Named Insured as Agent
The Named Insured will be considered the agent of all Insureds, and will act on behalf of all Insureds with respect to the giving of or receipt of all notices pertaining to this Policy, and the acceptance of any endorsements to this Policy. The Named Insured is responsible for the payment of all premiums and Retentions and for receiving any return premiums.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 181
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 42 of 76 Page | 1
Cyber Insurance – Incident Response Directions
Hamilton Policy Reference: B1180D231573/009
Named Insured: CU Technology d.b.a. Acorn Technology Services Policy Period: Effective from Thu Jun 01 2023 to Sat Jun 01 2024 Both days at 12.01a.m. Local Standard Time
IMPORTANT INFORMATION
IN THE EVENT OF AN INCIDENT AFFECTING THIS POLICY YOU SHOULD
CONTACT HAMILTON’S 24/7 INCIDENT RESPONSE PARTNER
BATES CAREY LLP
AT
+1 312 762 3256 or [email protected]
AND
QUOTE THE HAMILTON POLICY REFERENCE AND NAMED INSURED ABOVE
WHAT YOU SHOULD DO WHAT YOU SHOULD NOT DO
Contact Bates Carey LLP
Quote the Hamilton Policy Reference above
Quote the Named Insured above
State you hold a Hamilton policy
Cooperate fully with Bates Carey LLP
Ignore or do nothing
Contact another incident Response company
Negotiate with cyber criminals
Pay money to anyone
Contact another law firm
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 182
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 43 of 76
CONDITIONS SECTION
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 183
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 44 of 76
U.S. Terrorism Risk Insurance Act of 2002 as amended
New & Renewal Business Endorsement
This Endorsement is issued in accordance with the terms and conditions of the "U.S. Terrorism Risk Insurance Act of 2002" as amended, as summarized in the disclosure notice.
In consideration of an additional premium of USD 95.75 paid, it is hereby noted and agreed with effect from inception that the Terrorism exclusion to which this Insurance is subject, shall not apply to any “insured loss” directly resulting from any "act of terrorism" as defined in the "U.S. Terrorism Risk Insurance Act of 2002", as amended ("TRIA").
The coverage afforded by this Endorsement is only in respect of any “insured loss” of the type insured by this Insurance directly resulting from an "act of terrorism" as defined in TRIA. The coverage provided by this Endorsement shall expire at 12:00 midnight December 31, 2027, the date on which the TRIA Program is scheduled to terminate, or the expiry date of the policy whichever occurs first, and sha ll not cover any losses or events which arise after the earlier of these dates. The Terrorism exclusion, to which this Insurance is subject, applies in full force and effect to any other losses and any act or events that are not included in said definition of "act of terrorism".
This Endorsement only affects the Terrorism exclusion to which this Insurance is subject. All other terms, conditions, insured coverage and exclusions of this Insurance including applicable limits and deductibles remain unchanged and apply in full force and effect to the coverage provided by this Insurance.
Furthermore the Underwriter(s) will not be liable for any amounts for which they are not responsible under the terms of TRIA (including subsequent action of Congress pursuant to the Act) due to the application of any clause which results in a cap on the Underwriter’s liability for payment for terrorism losses.
LMA5389
09 January 2020
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 184
D231573009
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 45 of 76
LLOYD'S CCPA PRIVACY POLICY1
UNDERWRITERS AT LLOYD'S, LONDON
This CCPA Privacy Policy explains how Certain Underwriters at Lloyd's, London (“we” or “us”) collect, use, and disclose personal information subject to the California Consumer Privacy Act (“CCPA”). “Personal information” is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident (“consumer”) or household. This CCPA Privacy Policy also describes the privacy rights of California consumers and how they can exercise those rights.
The CCPA does not apply to certain types of information, such as information subject to the Gramm - Leach-Bliley Act (“GLBA”) or the Fair Credit Reporting Act (“FCRA”). This means that this CCPA Privacy Policy may not apply to personal information that we collect about individuals who seek, apply for, or obtain insurance products or services for personal, family, or household purposes. The CCPA also has limited application to personal information we collect in connection with providing a product or service to a business.
PERSONAL INFORMATION WE COLLECT
We collect, and in the past 12 months have collected, the categories of personal information described below from the sources described below. Some of this personal information may be subject to GLBA or FCRA.
Directly From You
We collect, and in the past 12 months have collected, the following categories of personal information about you that you include in your application or other forms that you submit, or that you otherwise provide to us:
• [Personal identifiers, such as name, postal address, email address, Social Security number, policy number, account number, driver’s license number, or passport number • Customer records information, such as bank account number, credit or debit card number, other financial information, phone number, health insurance information, or medical history • Protected information, such as race, religion, sexual orientation, gender, age, or marital status • Commercial information, such as records of personal property and insurance products or services purchased or obtained, purchasing or consuming histories, or transaction or account information
• Professional or employment related information, such as work history • Education information, such as school and date of graduation] 2
From Our Affiliates and Third Parties
We collect the following categories of personal information about you from our affiliates and other third parties, such as agents, brokers, consumer reporting agencies, or loss adjusters:
• [Personal identifiers, such as name, postal address, email address, Social Security number, policy number, account number, driver’s license number, or passport number • Customer records information, such as bank account number, credit or debit card number, other financial information, phone number, health insurance information, or medical history • Protected information, such as race, religion, sexual orientation, gender, age, or marital status DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 185
D231573009
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 46 of 76
• Commercial information, such as records of personal property and insurance products or services purchased or obtained, purchasing or consuming histories, or transaction or account information
• Professional or employment related information, such as work history • Education information, such as school and date of graduation] 3
We may also draw inferences from the personal information we collect directly from you or from our affiliates and third parties.
HOW WE USE PERSONAL INFORMATION
The purposes for which we use personal information depend on our relationship or interaction with a specific California consumer. We may use, and in the past 12 months have used, personal information to underwrite your insurance policy and evaluate claims under your policy; to operate and manage our business; to provide and maintain our insurance products and services; to verify your identity; to detect and prevent fraud; for vendor management purposes; to operate, manage, and maintain our business, such as developing and marketing our products and services; to conduct research and data analysis; to comply with applicable laws; to respond to civil, criminal, or regulatory lawsuits or investigations; to exercise our rights or defend against legal claims; to resolve complaints and disputes; to perform compliance activities; and to perform institutional risk control.
PERSONAL INFORMATION WE DISCLOSE
We disclose, and in the past 12 months have disclosed, the categories of personal information described in “Personal Information We Collect” for the purposes described in “How We Use Personal Information” to the following categories of third parties: 4 • Affiliates
• Agents
• Brokers
• Service providers, such as loss adjusters, fraud prevention services, and software provider s • Regulatory and law enforcement agencies
• Attorneys, auditors, and other business partners
In the past 12 months, we did not sell personal information, as the term “sell” is defined under the CCPA.
YOUR RIGHTS
You may have certain rights under the CCPA. These rights are subject to certain conditions and exceptions. Your rights under the CCPA may include: 5
• Right to Request to Know. You have the right to request to know the following information about our practices over the past 12 months: (i) the categories of personal information we collected about you; (ii) the categories of sources from which we collected the personal information about you; (iii) the categories of third parties with whom we shared personal information, (iv) the categories of personal information we sold or disclosed about you and the categories of third parties to whom we sold or disclosed that particular category of personal information; (v) our business or commercial purpose for collecting or selling your personal information; and (vi) the specific pieces of personal information we collected about you.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 186
D231573009
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 47 of 76
You may exercise your right to request to know twice a year, free of charge. If we are unable to fulfil your request to know, we will let you know the reason why. Please note, in response to a request to know, we are prohibited from disclosing your Social Security number; driver’s license number or other government-issued identification number; financial account number; any health insurance or medical identification number; an account password, security questions, or answers; and unique biometric data generated from measurements or technical analysis of human characteristics.
• Right to Request to Delete. You have the right to request that we delete the personal information that we have collected from you. We may deny your request under certain circumstances, such as if we need to retain your personal information to comply with our legal obligations or if retaining the information is necessary to complete a transaction for which your personal information was collected. If we deny your request to delete, we will let you know the reason why.
• Right to Non-Discrimination. If you choose to exercise any of these rights, we will not discriminate against you in any way.
If you, or your authorized agent, would like to make a request to know or request to delete, contact us at [toll-free number]6 or email your agent or broker who handled this insurance at the email address under “Contact Us” below.
We will take steps to verify your identity before processing your request to know or request to delete.
We will not fulfil your request unless you have provided sufficient information for us to reasonably verify that you are the individual about whom we collected personal information. We may request additional information about you so that we can verify your identity. We will only use additional personal information you provide to verify your identity and to process your request.
You may use an authorized agent to submit a request to know or a request to delete. When we verify your agent’s request, we may verify both your and your agent’s identity and request a signed document from you that authorizes your agent to make the request on your behalf. To protec t your personal information, we reserve the right to deny a request from an agent that does not submit proof that they have been authorized by you to act on your behalf. You may also make a consumer request on behalf of your minor child.
UPDATES TO PRIVACY NOTICE
We may change or update this CCPA Privacy Policy from time to time. If we make material changes to this CCPA Privacy Policy, we will provide you with an updated copy of the policy.
CONTACTING US
If you have any questions or concerns about this CCPA Privacy Policy or would like to learn more about how we protect your privacy, please contact the agent or broker through whom you purchased this insurance policy at [response].
Effective Date: Thu Jun 01 2023
LMA 9191
18 September 2020
1 This privacy policy does not cover agents of the Underwriters or visitors to the Underwriters’ websites. If the Underwriters are selling personal information of agents and coverholders, or they have a website, they will need a separate policy for these individuals.
2 The categories of personal information under the CCPA that are most likely being collected have been listed. The categories of personal information we did not include are biometric information; geolocation information; internet or other electronic network activity; or audio, electronic, visual, or olfactory information since it seemed unlikely that the Underwriters are collecting this DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 187
D231573009
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 48 of 76
information. This section should be customized so that categories or types of personal information not being collected are deleted. If a specific type of personal information is collected that is not included, that specific piece of personal information should be added to the relevant category.
3 The categories of personal information under the CCPA that are most likely being collected have been listed. The categories of personal information we did not include are biometric information; geolocation information; internet or other electronic network activity; or audio, electronic, visual, or olfactory information since it seemed unlikely that the Underwriters are collecting this information. This section should be customized so that categories or types of personal information not being collected are deleted. If a specific type of personal information is collected that is not included, that specific piece of personal information should be added to the relevant category.
4 Underwriters should confirm this section is accurate as to the parties with whom personal information is shared. 5 It has been assumed that the Underwriters are not selling consumers’ personal information and the right to opt-out of the sale of personal information has therefore not been included. If personal information is being sold, this notice will need to be amended/updated.
6 CCPA requires that insurers provide a toll free contact number, for consumers to make requests. This is an obligation that Underwriters will need to rely on their coverholders for, so this should be provided /completed by the coverholder. It is not required that the toll-free number be answered by a live individual.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 188
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 49 of 76
PREMIUM PAYMENT WARRANTY
IT IS WARRANTED that all Premiums due to the London Intermediary under this Policy are paid within 60 days from Inception.
Non-receipt by the London Intermediary of such premiums by Midnight on the Premium Due date shall render this Insurance Policy void with effect from Inception.
11/93
LSW585 (amended)
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 189
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 50 of 76
SMALL ADDITIONAL OR RETURN PREMIUMS CLAUSE (U.S.A.)
NOTWITHSTANDING anything to the contrary contained herein and in consideration of the premium for which this Insurance is written, it is understood and agreed that whenever an additional or return premium of $50 or less becomes due from or to the Assured on account of the adjustment of a deposit premium, or of an alteration in coverage or rate during the term or for any other reason, the collection of such premium from the Assured will be waived or the ret urn of such premium to the Assured will not be made, as the case may be.
NMA1168 (amended)
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 190
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 51 of 76
SERVICE OF SUIT CLAUSE (U.S.A.)
It is agreed that in the event of the failure of the Underwriters hereon to pay any amount claimed to be due hereunder, the Underwriters hereon, at the request of the Insured (or Reinsured), will submit to the jurisdiction of a Court of competent jurisdiction within the United States. Nothing in this Clause constitutes or should be understood to constitute a waiver of Underwriters' rights to commence an action in any Court of competent jurisdiction in the United States, to remove an action to a United Stat es District Court, or to seek a transfer of a case to another Court as permitted by the laws of the United States or of any State in the United States.
It is further agreed that service of process in such suit may be made upon
Lloyd's America Inc.,
Attention: Legal Department,
280 Park Avenue, East Tower, 25th Floor,
New York, NY 10017
and that in any suit instituted against any one of them upon this contract, Underwriters will abide by the final decision of such Court or of any Appellate Court in the event of an appeal.
The above-named are authorized and directed to accept service of pr ocess on behalf of Underwriters in any such suit and/or upon the request of the Insured (or Reinsured) to give a written undertaking to the Insured (or Reinsured) that they will enter a general appearance upon Underwriters' behalf in the event such a suit shall be instituted.
Further, pursuant to any statute of any state, territory or district of the United States which makes provision therefor, Underwriters hereon hereby designate the Superintendent, Commissioner or Director of Insurance or other officer specified for that purpose in the statute, or his successor or successors in office, as their true and lawful attorney upon whom may be served any lawful process in any action, suit or proceeding instituted by or on behalf of the Insured (or Reinsured) or any beneficiary hereunder arising out of this contract of insurance (or reinsurance), and hereby designate the above-named as the person to whom the said officer is authorized to mail such process or a true copy thereof.
NMA1998
24/04/1986
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 191
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 52 of 76 Page 1 of 1
CHOICE OF LAW AND SERVICE OF SUIT
In consideration of the premium charged for the Policy, it is hereby understood and agreed that GENERAL CONDITIONS is amended to include:
Service of Suit
It is agreed that in the event of the Underwriters’ failure to pay any amount claimed to be due under this Policy, the Underwriters will, at the Insured’s request, submit to the jurisdiction of a court of competent jurisdiction within the United States. No thing in this provision constitutes or should be understood to constitute a waiver of the Underwriters’ rights to commence an action in any court of competent jurisdiction in the United States, to remove an action to a United States District Court, or seek a transfer of a case to another court as permitted by the laws of the United States or any state in the United States. It is further agreed that service of processing such suit may be made upon the Underwriters’ representative:
Lloyd's America Inc.,
Attention: Legal Department,
280 Park Avenue, East Tower, 25th Floor,
New York, NY 10017
and that in any suit instituted against any one of them upon this contract, the Underwriters will abide by the final decision of such court or of any appellate court in the event of an appeal.
The person or entity named above is authorized and directed to accept service of process on the Underwriters’ behalf in any such suit and/or upon the Insured’s request to give a written undertaking to the Insured that they will enter a general appearance upon the Underwriters’ behalf in the event such a suit shall be instituted.
Pursuant to any statute of any state, territory, or district of the United States which makes provision therefore, the Underwriters hereby designate the Superintendent, Commissioner, or Director of Insurance or other officer specified for that purpose in the statute, or his successor in office, as their true and lawful attorney upon whom may be served any lawful process in any action, suit, or proceeding instituted by or on the Insured’s behalf or any beneficiary hereunder arising out of this Policy, and hereby designate the person or entity named above as the persons to whom said officer is authorized to mail such process or a true copy thereof.
Choice of Law
Any disputes involving this Policy will be resolved applying the law of the state of New York.
All other terms and conditions of this Policy remain unchanged.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 192
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 53 of 76 Page 1 of 1
COMPUTER HARDWARE REPLACEMENT COST
This endorsement modifies insurance provided under the following:
Hamilton Technology, Cyber and Media Policy Wording
In consideration of the premium charged for the Policy, it is hereby understood and agreed that:
1. The definition of Extra Expense is deleted in its entirety and replaced with the following:
Extra Expense means reasonable and necessary expenses incurred by the Insured Organization during the Period of Restoration to minimize, reduce or avoid Income Loss, over and above those expenses the Insured Organization would have incurred had no Security Breach , System Failure or Dependent Security Breach occurred; and includes reasonable and necessary expenses incurred by the Insured Organization to replace computers or any associated devices or equipment operated by, and either owned by or leased to, the Insured Organization that are unable to function as intended due to corruption or destruction of software or firmware directly resulting from a Security Breach, provided however that the maximum sublimit applicable to Extra Expense incurred to replace such devices or equipment is USD $100,000.
2. Part 2. of the Bodily Injury or Property Damage exclusion is deleted in its entirety and replaced with the following:
2. physical injury to or destruction of any tangible property, including the loss of use thereof; but this will not apply to the loss of use of computers or any associated devices or equipment operated by, and either owned by or leased to, the Insured Organization that are unable to function as intended due to corruption or destruction of software or firmware directly resulting from a Security Breach . Electronic data shall not be considered tangible property;
All other terms and conditions of this Policy remain unchanged.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 193
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 54 of 76 Page 1 of 1
CRISIS MANAGEMENT EXPENSE COVERAGE
This endorsement modifies insurance provided under the following:
Hamilton Technology, Cyber and Media Policy Wording
In consideration of the premium charged for the Policy, it is hereby understood and agreed that:
1. The Limits listed in the Declarations under COVERAGE SCHEDULE are amended to include:
Crisis Management Expenses: $1,000,000
2. INSURING AGREEMENTS is amended to include the following:
To indemnify the Named Insured for 100% of the costs of a public relations consultancy incurred by the Insured Organization with Underwriters’ prior written consent, for the purpose of averting or mitigating material damage to the Insured Organization’s reputation that results or reasonably will result from a Claim covered under by the Policy and publicized through any media channel (“Crisis Management Expenses”); provided, this coverage shall only apply when covered Damages other than (crisis management expenses) exceeds the applicable Retention.
3. The definition of Damages is amended to include Crisis Management Expenses.
All other terms and conditions of this Policy remain unchanged.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 194
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 55 of 76 Page 1 of 1
CRYPTOJACKING ENDORSEMENT
This endorsement modifies insurance provided under the following:
Hamilton Technology, Cyber and Media Policy Wording
In consideration of the premium charged for the Policy, it is hereby understood and agreed that:
1. The aggregate sublimit applicable to all loss under this endorsement is USD $100,000.
2. The Retention applicable to each incident, event, or related incidents or events, giving rise to an obligation to pay loss under this endorsement shall be USD $2,500.
3. INSURING AGREEMENTS is amended to include:
Cryptojacking
To indemnify the Insured Organization for any direct financial loss sustained resulting from Cryptojacking that the Insured first discovers during the Policy Period.
4. DEFINITIONS is amended to include:
Cryptojacking means the Unauthorized Access or Use of Computer Systems to mine for Digital Currency that directly results in additional costs incurred by the Insured Organization for electricity, natural gas, oil, or internet (the “Utilities”); provided, however, that such additional costs for the Utilities are:
1. incurred pursuant to a written contract between the Insured Organization and the respective utility provider, which was executed before the Cryptojacking first occurred;
2. billed to the Insured Organization by statements issued by the respective utility provider, which include usage or consumption information;
3. not charged to the Insured Organization at a flat fee that does not scale with the rate or use of the respective utility; and
4. incurred pursuant to statements issued by the respective utility provider and due for payment during the Policy Period.
All other terms and conditions of this Policy remain unchanged.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 195
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 56 of 76 Page 1 of 1
EMPLOYEE DEVICE ENDORSEMENT
This endorsement modifies insurance provided under the following:
Hamilton Technology, Cyber and Media Policy Wording
In consideration of the premium charged for the Policy, it is hereby understood and agreed that the definition of Computer Systems is amended to include computers, any software residing on such computers and any associated devices or equipment (including b ut not limited to wireless or mobile devices), operated by any person listed in parts 2., 3. or 4. of the Insured definition, but only for work done while acting within the scope of his or her employment and related to the conduct of the Insured Organization’s business.
All other terms and conditions of this Policy remain unchanged.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 196
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 57 of 76 Page 1 of 1
GDPR CYBER ENDORSEMENT
This endorsement modifies insurance provided under the following:
Hamilton Technology, Cyber and Media Policy Wording
In consideration of the premium charged for the Policy, it is hereby understood and agreed that the definition of Data & Network Wrongful Act is amended to include the following:
5. non-compliance with the following obligations under the EU General Data Protection Regulation:
(i) Article 5.1(f), also known as the Security Principle;
(ii) Article 32, Security of Processing;
(iii) Article 33, Communication of a Personal Data Breach to the Supervisory Authority; or
(iv) Article 34, Communication of a Personal Data Breach to the Data Subject.
All other terms and conditions of this Policy remain unchanged.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 197
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 58 of 76
Data Privacy Notice
This privacy notice is provided by Hamilton Insurance DAC and its London Branch. These firms are collectively referred to as Hamilton, we, our and us throughout this notice. Details on each legal entity is contained within the Companies section below.
Your Personal Information
Hamilton is committed to respecting your privacy and
that of the information you provide to us in our
business with you. This data privacy notice seeks to
provide you with information about how and why we
will use your personal data. We keep our data privacy
notice under regular review.
When we ask you for your personal data, we will
explain why we need it. Reasons we may require your
personal data include:
• To perform the contract we have entered into
with you.
• To meet our legal obligations.
• For our legitimate interests, where these do
not compromise your interests, rights and
freedoms.
If we are not being sufficiently clear in our explanation, we invite you to tell us. Where we are required to seek your specific consent to process your personal data we
will explain what we are asking you to agree and why.
In this situation, you have the choice as to whether to give your consent or not. If you do give consent, you
may withdraw it at a later date. Where we require your
consent but you choose to withhold or withdraw it, we
may not be able to perform the contract we have
entered into with you.
When you provide us with your personal data, we will
use it only for the purpose you have provided it. We
respect your privacy and will protect your data from
unintended use in the same way that we protect our
own confidential information. We may disclose your
personal data in the following circumstances:
• Where we are required to do so by law or
regulation.
• To other companies within Hamilton
• Insurance Group to facilitate the effective
management of the group of companies.
We will keep your personal data only for so long as is
necessary for the purpose it was provided and
otherwise in accordance with legal and regulatory
requirements. If you would like further information
regarding the periods for which your personal
information will be stored, please contact us using the details contained within the Contact us section below
Policyholders, Insureds and Claimants Insurance
involves the use and disclosure of your personal data
by various insurance market participants such as
intermediaries, insurers and reinsurers. Our core uses
and disclosures are consistent with the London Market
Core Uses Information Notice (see
londonmarketgroup.Co.Uk/gdpr). We recommend you
review this notice.
Business Partners
We have a legitimate interest in data required to
facilitate the business arrangement between us
and for normal exchanges in the course of business.
We may also lawfully process your information to
perform the contract agreed between us. Unless you
have signed up to receive news updates, we will not
send this information to you. You may withdraw your
consent to receiving news by using the options in the
communication sent to you or by contacting us using
the details contained within the Contact us section
below.
Prospective Employees
We have a legitimate interest in data required to make
contact with you. We may lawfully process data
required for pre-employment activities and have a legal obligation to undertake certain checks.
Website Users
When you visit our website (hamiltongroup.com), your
internet browser may provide us with some of your
personal information, including:
• The time and date you access our website.
• Information about your software and your
internet protocol address (ip address).
• Your location.
• The pages you visited.
We use this information to improve the delivery of
relevant information to you.
We may also leave a cookie on your internet browser.
Hamilton’s cookies policy can be found at
hamiltongroup.com/cookies-policy.
Data Sharing
We may share your personal data with other
companies within the Hamilton Insurance Group, some
of whom are based outside of the European Union.
To fulfil the need for which you have provided us with
your personal data, we may share your data with
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 198
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 59 of 76
companies based outside of the European Union. Not
all countries of the world have data protection
standards that are the equivalent of those in Ireland.
Where we share your personal data with companies
that are based outside of the European Union, we will
make sure that your information is protected to an
equivalent standard by, for example:
• Contracting with the receiving company with
clauses approved by the European Union
authorities as providing adequate protection or
through the use of Binding Corporate Rules.
• Sharing the data with companies in countries
considered by the European Commission as
having suitably high standards of data
protection legislation. A list of these countries
can be found on the European Union website
at ec.europa.eu/info/law/law-topic/data-
protection.
• Sharing the data with companies that have
committed to adequate levels of protection
through participation in schemes such as the
Privacy Shield agreed between the data
protection authorities of the European Union
and United States.
Website Users
The website hamiltongroup.com is hosted outside of
the European Union by a third party. Your Rights In
relation to your personal data, you may have the right
to require us to:
• Give further details of the use we make of your
personal data
• Give you a copy of your personal data that we
have, including in a structured and commonly
used format.
• Correct any incorrect personal data that we
have.
• Delete any personal data that we have no
lawful basis to hold.
Where our processing is based on consent, you may
withdraw your consent at any time. You may also
object to our processing of your personal data. If you
would like to exercise your rights in relation to your
personal data, you should contact us using the details
contained within the Contact us section below. We will
not charge you for exercising your rights, though if
your request for access to your personal information is clearly unfounded or excessive we are permitted to
charge a reasonable fee or refuse to comply with the
request.
Where we require your consent to process your data
but you choose to withhold or withdraw it, we may not
be able to perform the contract we have entered into
with you. Contact Us If you have any questions in
relation to this privacy notice or otherwise how
Hamilton processes personal data, including requests
to exercise a data subject’s legal rights, please contact the Data Protection Manager using the details below.
+353 (0) 1232 1900, 2 Shelbourne Buildings,
Crampton Avenue, Ballsbridge, Dublin 4, Ireland.
Complaint Should you believe we have failed to
process your personal information appropriately, you
are invited to discuss the matter with Hamilton. Our
contact details are at the Contact us section above.
You may at any time lodge a complaint with either the
Data Protection Commission (DPC) at 21 Fitzwilliam
Square South, Dublin 2, D02 RD28, Ireland +353
(0)761 104 800 https://www.dataprotection.ie/ or the
Information Commissioner’s Office (ICO), Wycliffe
House, Water Lane, Wilmslow Cheshire, SK9 5AF,
United Kingdom 0303 123 1113 or +44 (0) 162 554
5700 www.ico.org.uk
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 199
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 60 of 76 Page 1 of 1
INVOICE MANIPULATION COVERAGE
This endorsement modifies insurance provided under the following:
Hamilton Technology, Cyber and Media Policy Wording
In consideration of the premium charged for the Policy, it is hereby understood and agreed that:
1. The aggregate sublimit applicable to all loss under this endorsement is USD $100,000.
2. The Retention applicable to each incident, event, or related incidents or events, giving rise to an obligation to pay loss under this endorsement shall be USD $2,500.
3. INSURING AGREEMENTS is amended to include:
Invoice Manipulation
To indemnify the Insured Organization for Direct Net Loss resulting directly from the Insured Organization’s inability to collect Payment for any goods, products or services after such goods, products or services have been transferred to a third party, as a result of Invoice Manipulation that the Insured first discovers during the Policy Period:
4. DEFINITIONS is amended to include:
Direct Ne t Loss means the direct net cost to the Insured Organization to provide goods, products or services to a third party. Direct Net Loss will not include any profit to the Insured Organization as a result of providing such goods, products or services.
Invoice Manipulation means the release or distribution of any fraudulent invoice or fraudulent payment instruction to a third party as a direct result of a Security Breach or a Data Breach.
Payment means currency, coins or bank notes in current use and having a face value.
All other terms and conditions of this Policy remain unchanged.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 200
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 61 of 76 Page 1 of 3
REPUTATION LOSS
This endorsement modifies insurance provided under the following:
Hamilton Technology, Cyber and Media Policy Wording
In consideration of the premium charged for the Policy, it is hereby understood and agreed that:
1. Limit listed in the Declarations under COVERAGE SCHEDULE is amended to include:
Reputation Loss: USD $1,000,000
2. Retention listed in the Declarations under COVERAGE SCHEDULE is amended to include: Each incident giving rise to Reputation Loss: USD $2,500
3. INSURING AGREEMENTS is amended by the addition of:
Reputation Loss
To indemnify the Insured Organization for Reputation Loss that the Insured Organization sustains solely as a result of an Adverse Media Event that occurs during the Policy Period, concerning:
1. a Data Breach, Security Breach, or Extortion Threat that the Insured first discovers during the Policy Period; or
2. if this policy is a Renewal, a Data Breach, Security Breach, or Extortion Threat that the Insured first discovers during the last 90 days of the prior policy period.
4. DEFINITIONS is amended to include:
Adverse Media Event means:
1. publication by a third party via any medium, including but not limited to television, print, radio, electronic, or digital form of previously non -public information specifically concerning a Data Breach, Security Breach , or Extortion Threat; or
2. notification of individuals pursuant to part 4. of the Breach Response Costs definition.
Multiple Adverse Media Events arising from the same or a series of related, repeated or continuing Data Breaches, Security Breaches, or Extortion Threats , shall be considered a single Adverse Media Event, and shall be deemed to occur at the time of the first such Adverse Media Event.
Claims Preparation Costs means reasonable and necessary costs that the Named Insured incurs to contract with a third party to prepare a proof of loss demonstrating Reputational Loss.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 201
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 62 of 76 Page 2 of 3 Protection Period means the period beginning on the date the Adverse Media Event occurs, and ends after the earlier of:
1. 180 days; or
2. the date that gross revenues are restored to the level they would have been but for the Adverse Media Event.
Renewal means an insurance policy issued by the Underwriters to the Named Insured for the policy period immediately preceding this Policy Period that provides coverage for a Data Breach, Security Breach, or Extortion Threat otherwise covered under this Policy.
Reputation Loss means:
1. the net profit or loss before interest and tax that the Insured Organization would have earned during the Protection Period but for an Adverse Media Event; and
2. continuing normal operating expenses incurred by the Insured Organization (including payroll), but only to the extent that such operating expenses must necessarily continue during the Protection Period.
When calculating any Reputation Loss, due consideration will be given to any amounts made up during, or within a reasonable time after the end of, the Protection Period.
Reputation Loss will not mean and no coverage will be available under this endorsement for any of the following:
(i) loss arising out of any liability to any third party;
(ii) legal costs or legal expenses of any type;
(iii) loss incurred as a result of unfavorable business conditions;
(iv) loss of market or any other consequential loss;
(v) Breach Response Costs; or
(vi) Cyber Extortion Loss;
There will be no coverage available under this endorsement if there is an actual interruption of the Insured Organization’s business operations for any period of time.
5. Limits of Liability under LIMIT OF LIABILITY AND COVERAGE is amended to include:
Reputational Loss and Claims Preparation Costs covered under this Policy arising from an Adverse Media Event concerning any Data Breach, Security Breach, or Extortion Threat (including a series of related, repeated or continuing Data Breaches, Security Breaches, or Extortion Threats) first discovered during the last 90 days of the prior policy period, will be considered to have been noticed to the Underwriters during the prior policy period and will be subject to the Policy Aggregate Limit of Liability of the prior policy period. Under such circumstances, if the Policy Aggregate Limit of Liability of the prior policy period is exhausted due to payments made under the prior policy, the Underwriter’s obligation to pay Reputational Loss or Claims Preparation Costs under this Policy shall be completely fulfilled and extinguished.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 202
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 63 of 76 Page 3 of 3
6. Notice of Claim or Loss under GENERAL CONDITIONS is amended to include:
With respect to Reputation Loss, the Named Insured must notify the Underwriters through the contacts listed for Notice of Claim, Loss or Circumstance in the Declarations as soon as practicable after discovery of the circumstance, incident or event giving rise to such loss.
All Reputation Loss must be reported, and all proofs of loss must be provided, to the Underwriters no later than four (4) months after the end of the Protection Period.
7. This Policy will cover up to USD 50,000 of Claims Preparation Costs in excess of the Retention stated in Section 2. of this endorsement.
All other terms and conditions of this Policy remain unchanged.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 203
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 64 of 76 Page 1 of 1
STATE CONSUMER PRIVACY STATUTES ENDORSEMENT
This endorsement modifies insurance provided under the following:
Hamilton Technology, Cyber and Media Policy Wording
In consideration of the premium charged for the Policy, it is hereby understood and agreed that:
1. The Policy is amended to include the following insuring agreement:
State Consumer Privacy Statutes
To pay Penalties and Claims Expenses which the Insured is legally obligated to pay because of any Regulatory Proceeding first made against any Insured during the Policy Period for a violation of the California Consumer Privacy Act or any similar state statutes or state regulations specifically governing the Insured Organization’s collection, use, disclosure, sale, processing, profiling, acquisition, sharing, maintenance, retention or storage of or provision of access to personal information or personal data as defined under the California Consumer Privacy Act o r similar state statutes or state regulations.
2. The definition of Claim is amended to include institution of a Regulatory Proceeding against any Insured under the State Consumer Privacy Statutes insuring agreement for a violation of the California Consumer Privacy Act or any similar state statutes or state regulations specifically governing the Insured Organization’s collection, use, disclosure, sale, processing, profiling, acquisition, sharing, maintenance, retention or storage of or provision of access to personal information or personal data as defined under the California Consumer Privacy Act or similar state statutes or state regulations.
3. The Governmental Actions exclusion will not apply to the State Consumer Privacy Statutes insuring agreement.
4. Solely with respect to the State Consumer Privacy Statutes insuring agreement, the Deceptive Business Practices, Antitrust & Consumer Protection exclusion is deleted in its entirety and replaced with the following:
Deceptive Business Practices and Consumer Protection
any actual or alleged false, deceptive or unfair trade practices, unfair competition, or violation of consumer protection law; but this exclusion will not apply to coverage under the State Consumer Privacy Statutes insuring agreement, provided no member of the Control Group participated in or colluded in the activities or incidents giving rise to coverage under such insuring agreement;
Antitrust
any actual or alleged antitrust violation, restraint of trade, false, deceptive or misleading advertising, violation of the Sherman Antitrust Act, the Clayton Act, or the Robinson-Patman Act, or inaccurate cost estimates or failure of goods or services to conform with any represented quality or performance;
All other terms and conditions of this Policy remain unchanged.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 204
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 65 of 76 Page 1 of 1
VOLUNTARY SHUTDOWN COVERAGE
This endorsement modifies insurance provided under the following:
Hamilton Technology, Cyber and Media Policy Wording
In consideration of the premium charged for the Policy, it is hereby understood and agreed that the definition of Security Breach is deleted in its entirety and replaced with the following:
Security Breach means:
1. A failure of computer security to prevent:
(i) Unauthorized Access or Use of Computer Systems, including Unauthorized Access or Use resulting from the theft of a password from a Computer System or from any Insured;
(ii) a denial of service attack affecting Computer Systems;
(iii) with respect to coverage under parts 3. and 4. of the Media, Tech, Data & Network Liability insuring agreement, the Regulatory Defense & Penalties insuring agreement, and the Payment Card Liabilities & Costs insuring agreement, a denial of service attack affecting computer systems that are not owned, operated or controlled by an Insured; or
(iv) infection of Computer Systems by malicious code or transmission of malicious code from Computer Systems; or
2. Solely with respect to the Business Interruption insuring agreement:
(i) the voluntary and intentional shutdown of Computer Systems by the Insured Organization, but only to the extent necessary to limit the Loss during an active or on - going Unauthorized Access or Use of Computer Systems or infection of Computer Systems by malicious code, as covered by 1.(i) or 1.(iv) above; or
(ii) the intentional shutdown of Computer Systems by the Insured Organization as expressly required by any federal, state, local or foreign governmental entity in such entity’s regulatory or official capacity resulting from a situation described in 1.(i) or 1.(iv) above.
All other terms and conditions of this Policy remain unchanged.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 205
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 66 of 76
EXCLUSIONS SECTION
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 206
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 67 of 76
SANCTION LIMITATION AND EXCLUSION CLAUSE
No (re)insurer shall be deemed to provide cover and no (re)insurer shall be liable to pay any claim or provide any benefit hereunder to the extent that the provision of such cover, payment of such claim or provision of such benefit would expose that (re)insurer to any sanction, prohibition or restriction under United Nations resolutions or the trade or economic sanctions, laws or regulations of the European Union, United Kingdom or United States of America.
LMA3100
15 September 2010
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 207
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services LMA5567A (amended 2023)
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 68 of 76
War and Cyber Operations Exclusion No.4
(For use on commercial cyber insurance contracts)
If there is a conflict between any provision in this policy and this Endorsement, the terms of this Endorsement will prevail.
1. Notwithstanding any provision to the contrary in this insurance, this insurance does not cover that part of any loss, damage, cost, or expense, of any kind:
1.1 directly or indirectly arising from war, and/or
1.2 arising from a cyber operation that is carried out as part of a war, or the immediate preparation for a war, and/or
1.3 arising from a cyber operation that causes a state to become an impacted state.
Paragraph 1.3 shall also apply to exclude the direct or indirect effect of a cyber operation on a computer system used by an insured or its third party service provider that is not physically located in the impacted state.
Attribution of a cyber operation to a state
2. Notwithstanding the insurer’s burden of proof, which shall remain unchanged by this clause, in determining attribution of a cyber operation to a state, the insured and insurer will consider such objectively reasonable evidence that is available to them. This may include formal or official attribution by the government of the state in which the computer system affected by the cyber operation is physically located to another state or those acting at such other state’s direction or under its control.
3. The parties shall attempt in good faith to resolve any dispute arising out of or relating to the determination of attribution to this exclusion promptly by negotiation. Should the parties be not able to resolve the issue of attribution within thirty (30) days of the issue being raised in writing, either party may submit the dispute for a binding decision from a competent and disinterested umpire with the relevant knowledge and experience in international law matters to determine the attribution of a state backed cyber-attack to one or more states.
All applicable statutes of limitations and defences based upon the passage of time shall be tolled, or a standstill agreement shall be agreed by the parties, until the attribution issue is determined. The parties will take such action, if any, required to effectuate such tolling or standstill agreement.
The parties agree that no suit will be filed by either party against the other party seeking resolution of any dispute arising out of or relating to this exclusion no sooner than thirty (30) days after the conclusion of a binding decision from a competent and disinterested umpire, or the parties have otherwise resolved the attribution issue if sooner.
Definitions
4. Computer system means any computer, hardware, software, communications system, electronic device, server, cloud infrastructure or microcontrol ler including any similar system or any configuration of the aforementioned and including any associated input, output, data storage device, networking equipment or back up facility. If there is any inconsistency between definitions of computer system in this exclusion and the contract of insurance, the definition in the contract of insurance shall apply.
5. Cyber operation means the use of a computer system by, at the direction of, or under control of a state to:
5.1. disrupt, deny access to, or degrade functionality of a computer system, and/or
5.2 copy, remove, manipulate deny access to or destroy information in a computer system.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 208
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services LMA5567A (amended 2023)
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 69 of 76
6. Essential service means a service that is essential for the maintenance of vital functions of a state including, but not limited to, financial institutions and associated financial market infrastructure, health service or utility services.
7. Impacted state means any state where a cyber operation has a major detrimental impact on:
7.1 the functioning of that state due to disruption to the availability, integrity or delivery of an essential service in that state, and/or
7.2 the security or defence of that state.
8. State means sovereign state and any non-member observer state as classified by the United Nations.
9. War means armed conflict involving physical force:
9.1 by a state against another state, or
9.2 as part of a civil war, rebellion, revolution, insurrection, military action or usurpation of power, whether war be declared or not.
LMA5567A (amended)
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 209
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
NMA 1256 Nuclear Incident Exclusion Clause Liability Page 1 of 2 Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 70
of 76
NUCLEAR INCIDENT EXCLUSION CLAUSE-LIABILITY-DIRECT (BROAD) (U.S.A.) For attachment to insurances of the following classifications in the U.S.A., its Territories and Possessions, Puerto Rico and the Canal Zone:
Owners, Landlords and Tenants Liability, Contr actual Liability, Elevator Liability, Owners or Contractors (including railroad) Protective Liability, Manufacturers and Contractors Liability, Product Liability, Professional and Malpractice Liability, Storekeepers Liability, Garage Liability, Automobile Liability (including Massachusetts Motor Vehicle or Garage Liability),
not being insurances of the classifications to which the Nuclear Incident Exclusion Clause -Liability-Direct (Limited) applies.
This Policy* does not apply:
I. Under any Liability Coverage, to injury, sickness, disease, death or destruction:
(a) with respect to which an insured under the Policy is also an insured under a nuclear energy liability policy issued by Nuclear Energy Liability Insurance Association, Mutual Atomic Energy Liabilit y Underwriters or Nuclear Insurance Association of Canada, or would be an insured under any such policy but for its termination upon exhaustion of its limit of liability; or (b) resulting from the hazardous properties of nuclear material and with respect to which (1) any person or organization is required to maintain financial protection pursuant to the Atomic Energy Act of 1954, or any law amendatory thereof, or (2) the insured is, or had this Policy not been issued would be, entitled to indemnity from the United States of America, or any agency thereof, under any agreement entered into by the United States of America, or any agency thereof, with any person or organization.
II. Under any Medical Payments Coverage, or under any Supplementary Payments Provisi on relating to immediate medical or surgical relief, to expenses incurred with respect to bodily injury, sickness, disease or death resulting from the hazardous properties of nuclear material and arising out of the operation of a nuclear facility by any person or organization.
III. Under any Liability Coverage, to injury, sickness, disease, death or destruction resulting from the hazardous properties of nuclear material, if:
(a) the nuclear material (1) is at any nuclear facility owned by, or operated by or on behalf of, an insured or (2) has been discharged or dispersed therefrom;
(b) the nuclear material is contained in spent fuel or waste at any time possessed, handled, used, processed, stored, transported or disposed of by or on behalf of an insured; or (c) the injury, sickness, disease, death or destruction arises out of the furnishing by an insured of services, materials, parts or equipment in connection with the planning, construction, maintenance, operation or use of any nuclear facility, but if such facility is located within the United States of America, its territories or possessions or Canada, this exclusion (c) applies only to injury to or destruction of property at such nuclear facility.
IV. As used in this endorsement:
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 210
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
NMA 1256 Nuclear Incident Exclusion Clause Liability Page 2 of 2 Tue Jun 06 2023 @ 8:09:42 | 277157 |
"hazardous properties" include radioactive, toxic or explosive properties; "nuclear material" means source material, special nuclear material or by -product material; "source material", "special nuclear material", and "by-product material" have the meanings given them in the Atomic Energy Act 1954 or in any law amendatory thereof; "spent fuel" means any fuel element or fuel component, solid or liquid, which has been used or exposed to radiation in a nuclear reactor; "waste" means any waste material (1) containing by-product material and (2) resulting from the operation by any person or organization of any nuclear facility included within the definition of nuclear facility under paragraph (a) or (b) thereof; " nuclear facility" means:
(a) any nuclear reactor,
(b) any equipment or device designed or used for (1) separating the isotopes of uranium or plutonium, (2) processing or utilizing spent fuel, or (3) handling, processing or packaging waste,
(c) any equipment or device used for the processing, fabricating or alloying of special nuclear material if at any time the total amount of such material in the custody of the insured at the premises where such equipment or device is located consists of or contains more than 25 grams of plutonium or uranium 233 or any combination thereof, or more than 250 grams of uranium 235,
(d) any structure, basin, excavation, premises or place prepared or used for the storage or disposal of waste,
and includes the site on which any of the foregoing is located, all operations conducted on such site and all premises used for such operations; "nuclear reactor" means any apparatus designed or used to sustain nuclear fission in a self-supporting chain reaction or to contain a critical mass of fissionable material. With respect to injury to or destruction of property, the word "injury" or "destruction" includes all forms of radioactive contamination of property.
It is understood and agreed that, except as specifically provided in the foregoing to the contrary, this clause is subject to the terms, exclusions, conditions and limitations of the Policy to which it is attached. * NOTE: As respects policies which afford liability coverages and other forms of coverage in addition, the words underlined should be amended to designate the liability coverage to which this clause is to apply.
17/3/60
NMA1256
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 211
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 72 of 76
RADIOACTIVE CONTAMINATION EXCLUSION CLAUSE-LIABILITY-DIRECT (U.S.A.) For attachment (in addition to the appropriate Nuclear Incident Exclusion Clause-Liability-Direct) to liability insurances affording worldwide coverage.
In relation to liability arising outside the U.S.A., its Territories or Possessions, Puerto Rico or the Canal Zone, this Policy does not cover any liability of whatsoever nature directly or indirectly caused by or contributed to by or arising from ionising radiations or contamination by radioactivity from any nuclear fuel or from any nuclear waste from the combustion of nuclear fuel.
NMA 1477
13/02/1964
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 212
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 73 of 76 Page 1 of 1
ASBESTOS, POLLUTION, AND CONTAMINATION EXCLUSION ENDORSEMENT
This endorsement modifies insurance provided under the following:
Hamilton Technology, Cyber and Media Policy Wording
In consideration of the premium charged for the Policy, it is hereby understood and agreed that the coverage under this Policy will not apply to any Loss arising out of either in whole or in part, directly or indirectly arising out of or resulting from or in consequence of, or in any way involving:
1. asbestos, or any materials containing asbestos in whatever form or quantity;
2. the actual, potential, alleged or threatened formation, growth, presence, release or dispersal of any fungi, molds, spores or mycotox ins of any kind; any action taken by any party in response to the actual, potential, alleged or threatened formation, growth, presence, release or dispersal of fungi, molds, spores or mycotoxins of any kind, such action to include investigating, testing for, detection of, monitoring of, treating, remediating or removing such fungi, molds, spores or mycotoxins; and any governmental or regulatory order, requirement, directive, mandate or decree that any party take action in response to the actual, potential, alleged or threatened formation, growth, presence, release or dispersal of fungi, molds, spores or mycotoxins of any kind, such action to include investigating, testing for, detection of, monitoring of, treating, remediating or removing such fungi, molds, spores or mycotoxins;
The Underwriters will have no duty or obligation to defend any Insured with respect to any Claim or governmental or regulatory order, requirement, directive, mandate or decree which either in whole or in part, directly or indirectly, arises out of or results from or in consequence of, or in any way involves the actual, potential, alleged or threatened formation, growth, presence, release or dispersal of any fungi, molds, spores or mycotoxins of any kind;
3. the existence, emission or discharge of any electromagnetic field, electromagnetic radiation or electromagnetism that actually or allegedly affects the health, safety or condition of any person or the environment, or that affects the value, marketability, condition or use of any prope rty; or
4. the actual, alleged or threatened discharge, dispersal, release or escape of Pollutants; or any governmental, judicial or regulatory directive or request that the Insured or anyone acting under the direction or control of the Insured test for, monitor, clean up, remove, contain, treat, detoxify or neutralize Pollutants. Pollutants means any solid, liquid, gaseous or thermal irritant or contaminant including gas, acids, alkalis, chemicals, heat, smoke, vapor, soot, fumes or waste.
Waste includes but is not limited to materials to be recycled, reconditioned or reclaimed.
All other terms and conditions of this Policy remain unchanged.
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 213
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 74 of 76
SEVERAL LIABILITY NOTICE
The subscribing insurers' obligations under contracts of insurance to which they subscribe are several and not joint and are limited solely to the extent of their individual subscriptions. The subscribing insurers are not responsible for the subscription of any co-subscribing insurer who for any reason does not satisfy all or part of its obligations. 08/94
LSW1001 (Insurance)
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 214
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 75 of 76
Attaching to and forming part of Certificate Number: B1180D231573/009 (100%)
SCHEDULE OF LLOYD’S UNDERWRITERS
Authority Ref. B1180D231573 : Hereon 100%
75.00000% 4000 HAM
25.00000% 2121 ARG
100.0000%
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 215
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 76 of 76
One Lime Street London EC3M 7HA
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 216
REQUISITION
04/29/2024
ISSUED TO:
Date:
Vendor #: 004447
1960 CHICAGO AVE SUITE E9
RIVERSIDE, CA 92507-
ACORN TECHNOLOGY SERVICES SHIP TO:
130 CREMONA DRIVE, SUITE B
GOLETA, CA 93117
CITY OF GOLETA
Requisition #: 24GS108
UNITS DESCRIPTION PRICE AMOUNTGL ACCOUNT NUMBERITEM PROJECT # 1 0
c27bbc63-b19c-4a70-8abd-b16101255ae0
PROJECT - 2024-TBD IT Managed Services Agreement
c27bbc63-b19c-4a70-8abd-b16101255ae0
0.00 c27bbc63-b19c-4a70-8abd-b16101255ae0
101-18-1820-51200 26,500.00
26,500.00TOTAL
SHIPPING:
TOTAL TAX:
SUBTOTAL:
0.00 0.00
26,500.00
Authorized By:
To provide Managed Information Technology Services, generally including IT support, maintenance of desktops, servers, network, security, purchasing, & procurement as more particularly defined in the contract documents awarded to Acorn Technology by City Council on April 16, 2024, pursuant to City Bid No. 2023-013, Agrmt. No. 2024-TBD, Term Ending June 30, 2027, with (2) optional 1-year extensions. Services not-to-exceed $1,065,906 with a base of $1,035,906, plus $30k for Extra Services, and reimbursement for pass-through costs for equipment & software/licenses procured by vendor, and earned as the work progresses at the rates stated in Exhibit B of the contract. This purchase order is issued in the amount of $26,500 for May 2024 services provided under this agreement. Additional encumbrance will be added for subsequent months billing by way of change order requests through June 30, 2024. A new PO will be issued in FY 24-25, FY 25-26, and again in FY 26-27 for those annual services.
Detailed Description:
PO Description: PROJECT - 2024-TBD Managed IT Services Agreement DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 217
ATTACHMENT 3
PowerPoint Presentation
218
“First 100 Days” Report on
City Information Technology
Landscape and Execution of
Amendment No. 1 to
Agreement No. 2024-041
City Council
November 19, 2024
Matt Fore, General Services Director
219
Items to be Covered
Finding and Recommendations Regarding City of Goleta IT Environment – Acorn Technology Services, Inc.
• First 100 Days Accomplishments
• IT Governance, Policies & Procedures
• Risks and Vulnerability Assessment
• Organizational Efficiencies
• Recommendations for Near-Term Investments in Information Technology • Purchase of Replacement Laptops and Desktop Devices
November 19, 2024 City Council Meeting 2
220
First 100 Days Accomplishments
Creation of Policies
Inventory management
Documentation
Licensing audit
Vulnerability/Risk audit
Service delivery and infrastructure
dashboards
Hardware Standardization
24x7x365 Monitoring and
management
Replacement of old Synergy-
owned equipment
Patch Management Policy
Monitoring & Management policy
Incident Management Policy
Backup and disaster recovery
Policy
Improved uptime of Corp Yard and
Community Center camera systems
November 19, 2024 City Council Meeting 3
221
First 100 Days Accomplishments
Acorn Support Metrics
November 19, 2024 City Council Meeting 4
222
IT Governance, Policies & Procedures
• Lack of process, procedures, structure, and governance (as stated in the RFP)
oGovernance is critical to protecting the City from Cybersecurity risks (litiga
tion, reputation, and revenue loss risks)
oStructure and discipline are required to ensure security protocols and compliance with governanc
e policies
• Critical Policies Created:
oPatch Management Policy
oMonitoring and Management Policy
oBackup and Disaster Recovery Policy
oIncident Management Policy
November 19, 2024 City Council Meeting 5
223
Risk and Vulnerability Assessment
•Acorn performed a Risk Assessment pursuant to the National Institute of St
andards and Technology (NIST) Cybersecurity
Framework:
•Network Vulnerabilities
•Intrusion Risk
•Network Redundancy – eliminate single points of failure •Data Backup and Business Continuity
•Payment Card Industry Compliance
November 19, 2024 City Council Meeting 6
224
Organizational Efficiencies
•Acorn also identified organizational efficiencies that would benefit the City of Goleta
• Underutilized bandwidth (66% underutilization) and poor wireless connectivity at City Hall
•Need for phone system that supports remote work
•Need for cohesive file storage system (Egnyte, Teams, etc.) as sta
ted in the RFP
November 19, 2024 City Council Meeting 7
225
Near-Term Investments
Discovery Risk Priority Cost Type
Remedy Network Vulnerabilities Cybersecurity Critical $41,925 One time Intrusion Detection & Prevention Cybersecurity Critical $66,240 Annually City Hall Network and Wireless Upgrades Cybersecurity Critical $37,500 One time Goleta Community Center Wireless Network
Upgrades
Productivity High $11,583 One Time
Windows 10 Upgrade (to Windows 11) Cybersecurity High $25,110 One-Time Redundant Network Circuit Business Continuity Critical $15,000 Annually Backup Library Devices Business Continuity Critical $4,200 Annually Telephone Service for Remote Work Productivity High TBD TBD Change Domain Extension from .Org to .Gov Legal Compliance Medium $10,000 One Time Total $211,558
November 19, 2024 City Council Meeting 8
226
Near-T erm Investments
Discovery Risk Priority Cost Type
Remedy Network Vulnerabilities Cybersecurity Critical $41,925 One Time Intrusion Det
ection & Prevention Cybersecurity Critical $66,240 Annually City Hall Network and Wireless Upgrades Cybersecurity Critical $37,500 One Time Goleta
Community Center Wireless Network
Upgrades
Productivity High $11,583 One Time
Windows 10
Upgrade Cybersecurity High $25,110 One Time
Redundant Network Circuit Business Continuity Critical $15,000 Annually Backup Library Devices Business Continuity Critical $4,200 Annually Telephone Service for Remote Work Productivity High TBD TBD Change Domain Extension from .Org to .Gov Legal Compliance Medium $10,000 One Time Total $101,008
November 19, 2024 City Council Meeting 9
227
Financial Impacts
Recommended Expenditure Cost
One-Time Investments (Immediate) $101,008
Laptop & Desktop Replacements (Staff, Public Kiosks, and EOC) $85,000 Subtotal $186,008
Available Operating Budget $35,000
Transfer from Reserves ($151,008)
November 19, 2024 City Council Meeting 10
228
Recommendation
A. Receive a report of initial findings and recommendations related to the Information Technology posture of the City of Goleta; and B. Authorize the City Manager to execute Amendment No. 1 to Agreement No. 2024-041 with CU Technology, dba Acorn Technology Services, to align compensation and payment with nature of work to be performed through the contract term and to increase the contract by $70,000 for a new, not to exceed contract amount of $1,135,906; and
C. Authorize the transfer of $151,008 from the IT Strategic Plan Implementation Reserve to Program 1820 as discussed in the Fiscal Impacts Section; and
D. Authorize the City Manager to execute purchase order(s) for the purchase of six (6) replacement desktop devices and 35 replacement laptop devices, in an amount not to exceed $85,000.
November 19, 2024 City Council Meeting 11
229
Questions
12 230