance set forth in the Declarations to this it of Insurance by such payments, We will have with respect to Loss subject to such Sublimit of conditions remain unchanged. SP CW 83 05 22 Page 2 of 2 Spinnaker Insurance Company Includes copyrighted material of Insurance Services Office, Inc., with its permission Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. SERVICE FRAUD INCLUDING CRYPTOJACKING ENDORSEMENT Service Fraud Coverage Limit: See policy cover sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Service Fraud Endorsement, all provisions of the Policy to which this endorsement is attached, as well as all terms and conditions, remain unchanged an applicable. This endorsement extends certain coverages. The headers in thi• ndo ment are only for convenience. Read the entire policy carefully to determine rights, duties and wha d is covered. In consideration of the premium charged for the Policy, it is eby unde ood and agreed that: I. The following Insuring Agreement is added ON I — INSURING AGREEMENTS: Service Fraud: Subject to the Service Fraud the Declarations to this but not limited to phon during the Policy Period Claim or Los unauthorized a im set forth above and any Deductible specified in for any monetary Loss sustained by You, including sed service bills, and Cryptojacking, first Discovered d in accordance Condition 14. Duties in the Event of N VI - CONDITIONS, directly resulting from an intentional elephone System by a third party. With respect to this ej mmunications Fraud Insuring Agreement: a. Loss means the additional monetary costs incurred by You as a direct result of: 1. unauthorized calls or unauthorized use of Your Telephone System's bandwidth; 2. unauthorized access or use of Your Cloud Based Services; and 3. unauthorized access or use of a Computer System for the purpose of mining for Virtual Currency with the use of any of the following services or resources: • electricity • natural gas • oil • Internet. b. Monetary Costs include only those additional amounts billed to You by the respective service provider, including usage or consumption information, incurred in a periodic billing statement pursuant to a written contract executed before the Loss first occurred with You, and does not SP CW 70 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. include any amounts charged at a flat fee that does not scale with the rate or use of the respective service due for payment during the Policy Period. c. Telephone System means the Voice over Internet Protocol (VoIP) phone system directly under Your control. d. Cloud Based Services means Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). e. Virtual Currency means a type of digital representation of currency or asset which is stored, transferred, and transacted in electronic form, utilizes cryptography to secure its network, regulate its generation, and verify its transfer, and operated independently of a central bank or other central authority in the majority of financial jurisdictions.* 11. The following is added to SECTION II — LIMITS OF INSURICE, 2. Aggregate Sublimit(s) of Insurance: The most We will pay for all Loss covered under the S e Fr Insuring Agreement is the Service Fraud Aggregate Sublimit of Insuranc if any, s ove or in the Declarations., which are part of, and not in addition to, the licy A gate Limit of Insurance. Upon exhaustion of any Aggregate Sublimit of I• e s payments, We will have no further obligations of liability of any kind with r_ • os ject to such Sublimit of Insurance. III. The following is added to SECTION III — ' IBLE Under the Service Fraud Ins •re - We will pay only the amount of Loss which is in excess of the Policy Deductible the Declarations. and conditions remain unchanged. SP CW 70 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. DEDICATED BREACH COSTS ENDORSEMENT Security Breach Expense Coverage Limit: See policy cover sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Security Breach Expense Outside of Limit Endorsement, all provisions of the Policy to which this endorsement is attached, as well as all terms and conditions, remain unchanged and applicable. This endorsement extends certain coverages. The headers in this ors= ent are only for convenience. Read the entire policy carefully to determine rights, duties and w : 's . . is n.t covered. In consideration of the premium charged for the Policy, it isereby un. . .d and agreed that: I. Paragraph 1. Policy Aggregate Limit of I ION II — LIMITS OF INSURANCE is deleted in its entirety and replaced with t 1. Policy Aggregate Limit of Insura Except as provided below and the most We will pay f Limit of Insurance show Paragraph 3. Security B Insurance shall terms of this P applicable, the obligations or Iiabili h . Security Breach Expense Limit of Insurance, s and Defense Expenses is the Policy Aggregate rations. Furthermore, except as provided below under ense Limit of Insurance, the Policy Aggregate Limit of y any payment, including Defense Expenses, made under the austion of the Policy Aggregate Limit of Insurance and, only if • reach Expense Limit of Insurance, We will have no further y kind under this Policy. II. Paragraph 2. Aggregate Sublimit(s) of Insurance of SECTION II — LIMITS OF INSURANCE is deleted in its entirety and replaced with the following: The Aggregate Sublimit(s) of Insurance set forth in the Declarations are part of, and not in addition to, the Policy Aggregate Limit of Insurance. Any such Aggregate Sublimit(s) of Insurance shall be reduced by any payment for Loss and, if applicable, Defense Expenses, under the Insuring Agreement to which such Aggregate Sublimit of Insurance applies. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments, We will have no further obligations or liability of any kind with respect to Loss or Defense Expenses, subject to such Sublimit of Insurance. 2. Aggregate Sublimit(s) of Insurance Except as provided below under Paragraph 3. Additional Security Breach Expense Limit of Insurance, Subject to the Policy Aggregate Limit of Insurance, the most We will pay for all Loss covered under: SP CW 71 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. a. Insuring Agreement 2 — Extortion Threats, is the Ransom Payments Aggregate Sublimit Of Insurance, if any, shown in the Declarations; and b. Insuring Agreement 4 — Business Income and Extra Expense, is the Business Income and Extra Expense Aggregate Sublimit Of Insurance, if any, shown in the Declarations. The Aggregate Sublimit(s) of Insurance described in Paragraphs 2.a. and 2.b. above are part of, and not in addition to, the Policy Aggregate Limit of Insurance. Any such Aggregate Sublimit(s) of Insurance shall be reduced by any payment for Loss and, if applicable, Defense Expenses, under the Insuring Agreement to which such Aggregate Sublimit of Insurance applies. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments, We will have no further obligations or liability of any kind with re ct to Loss or Defense Expenses, subject to such Sublimit of Insurance. 1I1. The following is added to SECTION II — LIMITS OSURAN 3. Additional Security Breach Expens Solely with respect to SECTION I — I U `' AGREEMENTS, 1. Security Breach Expense: a. All Loss covered and Expense incurred by shown in the Declaratio Discovered du shall only apply InsuranII s Insura SEC - URING AGREEMENTS, 1. Security Breach ured in excess of the Policy Deductible amount directly from a Security Breach or Cyber Incident Period or any extended reporting period, if applicable, e, the Additional Security Breach Expense Limit of oss shall not apply to or reduce the Policy Aggregate Limit of b. Upon exh ustio f the Additional Security Breach Expense Limit of Insurance We will have her obligations or liability of any kind SECTION I — INSURING AGREEMENTS, 1. Security Breach Expense under the Policy. All other terms and conditions remain unchanged. SP CW 71 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. REVERSE SOCIAL ENGINEERING ENDORSEMENT Reverse Social Engineering Coverage Limit: See cover sheet Reverse Social Engineering Deductible: See cover sheet This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Reverse Social Engineering Endorsement, all provisions of the Policy to which this endorsement is attached, as well as all terms and conditions, remain unchanged and applicable. This endorsement extends certain coverages. The headers in this endorsement are only for convenience. Read the entire policy carefully to determine rights, duties and what is and is not covered. In consideration of the premium charged for the Policy, it is hereby understood and agreed that: I. The following Insuring Agreement is added to SECTION I — INSURING AGREEMENTS: Reverse Social Engineering: Subject to the Reverse Social Engineering Coverage Limit and Deductible set forth above, We will pay for a Reverse Social Engineering Loss resulting directly from a Reverse Social Engineering Event that is first Discovered during the Policy Period and reported in accordance with Condition 14. Duties in the Event of Claim or Loss in SECTION VI — CONDITIONS. With respect to this Reverse Social Engineering Insuring Agreement: a. Client means any person or entity with whom You have entered into a written contract to provide services or deliverables. b. Money means currency, coins or banknotes in current use and having a face value, travelers' checks, register checks and money orders held for sale to the public. The term Money does not include digital currency or other negotiable and nonnegotiable instruments or contracts representing either Money or property. c. Reverse Social Engineering Event means the intentional use of Your Computer System by a person or organization that is not an Insured to mislead or deceive Your Client or Vendor into transferring Money intended for You to another person or entity. d. Reverse Social Engineering Loss means the loss of Money as a result of a Reverse Social Engineering Event. e. Vendor means any person or entity with whom You have entered into a written contract to provide services to You provided that entity is not owned, operated or controlled by You. Vendor does not include any financial institutions with which you directly or indirectly do business. SP CW 82 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. II. The following is added to SECTION II — LIMITS OF INSURANCE, 2. Aggregate Sublimit(s) of Insurance: The most We will pay for all Loss covered under the Reverse Social Engineering Insuring Agreement is the Reverse Social Engineering Aggregate Sublimit of Insurance, if any, shown above, which is part of, not in addition to the Policy Aggregate Limit of Insurance set forth on the Declarations to this Policy. Any such Aggregate Sublimit(s) of Insurance shall be reduced by the amount of any payment for Loss under the Insuring Agreement to which such Aggregate Sublimit of Insurance applies. Upon exhaustion of any Aggregate Sublimit of Insurance by such payments, We will have no further obligations or liability of any kind with respect to Loss subject to such Sublimit of Insurance. III. The following is added to SECTION III - DEDUCTIBLE Under the Reverse Social Engineering Insuring Agreement, We will pay only the amount of Loss which is in excess of the Reverse Social Engineering Deductible amount shown above. All other terms and conditions remain unchanged. SP CW 82 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 2 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. ENHANCED BUSINESS INCOME, CONTINGENT BUSINESS INCOME AND EXTRA EXPENSE COVERAGE ENDORSEMENT - INCLUSIVE OF SYSTEMS FAILURE This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY Unless modified by this Endorsement, all provisions of the Policy to which this endorsement is attached, as well as all terms and conditions, remain unchanged and applicable. This endorsement extends certain coverages. The headers in this end• -mes are only for convenience. Read the entire policy carefully to determine rights, duties and what is and is not In consideration of the premium charged for the Policy, it is hereb dersto..'and agreed that: I. Insuring Agreement 4. Business Income, Continge t Income and Extra Expense is deleted in its entirety and replaced with the following: 4. Business Income, Contingent Busin nco e d xtra Expense We will pay for Loss due to an System Failure that is Discove applicable. rupb• res. ing directly from a Cyber Incident, Extortion Threat or Policy Period or during any extended reporting period, if With respect to this Inst 4, Loss means the actual Loss of: (1) "business and contingent business income" You s r (2) "extra expense" You incur. As used in this Insuring Agreer4Sent 4: a. "Business and contingent business income" means the: net income (net profit or loss before income taxes) that would have been earned or incurred; and ii. continuing normal operating expenses incurred, including payroll. "Business and contingent business" income does not include: (1) Net Profit that would likely have been earned as a result of an increase in volume due to favorable business conditions caused by the impact of network security failures impacting other businesses, loss of market, or any other consequential loss b. "Extra expense" means necessary and reasonable expenses You incur during the period of restoration as a result of the measurable Interruption of the Insured's business operations, in order to reduce the period of restoration and minimize or reduce Business and Contingent Business income. "Extra expense" does not include: SP CW 76 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 3 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL (1) any costs or expenses associated with upgrading, maintaining, repairing, remediating or improving a Computer System as a result of a Cyber Incident, Extortion Threat or System Failure; or (2) Extortion Expenses covered under Insuring Agreement 2 — Extortion Threats. II. The following definition in SECTION VII — DEFINITIONS is deleted in its entirety and replaced with the following: Interruption means: a. With respect to a Cyber Incident or System Failure: an unanticipated cessation or slowdown for Your business operations; or ii. Your suspension of Your business operations for the purpose of avoiding or mitigating the possibility of transmitting a Virus or malicious code to another person or organization; and, with regard to Paragraphs 14.a.i and 14.a.ii. ve, shall be deemed to begin when Your business operations are interrupted and ends a sliest of: (1) (2) (3) one hundred -eighty (180) days after the the time when Your business orations are the time when service is re on begins; med; or b. With respect to an Extortion Threat, Yo. of - ry supension of Your business operations: based upon clear evidence o -di. threat; or ii. based upon the recomdati• . s-curity firm, if any; and, with regard t• 'aragr. •s •.i and 14.b.ii. above, shall be deemed to begin when Your business operati. 't to •ted and ends at the earliest of: (1) o ndre -ighty (180) days after the Interruption begins; (2) e ti Your business operations are resumed; or (3) e n service is restored to You. III. The following definition is ad SECTION VII — DEFINITIONS: System Failure means: any sudden, unintentional, or unexpected and continuous Interruption of your Computer System which disrupts, prevents, or restricts the normal functioning of your business operations which would otherwise have been handled in whole or in part by the Computer System and is directly caused by a Cyber Incident, malfunction in normal computer function or network service, or hardware failure. System Failure does not include: (1) any hardware failure due to design/manufacturing defects or use of hardware past End of Life Announcements (EOLA) or Last Date of Support (LODS); (2) failure of hosted computer systems that results in an outage that extends beyond the services being provided to you by hosted Computer Systems; (3) failure to adequately anticipate or capacity plan for expected and/or above -normal operational demand for Computer Systems except where this demand is a denial of service attack; (4) any Interruption of a Computer System resulting from a Security Breach; or (5) any Interruption of a Computer System operated by any Third Party. SP CW 76 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 2 of 3 Policy Number: Endorsement Issued Date: Endorsement Effective Date: node INTERNATIONAL IV. Condition 16. Valuation — Settlement in SECTION VI — CONDITIONS is deleted in its entirety and replaced with the following: 16. Valuation — Settlement All premiums, limit(s) of insurance, deductible amounts, Loss and any other monetary amounts under this Policy are expressed and payable in the currency of the United States of America. If judgment is rendered, settlement is agreed to or another component of Loss under this Policy is expressed in any currency other than United States of America dollars, payment under this Policy shall be made in United States dollars at the rate of exchange published in The Wall Street Journal on the date the final judgment is entered, settlement amount is agreed upon or the other component of Loss is due, respectively. a. With respect to Loss covered under Insuring Agreement 4 — Business Income, Contingent Business Income and Extra Expense, the amount of "business and contingent business income" will be determined based on consideration of: the net income generated from Your business activ' 'es before the Interruption occurred; ii. the likely net income generated by Your busines ctivities if no Interruption had occurred, but not including any net income that would lik av- -en earned as a result of an increase in the volume of business due to favorable bus and.. ns caused by the impact of the Cyber Incident or System Failure on customers . .n er businesses; the operating expenses, including payr ecessa esume Your business activities with the same quality of service that exis.: ;•,e the ydterruption; and 44 iv. other relevant sources of infor s 'ion, nc Your financial records and accounting procedures, bills, invoices and o r v. hers, gnd debts, liens and contracts. However, the amount of "business an the reduction in the volume of in the volume of business fro sources. t business income" will be reduced to the extent that h- affected business activities is offset by an increase s of commerce such as via telephone, mail or other b. With respect to Loss cove suring Agreement 4 — Business Income, Contingent Business Income and Extra, nse, e amount of "extra expense" will be determined based on: i. necessas'that exceed the normal operating expenses that would have been incurred in a rse of Your business activities during the period of coverage if no Interruption occurred. We will deduct from the total of such expenses the salvage value that remains of any property bought for temporary use during the period of coverage once Your business activities are resumed; and ii. necessary expenses that reduce the "business and contingent business income" Loss that otherwise would have been incurred during the period of coverage. All other terms and conditions remain unchanged. SP CW 76 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 3 of 3 Policy Number: Issued Date: Effective Date: node INTERNATIONAL THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY. INCREASE OF OR ELIMINATION OF BUSINESS AND CONTINGENT BUSINESS INCOME AND EXTRA EXPENSE SUBLIMIT This endorsement modifies insurance provided under the following: COMMERCIAL CYBER INSURANCE POLICY SCHEDULE Effective Date of Endorsement: Inception Date Business and Contingent Business Income and Extra Expense Sublimit: See coverage sheet Premium: TBC In consideration of the premium charged for the Policy, The following sentence is added to Para II — LIMITS OF INSURANCE, 2. Aggre Insuring Agreement 4 — Busines Business Income and Extra Expe Schedule of this endorseme by un. -r3`tood and agreed that: gregate Sublimit(s) of Insurance of SECTION mit(s) of Insurance: nt Business Income and Extra Expense: is the gate Sublimit of Insurance, if any, shown in the oilier tes and conditions remain unchanged. SP CW 72 02 23 Includes copyrighted material of Insurance Services Office, Inc., with its permission Page 1 of 1