Initial Findings and Recommendations on City Information Technology Landscape and Execution of Amendment No. 1 to Agreement No. 2024-041 — Goleta City Council, November 19, 2024 (part 1 of 2)

Agenda Item D.2

CPMS DISCUSSION/ACTION ITEM
Meeting Date: November 19, 2024
TO: Mayor and Councilmembers
SUBMITTED BY: Matthew R. Fore, General Services Director SUBJECT: Initial Findings and Recommendations on City Information Technology Landscape and Execution of Amendment No. 1 to Agreement No. 2024 -041 with CU Technolog y, dba Acorn
Technology Services
RECOMMENDATION:

A. Receive a report of initial findings and recommendations related to the Information Technology environment of the City of Goleta; and
B. Authorize the City Manager to execute Amendment No. 1 to Agreement No. 2024- 041 with CU Technology, dba Acorn Technology Services , to align compensation and payment with nature of work to be performed through the contract term and to increase the contract by $70,000 for a new, not to exceed contract amount of $1,135,906; and
C. Authorize the transfer of $151,008 from the IT Strategic Plan Implementation Reserve to Program 1820 as discussed in the Fiscal Impacts Section; and D. Authorize the City Manager to execute purchase order(s) for the purchase of six (6) replacement desktop devices and 35 replacement laptop devices, in an amount not to exceed $85,000.

BACKGROUND:

On April 16, 2024, City Council authorized the City Manager to execute Agreement No. 2024-041 with CU Technology, dba Acorn Technology Services (Acorn). Following an approximate two-month transition period from Synergy Computing, Inc., the City’s former managed services provider (MSP), Acorn assumed full responsibility for all information - technology related services on July 1, 2024.

DISCUSSION:

Since July 1, 2024, Acorn has evaluated all facets of the City’s information technology environment including cybersecurity and business continuity vulnerabilities, asset and process documentation, allocation of software licenses, governance and policy framework, and organizational efficiencies.
1 Meeting Date: November 19, 2024

Page 2 of 4 ends

Near Term Recommendations:

 Cybersecurity: Acorn and City Staff recommend bolstering the City’s cybersecurity posture through investments in both hardware and software. Replacement of remaining legacy hardware at City Hall will harden the network against intrusion while also improving the efficient flow of data through the network. Enabling two- factor authentication and the addition of c ybersecurity software and training will improve detection and prevention of unwanted intrusions.

 Business Continuity: Acorn and City Staff are exploring options to provide network circuit redundancy, primarily at City Hall. This fail -safe measure would ensure continued network connectivity in case of intermittent or prolonged outage of the Cox internet connection.

 Productivity: Acorn and City Staff are exploring options to provide City phone service to telecommuting employees. In lieu of desk phone hardware, which can only be used when an employee is physically located in the workplace, various “soft phone” applications allow outgoing and incoming phone calls through one’s laptop or desktop device. Staff and Acorn are also evaluating the means and methods of the City’s file storage system and are developing recommendations to improve organization and efficient retrieval of files.

 Legal Compliance: Assembly Bill 1637 requires all California cities and counties to transition their public internet websites and employee email addresses to utilize a “.gov” or “.ca.gov” domain by January 1, 2029. The City’s email address and many of its websites currently use .org, which must be transitioned to a compliant “.gov” or “.ca.gov” domain.

In the near term, Acorn recommends that the City invest approximately $211,000 in one- time and ongoing costs related to both hardware and software. Staff recommends spending $101,008 immediately on one-time remedies to cure network vulnerabilities, to improve network connectivity throughout City Hall and the Goleta Community Center, and to transition to a “ .gov” domain. Additional nea r-term investments in cybersecurity, network redundancy, and improved phone service totaling approximately $110,000 annually, will be proposed in future General Services Dep artment budgets for Council consideration.

Amendment No. 1 to Agreement No. 2024-041

The Agreement for managed information technology services provides monthly compensation of $26,500 to Acorn. Additional “project work,” which is considered out-of- scope and therefore beyond the monthly compensation, is billed separately based upon the rate schedule listed in the Agreement.

During discovery, and in the first few months of the Agreement, both Acorn and the City found that the amount of resources needed to manage City -owned assets (laptops, 2 Meeting Date: November 19, 2024

Page 3 of 4 ends

desktops, mobile devices, and networking equipment) is substantially less than initially forecast during the RFP process, while the amount of out-of-scope “project work,” which has already been performed and is forecast over the next three years of the Agreement term is substantially more than originally anticipated. For example, in the past three months, Acorn has committed substantial time and effort to the following projects:

1. Replacement of approximately 75% of the entire City network.

2. Relocation of the Buellton Library; and,

3. Establishment of a t emporary location for Goleta Library services during construction of the Library ADA, Safety, and Building Improvements Project.

Similar out -of-scope project work will continue in earnest for the next three years as General Services continues to close the gap on a myriad of initiatives to bring the City to the desired IT baseline.

To rebalance the basis for Acorn’s compensation, Staff recommends that Council approve the proposed amendment to the Agreement. The amendment is cost neutral.

Acorn’s compensation will remain unchanged at $26,500 per month. However, the difference between Acorn’s proposed cost to manage and maintain City-owned assets and the actual cost to maintain City -owned assets, valued at $5,776 per month, will be converted to 33 hours of As -Needed Additional Consulting Services per month. In other words, the first 33 hours of out-of-scope work will not be charged to the City, resulting in practical savings to the City.

FISCAL IMPACTS:

As stated above, Amendment No. 1 to the Agreement with Acorn is cost neutral and therefore results in a positive financial impact to the City by providing the City with 33 hours of As- Needed Consulting Services at no incremental charge.

In the near term, Staff recommends that the City invest approximately $ 211,000 in one- time and ongoing costs related to both hardware and software to bolster cybersecurity and to improve business cont inuity and organizational productivity. Staff recommends spending $101,008 immediately on one -time remedies. For this reason, Staff recommends that Council approve a transfer of $1 51,008 from the IT Strategic Plan Implementation Fund to the IT Operating Bu dget to: 1) implement one -time improvements; and 2) purchase six (6) replacement desktop devices and 35 replacement laptop devices as shown in the Financial Impacts table below:

3 Meeting Date: November 19, 2024

Page 4 of 4 ends

Financial Impacts
Remedy Network Vulnerabilities $41,925
City Hall Network and Wireless Upgrades $37,500
Goleta Community Center Wireless Network Upgrades $11,583 Change Domain Extension to .gov $10,000
Subtotal One-Time Costs $101,008
Laptop and Desktop Replacements (Staff, Public Kiosks, EOC Devices)
$85,000
Total Recommended Expenditures $186,008
Available Operating Budget ($35,000)
Transfer from IT Strategic Plan Implementation Reserve $151,008 Transfer from IT Strategic Plan Implementation Reserve
Professional Services 101-18-1820-51200 $57,075
Computer Hardware & Peripherals 101-18-1820-57020 $93,933 $151,008

LEGAL REVIEW BY: Megan Garibaldi, City Attorney

APPROVED BY: Robert Nisbet, City Manager

ATTACHMENT:

1. Amendment No. 1 to Agreement No. 2024-041

2. Agreement No. 2024-041

3. PowerPoint Presentation

4 ATTACHMENT 1

Amendment No. 1 to Agreement No. 2024-041

5 City of Goleta
Amendment No. 1 to Agreement No. 2024-041

Page 1 of 7 ends

AMENDMENT NO. 1

TO A PROFESSIONAL SERVICES AGREEMENT

BETWEEN THE CITY OF GOLETA

AND CU TECHNOLOGY, DBA ACORN TECHNOLOGY SERVICES

This Amendment No. 1 to the Professional Services Agreement by and between the City of Goleta , a municipal corporation (“City”) and CU TECHNOLOGY, DBA ACORN TECHNOLOGY SERVICES (“Consultant”) dated April 16, 2024 (“Agreement,” Agreement No. 2024-041) is made on this ____ day of ___, 20___.

SECTION A. RECITALS

1. This Agreement is for the provision of Managed Information Technology services; and

2. The Agreement currently provides in Section 3 Subsection (a) for the total compensation amount not to exceed $1,065,906; and

3. The parties desire to amend the Agreement so as to provide for additional compensation in the amount of $70,000 for Extra Services; and

4. The Agreement currently provides in Exhibit B entitled “Schedule of Fees” the Standard Rates for device management and hourly rates for as-needed additional consulting services; and

5. The parties desire to amend Exhibit B of the Agreement to revise device quantities and to identify an additional bank of hours that the City may use each month for project-related work that exceeds the Standard Scope of Work, attached as “Exhibit B-1”; and

6. The City Council approved this Amendment No. 1, on this _____ day of ____, 2024.

SECTION B. AMENDED TERMS

Now therefore City and Consultant agree that the Agreement be, and hereby is, amended as follows:

Docusign Envelope ID: 349EFA50-6164-428C-B512-A7D0CA3B162B 6 City of Goleta
Amendment No. 1 to Agreement No. 2024-041

Page 2 of 7 ends

1. Subsection (a) of Section 3. COMPENSATION AND PAYMENT of the Agreement is amended to add an additional authorized amount of $70,000 and to read in its entirety:
(a) Maximum and Rate . The total compensation payable to CONSULTANT by CITY for the services under this AGREEMENT SHALL NOT EXCEED the sum of $1,135,906, comprised of a base amount of $1,035,906 and compensation for Extra Services in the amount of $100,000, plus reimbursement for pass-through costs for equipment, software, and licenses procured by CONSULTANT (herein "not -to-exceed amount") and shall be earned as the work progresses on the following basis:

The rates and with reimbursement to CONSULTANT for those expenses set forth in CONSULTANT's Schedule of Fees marked Exhibit "B -1," attached and incorporated herein. The rates and expenses set forth in that exhibit shall be binding upon CONSULTANT until June 30, 2027, after which any change in said rates and expenses must be approved in writing by CITY's Project Manager as described in Section 5 (CITY is to be given 60 days notice of any rate increase request), provided the not to exceed amount is the total compensation due CONSULTANT for all work described under this AGREEMENT.

2. This Agreement is amended to delete and replace in its entirety:

Exhibit B “ Schedule of Fees ” with Exhibit B-1 “Schedule of Fees ” attached hereto and incorporated herein.

3. Except as otherwise specifically provided herein, all other provisions of the Agreement shall remain in full force and effect.

Docusign Envelope ID: 349EFA50-6164-428C-B512-A7D0CA3B162B 7 City of Goleta
Amendment No. 1 to Agreement No. 2024-041

Page 3 of 7 ends

In concurrence and witness whereof, this Amendment No. 1 has been executed by the parties effective on the date and year first above written.

CITY OF GOLETA CU TECHNOLOGY, DBA ACORN

TECHNOLOGY SERVICES

____________________________ ______________________________ Robert Nisbet, City Manager Craig Wolynez, Chief Executive Officer

ATTEST:

_____________________________
Deborah Lopez, City Clerk

APPROVED AS TO FORM:

ISAAC ROSEN, ACTING CITY ATTORNEY
_____________________________
Scott Shapses, Deputy City Attorney

Docusign Envelope ID: 349EFA50-6164-428C-B512-A7D0CA3B162B 8 City of Goleta
Amendment No. 1 to Agreement No. 2024-041

Page 4 of 7 ends

EXHIBIT B-1

SCHEDULE OF
FEES

Variations to the monthly price: 07/01/2024 – 06/30/2027

All City sites $26,500
per/month*

Consultant shall verify the inventory monthly. Billing based on inventory will be adjusted semi-annually (true-up).

Additional servers, MDM devices and/or workstations, added by City, beyond the quantities listed in the Standard Rates Table below will be charged at the rates below:

Network and Security Services $225.00 per unit/month
Desktop Services $50.00 per unit/month
MDM Services $20.00 per unit/month

Reimbursement for Costs: Should Consultant agree to procure equipment, software, licensing, or supplies at the request of City, City shall reimburse Consultant. Consultant shall pass through straight cost to C ity without markup.

Reimbursement for these costs shall be promptly paid by the City and shall not be considered compensation earned by the Consultant and shall not be by the compensation limitation of Paragraph 3 of this Agreement.

Annual Adjustments

Pursuant to the Consultant’s proposals, a 3% annual adjustment will be applied annually beginning July 1, 2025.

Docusign Envelope ID: 349EFA50-6164-428C-B512-A7D0CA3B162B 9 City of Goleta
Amendment No. 1 to Agreement No. 2024-041

Page 5 of 7 ends

Other Mutual Adjustments/Discounts

Consultant has presented the City with discounted pricing as per the Standard Rates table below. Consult ant shall honor the proportional discounting through the term of the Agreement.

Emergency Operations Center Support

In the event of an emergency, Consultant shall immediately respond to the City’s Emergency Operation Center or remotely, as directed by the City, to provide support to City staff. Work performed outside of business hours shall be billed at a rate of $125 per hour.

Billing by Location

Consultant and City will develop methodology to enable Consultant to segregate (bill) proportional monthl y amounts by location for the following locations:

 City Hall and Corporation Yard
 Goleta Library
 Solvang Library
 Buellton Library
 Goleta Community Center
Docusign Envelope ID: 349EFA50-6164-428C-B512-A7D0CA3B162B 10 City of Goleta
Amendment No. 1 to Agreement No. 2024-041

Page 6 of 7 ends

Standard Rates

Percentage of base and salary to be charged based on City determination.

Workstations, Mobile and Cybersecurity per device based on inventory.

Unlimited Managed Services

QTY

Price

Monthly

Discount %

Discount
Amount

Price after
Discount
Base Services
Purchasing, PM, Documentation,
Support tracking, SLA, AM, Reporting,
CM, and Asset management

$4,500

Desktop,
MDM, and
Server
Services
Workstations management, 24x7x365
Helpdesk. All services listed on page 23
and 24 under the section Desktop and
Server Services of the RFP document.

188

$50

$9,400

27.15%

$4,500

$12,075
Servers’ management, 24x7x365
monitoring and management by NOC
team. All services listed on page 25 and
26 under the sub section Microsoft
Server Administration and Security, of
the RFP document.

3 $225

$675
Mobile Devices (iPads/Tablets) 75 $20 $1,500
Full Time Onsite Employee. Salary,
Benefits, Consultant provided laptop. 1 $5,000 $5,000

Network
and
Security
Services
24x7x365 Monitoring & Management.

Firewalls and IDS, IPS. Switches, WAPs,
NAT, VLANs, Bandwidth monitoring,
Network QoS via Auvik. Patching,
updates, firmware upgrades, Network
diagrams, troubleshooting, maintenance.

Network optimization. VOIP connectivity
issues. VPN management.

20 $75

$1,500

15.05%

$735

$4,149
Cybersecurity - 24x7x365 SOC team.

Anti- virus on all servers and
workstations.

Incident management, DLP. NIST
standards implementation and
maintenance including PCI DSS.

Vulnerability and penetration scan.

Support and maintenance of Security
awareness training.

188

$18

$3,384
Subtotal – Monthly Managed Service Fees (EOC Support: During Business Hours Included) $20,724 Monthly Consulting Services Fees ($175/hr) $5,776
Monthly Total $26,500
Note: EOC Support: During Business Hours – Included. EOC After Hours Support: $125/hour

Docusign Envelope ID: 349EFA50-6164-428C-B512-A7D0CA3B162B 11 City of Goleta
Amendment No. 1 to Agreement No. 2024-041

Page 7 of 7 ends

As-Needed additional Consulting Services Hourly Rate
Schedule
As needed consulting services for work deemed out -of-scope shall be charged to City at the rates shown below in the As -Needed Additional Consulting Services Hourly Rate Table.

The rates below shall not be charged to the City for the first 33 hours of out- of-scope work performed each month. As -Needed Additional Consulting Services hours will accrue for three (3) months and will cap at 120 hours.

As-Needed Additional Consulting Services hours will be adjusted on January 1 st and July 1 st of each Calendar Year bas ed upon the updated device counts described in the Standard Rates Table above.

Consulting Resource

Billing Rate Per
Hour
Sr. Project Manager 175
Project Manager 145
Sr Field Technician 175
Field Technician 125
Sr Server Engineer 175
Server Engineer 125
Sr Network Engineer 175
Network Engineer 155
Sr Database Administrator 175
Database Administrator 155
Sr Business Analyst 175
Business Analyst 155
Sr Trainer 175
Trainer 125
Sr Organizational Change Manager 175
Organizational Change Manager 125
Sr Contractor/Technology Subject Matter Expert 150
Contractor/Technology Subject Matter Expert 125
EOC after-hours support 125
Special Event after-hours support 125

Docusign Envelope ID: 349EFA50-6164-428C-B512-A7D0CA3B162B 12 ATTACHMENT 2

Agreement No. 2024-041

13 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 1 of 47 ends

Project Name: Managed Information Technology Services

AGREEMENT FOR PROFESSIONAL SERVICES

BETWEEN THE CITY OF GOLETA
AND

CU TECHNOLOGY, DBA ACORN TECHNOLOGY SERVICES

This AGREEMENT FOR PROFESSIONAL SERVICES (herein referred to as “AGREEMENT”) is made and entered into this ________ day of ______ , 2024, by and between the CITY OF GOLETA, a municipal corporation (herein referred to as " CITY"), and CU TECHNOLOGY, DBA ACORN TECHNOLOGY SERVICES , a Limited Liability Corporation, (herein referred to as "CONSULTANT").

SECTION A. RECITALS

1. The CITY has a need for professional services for the provision of Managed Information Technology Services; and

2. The CITY does not have the personnel able and/or available to perform the services required under this AGREEMENT, and therefore, the CITY desires to contract for professional services to accomplish this work; and

3. The CITY procured these services in compliance with Goleta Municipal Code Section 3.05.260.

4. The City Council, on this 16th day of April 2024, approved this AGREEMENT and authorized the City Manager to execute the AGREEMENT.

SECTION B. TERMS

1. RETENTION AS CONSULTANT
CITY hereby retains CONSULTANT, and CONSULTANT hereby accepts such engagement, to perform the services described in Section 2. CONSULTANT warrants it has the qualifications, experience, and facilities to properly and timely perform said services.

2. DESCRIPTION OF SERVICES
The services to be performed by CONSULTANT are as follows:

Provision of comprehensive, full -service Managed Information Techn ology Services. Services shall generally include maintenance of desktops and servers, network and security, purchasing and procurement, and general Information Technology support services as more particularly set forth in the Scope of Work, attached as Exhibit “A,” and incorporated herein.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 2024-041
April16th
14 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 2 of 47 ends

CONSULTANT shall deliver to CITY the deliverables defined in Exhibit “A.”

3. COMPENSATION AND PAYMENT
(a) Maximum and Rate. The total compensation payable to CONSULTANT by CITY for the services under this AGREEMENT SHALL NOT EXCEED the sum of $1,065,906, comprised of a base amount of $1,035,906 and compensation for Extra Services in the amount of $30,000, plus reimbursement for pass -through costs for equipment, software and licenses procured by the CONSULTANT (herein "not to exceed amount"), and shall be earned as the work progresses on the following basis:

The rates and with reimbursement to CONSULTANT for those expenses set forth in CONSULTANT's Schedule of Fees marked Exhibit "B," attached and incorporated herein. The rates and expenses set forth in that exhibit shall be binding upon CONSULTANT until June 30, 202 7, after which any change in said rates and expenses must be approved in writing by CITY's Project Manager as described in Section 5 (CITY is to be given 60 days notice of any rate increase request), provided the not to exceed amount is the total compensation due CONSULTANT for all work described under this AGREEMENT.
(b) Payment. CONSULTANT shall provide CITY with written verification of the actual compensation earned, which written verification shall be in a form satisfactory to CITY's Project Manager , as described in Section 5 . Invoices shall be made no more frequently than on a monthly basis, and describe the work performed (including a list of hours worked by perso nnel classification). All payments shall be made within 30 days after CITY’s approval of the invoice.

4. EXTRA SERVICES
CITY shall pay CONSULTANT for those CITY authorized extra services, not reasonably included within the services described in Section 2, as mutually agreed to writing in advance of the incurrence of extra services by CONSULTANT. Unless CITY and CONSULTANT have agreed in writing before the performance of extra services, no liability and no right to claim compensation for such extra services or expenses shall exist. The applicable hourly rates for extra services shall be at the hourly rates set forth in Exhibit B, if one is included as part of this agreement . Any compensation for extra services shall be part of the total compensation and shall not increase the not to exceed amount identified in Section 3.

5. CITY PROJECT MANAGER AND SERVICES BY CITY
The services to be performed by CONSULTANT shall be accomplished under the general direction of, and coordinate with, CITY's "Project Manager", as tha t staff person is designated by CITY from time to time, and who presently is Matthew Fore, General Services Director, or his designee . Project Manager shall have the authority to act on behalf of the CITY in administering this AGREEMENT but shall not be authorized to extend the term of the AGREEMENT or increase the not to exceed amount.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 15 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 3 of 47 ends

6. TERM, PROGRESS AND COMPLETION
The initial term of this AGREEMENT is from the date first written above to June 30, 2027, with two (2) additional one -year extensions at the di scretion of the City, unless the term of this AGREEMENT is extended , or the AGREEMENT is terminated as provided for herein.

CONSULTANT shall not commence work on the services to be performed until (i) CONSULTANT furnishes proof of insurance as required by Section 10 below, and (ii) CITY gives written authorization to proceed with the work provided by CITY's Project Manager.

7. OWNERSHIP OF DOCUMENTS
All drawings, designs, data, photographs, reports and other documentation (other than CONSULTANT's drafts, note s and internal memorandum), including duplication of same prepared by CONSULTANT in the performance of these se rvices, are the property of CITY. CITY shall be entitled to immediate possession of the same upon completion of the work under this AGREEMENT, or at any earlier or later time when requested by CITY.

CITY agrees to hold CONSULTANT harmless from all damages, claims, expenses, and losses arising out of any reuse of the plans and specifications for purposes other than those described in this AGREEMENT, unless written authorization of CONSULTANT is first obtained.

8. PERSONAL SERVICES/NO ASSIGNMENT/SUBCONTRACTOR
This AGREEMENT is for professional services which are personal to CITY. Craig Wolynez, Chief Executive Officer, is deemed to be specially experie nced and is a key member of CONSULTANT's firm, and shall be directly involved in the performance of this work. This key person shall communicate with, and periodically report to, CITY on the progress of the work. Should any such individual be removed fro m assisting in this contracted work for any reason, CITY may terminate this AGREEMENT. This AGREEMENT may not b e assigned or subcontracted without the City M anager’s prior written consent.

9. HOLD HARMLESS AND INDEMNITY
(a) Hold Harmless for CONSULTANT's Dama ges. CONSULTANT holds CITY, its elected officials, officers, agents, and employees, harmless from all of CONSULTANT's claims, demands, lawsuits, judgments, damages, losses, injuries or liability to CONSULTANT, to CONSULTANT's employees, to CONSULTANT’s co ntractors or subcontractors, or to the owners of CONSULTANT's firm, which damages, losses, injuries or liability occur during the work required under this AGREEMENT, or occur while CONSULTANT is on CITY property, or which are connected, directly or indirec tly, with CONSULTANT's performance of any activity or work required under this AGREEMENT. (b) Defense and Indemnity of Third Party Claims/Liability. CONSULTANT shall investigate, defend, and indemnify CITY, its elected officials, officers, agents, and employees, from any claims, lawsuits, demands, judgments, and all liability including, but DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 16 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 4 of 47 ends

not limited to, monetary or property damage, lost profit, personal injury, wrongful death, general liability, automobile, infringement of copyright/patent/trademark, or pro fessional errors and omissions arising out of, directly or indirectly, an error, negligence, or omission of CONSULTANT or any of CONSULTANT’s officers, agents, employees, representatives, subconsultants, or subcontractors, or the willful misconduct of CONS ULTANT or any of CONSULTANT’s officers, agents, employees, representatives, subconsultants, or subcontractors, in performing the services described in, or normally associated with, this type of contracted work. The duty to defend shall include any suits o r actions concerning any activity, product or work required under this AGREEMENT, and also include the payment of all court costs, attorney fees, expert witness costs, investigation costs, claims adjusting costs and any other costs required for and related thereto. (c) No Waiver. CITY does not waive, nor shall be deemed to have waived, any indemnity, defense or hold h armless rights under this section because of the acceptance by CITY, or the deposit with CITY, of any insurance certificates or policies describe d in Section 10.

10. INSURANCE
CONSULTANT shall, at CONSULTANT's sole cost and expense, provide insurance as described herein. All insurance is to be placed with insurers authorized to do business in the State of California with an A.M. Best and Company rating of A- or better, Class VII or better, or as otherwise approved by CITY.

Insurance shall include the following (or broader) coverage:

a) Insurance Services Office Commercial Liability coverage “occurrence” form CG 00 01 or its exact equivalent with an edition date prior to 2004 and with minimum limits of $1,000,000 per occurrence and $2,000,000 general aggregate.

b) Insurance Services Office form number CA 00 01 or equivalent covering Automobile Liability, including hired and non -owned automobile liabilit y with a minimum limit of $1,000,000 per accident. If the Service Provider owns no vehicles, this requirement may be satisfied by a non -owned and hired auto endorsement to Service Provider’s commercial general liability policy.

c) Workers’ Compensation insu rance complying with California worker’s compensation laws, including statutory limits for workers’ compensation and an Employer’s Liability limit of $1,000,000 per accident or disease.

d) Professional liability insurance that covers the services to be perfo rmed in connection with this agreement, in the minimum amount of $1,000,000 per claim.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 17 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 5 of 47 ends

e) Cyber Security and Pri vacy Liability . Consultant shall procure and maintain insurance with limits of $1,000,000 per occurrence/loss, $2,000,000 general aggregate, which shall include the following coverage:
i. Liability arising from the theft, dissemination and/or use of confidential or personally identifiable information; including but not limited to personally identifiable information (PII), protected health information (PHI), security codes, access codes, passwords, etc.
ii. Network security liability arising from the unauthorized use of, access to, or tampering with computer systems, including hacker or denial of service attacks.
iii. Liability arising from introducing a compute r virus into or otherwise causing damage to vendor (first -party) or customer’s (third party) computer, computer system, network, or similarly related property and the data, software, and programs.
iv. Liability arising from professional misconduct or lack of the requisite skill required for performing services defined in the contract or agreement.
v. Costs associated with restoring, updating, or replacing data. vi. Costs associated with a privacy breach, including notification costs, customer support, forensics, crises management, public relations consulting, legal services of a privacy attorney, credit monitoring, and identity fraud resolution services for affected individuals.

If coverage is maintained on a claims -made basis, consultant shall maintain such coverage f or an additional three (3) years following termination of the contract.

f) Cyber Technology Errors and Omissions. Consultant shall procure and maintain insurance with limits of $1,000,000 per occurrence/loss, $2,000,000 general aggregate, which shall include the following coverage:
i. Liability arising from the unauthorized release of information for which an entity has the legal obligation to keep private, such as personally identifiable information (PII) and protected health information (PHI). ii. Network security liability arising from the unauthorized use of, access to, or tampering with computer systems, including hacker or denial of service attacks.
iii. Liability arising from the failure of technology products (software and hardware) required under the contract for Consultant to properly perform the intended services.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 18 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 6 of 47 ends

iv. Claims alleging the failure of computer security that result in the transmission of malicious code, deletion, destruction or alteration of data, or the denial of service.
v. Electronic Media Liability arising from personal injury, plagiarism or misappropriation of ideas, domain name infringement or improper deep-linking or framing, and infringement or violation of intellectual property rights.
vi. Liability arising from the rendering, or failure to render, professional services.
vii. Defense costs in regulatory proceedings (state and federal) involving a violation of privacy laws or intellectual property rights. viii. Crisis management and other expert services.

If coverage is maintained on a claims -made basis, the Consu ltant shall maintain such coverage for an additional three (3) years following termination of the contract.

Liability insurance policies required to be provided by CONSULTANT hereunder shall contain or be endorsed to contain the following provisions:

a) Except for professional liability insurance, CITY, its employees, officials, agents and member agencies shall be covered as additional insureds. Coverage shall apply to any and all liability arising out of the work performed or related to the contract. Additional insured status under the general liability requirement shall be provided on Insurance Services Office Form CG 20 10, with an edition date prior to 20 04, or its equivalent. Additional insured status for completed operations shall be provided eithe r in the additional insured form or through another endorsement such as CG 20 37, or its equivalent.

b) General and automobile liability insurance shall apply separately to each insured against whom a claim is made or suit is brought, except with respect t o the limits of the insurer’s liability. Coverage will not be limited to CITY’s vicarious liability.

c) Professional liability insurance policies inception date, continuity date, or retroactive date must be before the effective date of this agreement .

CONSULTANT agrees to maintain continuous coverage through a period no less than three years after completion of the services required by this agreement.

d) Except for professional liability insurance, l iability coverage shall be primary and non-contributing with any insurance maintained by CITY.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 19 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 7 of 47 ends

e) Evidence of coverage (including the workers’ compensation and employer ’s liability policies) shall provide that coverage shall not be suspended, voided, canceled or reduced in coverage or in limits except after 30 d ays’ prior written notice has been given to CITY. Such provision shall not include any limitation of liability of the insurer for failure to provide such notice.

f) No liability insurance coverage provided to comply with this AGREEMENT shall prohibit CONSULTANT, or CONSULTANT’s employees, or agents, from waiving the right of recovery prior to a loss. CONSULTANT waives its right of recovery against CITY.

g) CONSULTANT agrees to deposit with CITY within fifteen days of Notice to Proceed of the Contract certificates of insurance and required endorsements.

h) There shall be no recourse against CITY for payment of premiums or other amounts with respect to the insurance required to be provided by CONSULTANT hereunder. Any failure, actual or alleged, on the part of CITY to monitor compliance with these requirements will not be deemed as a waiver of any rights on the part of CITY. CITY has no additional obligations by virtue of requiring the insurance set forth herein. In the event any policy of insurance required under this AGREEMENT does not comply with these requirements or is canceled and not replaced, CITY has the right but not the duty to obtain the insurance it deems necessary and any premium paid by CITY will be promptly reimbursed by CONSULTANT or CITY will withhold amounts sufficient to pay premium from CONSULTANT payments.

i) CONSULTANT agrees to provide immediate notice to CITY of any claim or loss against CONSULTANT arising out of the work performed under this AGREEMENT. CITY assumes no obligation or liability by such notice, but has the right (but not the duty) to monitor the handling of any such claim or claims if they are likely to involve CITY.

11. RELATIONSHIP OF CONSULTANT TO CITY
The relationship of the CONSULTANT to CITY shall be that of an indep endent contractor and that in no event shall CONSULTANT be considered an officer, agent, servant or employee of CITY. CONSULTANT shall be solely responsible for any workers compensation insurance, withholding taxes, unemployment insurance, and any other employer obligations associated with the described work.

12. CORRECTIONS
In addition to the above indemnification obligations, CONSULTANT shall correct, at its expense, all errors in the work that may be disclosed during CITY's review of CONSULTANT's report or plans. Should CONSULTANT fail to make such correction in a reasonably timely manner, such correction shall be made by CITY, and the cost thereof DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 20 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 8 of 47 ends

shall be charged to CONSULTANT or withheld from any funds due to CONSULTANT hereunder.

13. TERMINATION BY CITY
CITY, by notifying CONSULTANT in writing, may upon 10 calendar days notice, terminate without cause any portion or all of the services agreed to be performed under this AGREEMENT. If termination is for cause, no notice period need be given. In the event o f termination, CONSULTANT shall have the right and obligation to immediately assemble work in progress for the purpose of closing out the job. All compensation for actual work performed and charges outstanding at the time of termination shall be payable by CITY to CONSULTANT within 30 days following submission of a final statement by CONSULTANT unless termination is for cause. In such event, CONSULTANT shall be compensated only to the extent required by law.

14. ACCEPTANCE OF FINAL PAYMENT CONSTITUTES RELEASE
The acceptance by CONSULTANT of the final payment made under this AGREEMENT shall operate as and be a release of CITY from all claims and liabilities for compensation to CONSULTANT for anything done, furnished, or relating to CONSULTANT'S work or service s. Acceptance of payment shall be any negotiation of CITY's check or the failure to make a written extra compensation claim within 10 calendar days of the receipt of that check. However, approval or payment by CITY shall not constitute, nor be deemed, a release of the responsibility and liability of CONSULTANT, its employees, subcontractors, agents and CONSULTANTs for the accuracy and competency of the information provided and/or work performed; nor shall such approval or payment be deemed to be an assump tion of such responsibility or liability by CITY for any defect or error in the work prepared by CONSULTANT, its employees, subcontractors, agents and consultants.

15. AUDIT OF RECORDS
At any time during normal business hours and as often as it may deem neces sary, CONSULTANT shall make available to a representative of CITY for examination of all its records with respe ct to all matters covered by this AGREEMENT and will permit CITY to audit, examine and/or reproduce such records. CONSULTANT will retain such fi nancial records, time sheets, work progress reports, invoices, bills and project records for at least two years after termination or final payment under this AGREEMENT.

16. WAIVER; REMEDIES CUMULATIVE
Failure by a party to insist upon the strict performance o f any of the provisions of this AGREEMENT by the other party, irrespective of the length of time for which such failure continues, shall not constitute a waiver of such party's right to demand strict compliance by such other party in the future. No waiver by a party of a default or breach of the other party shall be effective or binding upon such party unless made in writing by such party, and no such waiver shall be implied from any omissions by a party to take any action with respect to such default or b reach. No express written waiver of a specified DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 21 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 9 of 47 ends

default or breach shall affect any other default or breach, or cover any other period of time, other than any default or breach and/or period of time specified. All of the remedies permitted or available to a party under this AGREEMENT, or at law or in equity, shall be cumulative and alternative, and invocation of any such right or remedy shall not constitute a waiver or election of remedies with respect to any other permitted or available right of remedy.

17. CONFLICT OF INTEREST
CONSULTANT is unaware of any CITY employee or official that has a financial interest in CONSULTANT'S business. During the term of this AGREEMENT and/or as a result of being awarded this AGREEMENT, CONSULTANT shall not offer, encourage or accept any financial interest in CONSULTANT'S business by any CITY employee or official.

18. CONSTRUCTION OF LANGUAGE OF AGREEMENT
The provisions of this AGREEMENT shall be construed as a whole according to its common meaning of purpose of providing a public benefit and not strictly for or against any party. It shall be construed consistent with the provisions he reof, in order to achieve the objectives and purposes of the parties. Wherever required by the context, the singular shall include the plural and vice versa, and the masculine gender shall include the feminine or neutral genders or vice versa.

19. MITIGATION OF DAMAGES
In all situations arising out of this AGREEMENT, the parties shall attempt to avoid and minimize the damages resulting from the conduct of the other party.

20. GOVERNING LAW
This AGREEMENT, and the rights and obligations of the parties, shall be g overned and interpreted in accordance with the laws of the State of California. Should litigation occur, venue shall be in Superior Court of Santa Barbara County.

21. NONDISCRIMINATION
CONSULTANT shall not discriminate on the basis of race, color, gender, gender identity/expression, pregnancy, sexual orientation, disability, marital status, or any other characteristic protected under applicable federal or state law.

22. TAXPAYER IDENTIFICATION NUMBER
CONSULTANT shall provide CITY with a complete Request for T axpayer Identification Number and Certification, Form W -9 (Rev. October 2018), as issued by the Internal Revenue Service.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 22 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 10 of 47 ends

23. NON-APPROPRIATION OF FUNDS
Payments due and payable to CONSULTANT for current services are within the current budget and within an available, unexhausted and unencumbered appropriation of CITY funds. In the event CITY has not appropriated sufficient funds for payment of CONSULTANT services beyond the current fiscal year, this AGREEMENT shall cover only those costs incurred up to the conclusion of the current fiscal year.

24. MODIFICATION OF AGREEMENT
The tasks described in this AGREEMENT and all other terms of this AGREEMENT may be modified only upon mutual written consent of CITY and CONSULTANT.

25. USE OF THE TERM “CITY”
Reference to “CITY” in this AGREEMENT includes City Manager or any authorized representative acting on behalf of CITY.

26. PERMITS AND LICENSES
CONSULTANT, at its sole expense, shall obtain and maintain during the term of this AGREEMENT, all appropriate permits, licenses, and c ertificates that may be required in connection with the performance of services under this AGREEMENT.

27. CAPTIONS
The captions or headings in this AGREEMENT are for convenience only and in no other way define, limit or describe the scope or intent of any provision or section of the AGREEMENT.

28. AUTHORIZATION
Each party has expressly authorized the execution of this AGREEMENT on its behalf and bind sai d party and its respective administrators, officers, directors, shareholders, divisions, subsidiaries, agents, employees, successors, assigns, principals, partners, joint venturers, insurance carriers and any others who may claim through it to this AGREEMENT.

29. ENTIRE AGREEMENT BETWEEN PARTIES
Except for CONSULTANT'S proposals and submitted representations for obtaining this AGREEMENT, this AGREEMENT supersedes any other agreements, either oral or in writing, between the parties hereto with respect to the re ndering of services, and contains all of the covenants and agreements between the parties with respect to said services.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 23 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 11 of 47 ends

30. PARTIAL INVALIDITY
If any provision in this AGREEMENT is held by a court of competent jurisdiction to be invalid, void or unenforceable, the remaining provisions will nevertheless continue in full force without being impaired or invalidated in any way.

31. NOTICES
Any notice required to be given hereunder shall be deemed to have been given by depositing said notice in the United States mail , postage prepaid, and addressed as follows:

TO CITY: Attention: Robert Nisbet, City Manager
City of Goleta
130 Cremona Drive, Suite B
Goleta, CA 93117
TO CONSULTANT: Attention: Craig Wolynez, Chief Executive Officer CU Technology, dba Acorn Technology Services
1960 Chicago Avenue, Suite E9
Riverside, CA 92507

32. COUNTERPARTS AND ELECTRONIC/FACSIMILE SIGNATURES
This Agreement may be executed in several counterparts, which may be facsimile or electronic copies. Each counterpart is fully effective as an original, and together constitutes one and the same instrument.

33. FEDERAL REQUIREMENTS
FEMA financial assistance will be used to fund all or a portion of this contract.

The Consultant shall comply with all federal requirements including, but not limited to, the following:

1. 2 C.F.R. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, which is expressly incorporated herein by reference.

2. Federal Contract Provisions attached hereto as Exhibit “C” and incorporated herein by reference.

Subcontracts, if any, shall contain a provision making them subject to all of the provisions stipulated in the contract, including but not limited to, 2 C.F.R. Part 200 and the Federal Contract Provisions.

With respect to any co nflict between such federal requirements and the terms of this contract and/or the provisions of state law and except as otherwise required under federal law or regulation, the more stringent requirement shall control.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 24 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 12 of 47 ends

In concurrence and witness whereof , this AGREEMENT has been executed by the parties effective on the date and year first above written.

CITY OF GOLETA CONSULTANT

_____________________________ _____________________________ Robert Nisbet, City Manager Craig Wolynez, Chief Executive Officer

ATTEST

_____________________________
Deborah Lopez, City Clerk

APPROVED AS TO FORM:

MEGAN GARIBALDI, CITY ATTORNEY

_____________________________
Scott Shapses, Deputy City Attorney

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 25 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 13 of 47 ends

EXHIBIT A

SCOPE OF WORK

The Consultant shall deliver comprehensive infor mation technology support services as outlined in Consultant's proposal and its appendices submitted to the City on January 5, 2024, pursuant to RFP No. 2023-013 and the Consultant’s Last Best and Final Offer dated February 20, 2024. This includes, but is not limited to, the following:

General Support

1. Consultant shall provide “full service” to the City, delivering comprehensive IT provisions, addressing all Information Technology needs.

2. Provision of strategic and day -to-day IT support services aligned w ith the Consultant's highest level of support.

3. Consultant shall provide support for City desktops, laptops, computer units and applications.

4. Consultant shall provide support for mobile devices (i.e., tablets, phones, etc.) including device management Mobile Device Management (MDM) (software and hardware).

5. Consultant shall collaborate with third party vendors for application issues beyond routine repair procedures and for non -standard, unique third -party software that the City utilizes.

6. Consultant shall provide 24/7 support to all server(s).

7. Consultant shall provide 24/7 management and monitoring of the network infrastructure.

8. Consultant shall provide 24/7 network security and cyber security monitoring and management.

9. Consultant shall provide centralized security patches/updates and firmware process.

10. Consultant shall evaluate and recommend technological upgrades to the City as needed to improve performance, security, reliability, etc. The City will function as the final decision maker for any proposed upgrades.

11. Consultant will provide support to the Library Services department with all considerations and caveats that will entail.

12. Consultant shall identify, evaluate, and recommend any third -party software tools that the City will be required to procure. The City will function as the final decision maker for DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 26 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 14 of 47 ends

any software licensed by, or for, the City, procured with City funds, or requir ed to be reimbursed with City funds.

13. Acceptance Testing and Documentation of Procedures. Following the comple tion by Consultant of any deliverables required by this Agreement that result in operational changes or new processes, City shall evaluate each p rocess/procedure in accordance with standard industry procedures, noting in writing whether the deliverable will be accepted (final acceptance) or if modifications are required.

14. Consultant shall provide written documentation procedures within thirty (30) calendar days of the effective date of final acceptance.

15. Consultant Staffing: Consultant shall provide technical staff that are knowledgeable and trained to conduct this Scope of Services. Based on ongoing IT needs, staffing levels may change upon mutua l agreement between Consultant and City. Managed Service staffing includes, but not limited to:

15.1. Fractional Chief Information Officer (CIO): Responsible for the Strategy, Budgeting, Road-mapping, and Governance.

15.2. Account Manager: Provides day to day oversight and management.

15.3. Director of IT: Ensures all facets of IT Infrastructure are functioning effectively.

15.4. Project Manager: Ensures all IT projects are delivered on time and on budget.

15.5. Procurement: Ensures that IT assets are procured by leveraging availab le City contracts and incentives.

15.6. On-Site Technician: Full Time Employee that will reside at the City providing white glove service to its employees . The City has a right to review, decline, replace, or accept any proposed staff. Consultant to provide an on-site technician with 3-5 years’ experience.

15.7. 24x7x365 In-Sourced/American Based helpdesk: Consultant will follow the ITIL framework.

15.8. 24x7x365 NOC: Network Operations Center continuously monitoring servers and network to keep the City operational.

15.9. 24x7x365 SOC: Security Operations Center continuously monitoring Security stack to keep the City secure.

15.10. Consultant shall develop and implement a Governance Framework and IT policies; with City’s approval, all policies will utilize City logo and branding and approved formatting.

15.11. Consultant will model governance following COBIT, ITIL and ITSM as stated in proposal.

15.12. Consultant shall develop a 5 -Year Budget and Technology Roadmap. The Consultant shall annually review and update as requested by the City.

16. Consultant shall provide “on -site” support for City special events such as “State of the City” meeting requiring IT support.

17. Consultant shall develop and implement the 12 policies identified in response to issue No. 3 in its proposal. Policies shall be complet ed by December 31, 2024, following the DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 27 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 15 of 47 ends

established governance framework.

18. Consultant shall work with the City to provide services and documents as described in response to RFP Issues and Expectations as outlined in proposal pages 23 -25.

Consultant shall provide an implementation plan and timeline for the City.

19. Consultant shall assist the City in the development and review of plans and specifications for projects that interface with technology to ensure the project meets City standards and needs.

20. Consultant shall be the point of contact for all City third -party IT related vendors (including but not limited to s oftware, security, telecommunications, Internet Service Providers (ISP), and Voice over Internet Protocol (VoIP).

21. Consultant shall support the k eycard access system, including but not limited to commissioning and decommissioning of access control badges as part of MAC protocols.

22. Consultant shall develop training resources to remedy organizational disconnects and inefficiencies based upon trend analysis performed by Consultant.

23. Consultant will implement the real -time service delivery reports to the City within 60 days as described in the proposal submitted to the City on January 5, 2024 pursuant to RFP No. 2023-013, on page 49 (ix. Monthly Reports).

24. Consultant shall conduct annual citywide needs assessment, assist with the development of IT budget and workplan as endorsed by Governance Committee.

25. The City will provide the Consultant with resources as needed to conduct services such as facilitie s access, server and network access, and temporary workspace for Consultant staff as needed. Consultant shall c ommunicate in advance with the City when assistance is required.

26. City will provide a designated point of contact for Consultant.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 28 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 16 of 47 ends

I – Service Delivery Area - Base Services

Purchasing

1. Consultant will be responsible for making recommendations on IT -related equipment (hardware) and software and will coordinate with vendors as requested, although City will generally make purchases.

2. Consultant will be responsible for obtaining quotes for maintenance or warranty renewals and reviewing the terms and conditions of the City's maintenance and support agreements. If Consultant adds a markup or management fee to any hardware, software, or third-party services, such markups or fees must be transparently disclosed to the City in advance. Consultant shall follow all City purchasing policies. The City will function as the final decision maker for any hardware or software purchases made on behalf of the City, procured with City funds, or required to be reimbursed with City funds.

3. The City has the right to obta in quotes and make purchases independent of the Consultant.

4. All hardware and software purchases shall be updated in an asset database with seri al numbers, warranties, and expiration dates and will be reflected in the Annual Technology Audit. Consultant shall export its own data to the City’s asset management system, Asset Essentials, at the request of the City.

5. The Consultant shall assist the C ity in adhering to the Governmental Accounting Standards Board (GASB) Statement No. 96 regarding subscription -based information technology arrangements. This includes ensuring that all IT subscriptions are properly accounted for, and working with the Finan ce Department that the City is compliant with the relevant standards.

Project Management and Delivery

1. Consultant shall deliver and manage projects with an elevated level of professionalism and skill to ensure timelines, scope and budgets are adhered to.

2. Consultant will provide a consistent methodology for all technology projects (i.e., planned during the year ly budget process, ad hoc projects) to ensure successful delivery.

3. Consultant will provide consistent support and project management of all mis sion critical business systems and liaison with the designated software/hardware provider.

4. At City’s sole discretion, innovative technology or application implementation requiring project management and services, may be sole sourced to the Consultant or may be submitted for outside bids.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 29 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 17 of 47 ends

Documentation

1. Consultant shall create and maintain accurate and updated t echnology documentation, including, but not limited to:

1.1. A complete Network map that displays all pertinent sites and devices

1.2. Device configuration version control

1.3. Change control documentation, including thorough test plans

1.4. Standard procedures (i.e., patch management)

1.5. Updated equipment/application/warranty/license lists

1.6. Consultant contact list

Support Tracking

1. Consultant shall utilize an int eractive ticketing system that tracks each ticket from initiation to completion. The system shall serve as the central communication hub between the Consultant's helpdesk and City users. Consultant shall develop pre - configured report(s) that can be run fro m the ticketing system showing outstanding tickets. Service Levels aims to ensure that the Consultant meets City's business requirements for availability, reliability, and secure services that are backed by service levels. By meeting these objectives, City aims to:

1.1. ensure end-user experience and productivity

1.2. standardize hardware and software environments

1.3. ensure security, data management, and backup

1.4. ensure asset management and control

2. Consultant shall follow industry best practices, specifically the "S ervice Operation" standards outlined by the Information Technology Infrastructure Library (ITIL).

Consultant shall use processes governed by a Service Level Matrix (SLM) and a set of Service Level Objectives (SLO) to identify incidents (i.e., alerts and/or events), define each incident's priority level (defined by that incident's urgency and impact), respond to incidents in order of priority, and ultimately resolve incidents as quickly as possible.

Service Level Metrics, Availability and Response Times KPI’s

1. Expected Key Performance Indicators (KPI):

1.1. Churn Rate - calculated as the percentage of employees leaving an organization at a certain period divided by the total number of employees in the organization during that period.

1.2. Average Time to Ticket Resolution

1.3. Average First Response Time

1.4. Opening/Closing tickets rate

1.5. Mean Time to Resolve

1.6. Average tickets and help time per customer

1.7. First Call Resolution

1.8. Potential IT issues prevented
DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 30 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 18 of 47 ends

1.9. Network uptime and speed history

1.10. Network inventory and important device statistics DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 31 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 19 of 47 ends

Service Level Agreements

Service Level Metrics for Service Level Agreements (SLA’s)

Service Type Service Delivery

Regular Service

7:00am to 5:30pm, Monday -
Friday

10.5 Hours of service
Help Desk hours, both via email and
telephony, are defined as 7:00am to
5:30pm Monday through Friday except
for City holidays.

Network support 24X7X365 is included
in pricing without additional charges.

City Council
Meetings

Special requirement due
to the importance of these
meetings
SLA – P0 - Immediate
Note: an MSP technician/engineer must
be immediately available, with expedited
resolution, for the duration of the
meeting.

Public Meetings
As required, both within and
outside of regular business
hours
SLA – P1 - Critical
Note: an MSP technician/engineer must
be on-call and available* immediately
for the duration of the meeting.

Emergency
Operation Center
(EOC)

Once EOC has been activated
SLA – P1 – Critical
Note: an MSP technician/engineer must
be on-site at the EOC during all
operational periods for the duration of
the emergency.

After Hours Service
5:31pm to 6:59am hours of
service Monday – Friday
All hours Saturday, Sunday
SLA – P3 - Normal

Service Level Objectives (SLO’s)

P0 -
Immediate
P1 -
Critical
P2 -
Important
P3 –
Normal
P4 –
Low
Metric Objective Objective Objective Objective Objective Availability- Network
Support Operations

Immediate 24x7x365 24x7x365 24x7x365 24x7x365
Availability-
Helpdesk

Immediate

24x7x365

24x7x365
Regular
Service
Hours

Acknowledgement KPI

Immediate 15
minutes*

30 minutes

60 minutes

120 minutes
Status Updates
Continuous
30 minutes 2 hours 8 hours 12 hours
Resolution Plan <10 minutes < 4 hours < 8 hours

< 16 hours < 3 days

Resolution Time
90%
resolved in
less than 10
minutes
90%
resolved in
less than 4
hours
90% resolved
in less than 8
hours
75% resolved
in less than
16 business
hours
75% resolved
in less than 1
week
DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 32 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 20 of 47 ends

Priority Levels

Incident Priority Definition
P0 – Immediate Special need for Council Meetings that necessitate immediate response to an issue affecting the City’s ability to meet its requirement as a public meeting (Brown Act).

P1 – Critical Typically, an emergency incident affecting all or most users and that is halting the use of critical "line of business" applications and/or access to the network or a data/security breach.

Examples: Email server(s) not sending/receiving email, Internet connection down, database server appears offline, etc.

P2 – Important Likely affecting multiple users and impairing access to one or more critical business applications, though, not resulting in a complete stoppage of work

Examples: Slow/intermittent Internet connectivity, backup failures, imminent server crash due to lack of hard disk space, etc.

P3 - Normal Typically affecting between 1 and 5 users and generally non-critical in nature. Workarounds are likely available.

Examples: User cannot print to a network printer, user's domain account locked due to unsuccessful password entries, a user has deleted an email by accident and wants it restored, etc.

P4 – Low The problem affects no more than a few users and is defined as a non- business impact. Workarounds available.

Examples: User has some "dead pixels" on their monitor, user application displaying persistent error messages with no impact to use of the application, occasional static heard on a particular VoIP phone, etc.

Consultant shall develop a pre -configured report(s) from Consultant’s ticketing system that documents Consultant performance according to the service levels set forth above. Any SLA that is not met will require a remediation plan included in the SLA Report that will be implemented in less than 30 days following the report's submission.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 33 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 21 of 47 ends

Account Administration, Management, and Reporting

Consultant is responsible for maintaining a prominent level of service and accurate reporting on that service. Account administration includes, but is not limited to, the following services and reports:

1. Prepare and deliver Service Level Agreement Reports acco rding to the agreed- upon service levels, and timelines set forth above

2. Report of all Help Desk tickets or reported incidents that have been open more than three days (weekly)

3. Prepare and deliver a summary report of all tickets opened, closed, or worke d during the month, with a status for each

4. Prepare and conduct an IT Satisfaction Survey due annually by the end of the 1st quarter of each fiscal year (9/30)

5. Perform Annual Technology Audit, also due by the end of the 1st quarter of each fiscal year ( 9/30), to include the current state of all hardware, software, licenses,
Contractors, diagrams, and recommendations for improvements, innovation, modern technology, including improvement and sustainability projects

6. As part of this audit, the Consultant shall present the City with all upcoming hardware/software technologies that will eventually help improve City's services. Also, to align with broader goa ls and objectives, a sequence/timeline for implementation based upon budget forecasts, organizational capacity, support, training, and implementation fatigue, etc.

7. Attend IT meetings (TBD quarterly) on -site or via teleconference with department IT user group and/or Executive Steering Committee

8. Conduct monthly IT status update meetings with City point of contact

9. Provide status of service request or project (as needed)

10. Decommission and remove hardware, including hard drives in compliance with DOJ/CJIS policies

Asset Management Services include:

1. Physical inventory

2. Asset receiving

3. Asset tracking

4. Software license management

5. Asset cascading and disposal
DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 34 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 22 of 47 ends

Change Management

Consultant shall establish a robust Change Management methodology to ensure changes are managed. Change Management System must provide a Change Control structure including roles and responsibilities, required inputs and outputs, and communication requirements. Identify any areas where specific processes or procedures need to be adhered to (e.g., application vs. infrastructure).

II – Service Delivery Area - Desktop and Server Services

1. Help Desk management, maintenance, and monitoring activities for the operation and performance of network equipment, desktops, peripherals, and telephone equipment.

2. Consultant shall provide a full -service Help Desk as specified in the Service Level Agreement table above.

3. Consultant shall provide support for Microsoft 365, Microsoft Windows and Microsoft Server (multiple OS versions).

4. Consultant shall provide support for Microsoft 365 Exchange in the cloud.

5. Consultant shall manage all aspects of Help Desk service delivery as a single point of contact, including:

5.1. All problem resolution

5.2. Service request tracking

5.3. Problem management

5.4. Call escalation management

5.5. Dispatch

5.6. Knowledge management

5.7. Self help

5.8. New employee Onboarding / training

5.9. Manage the team providing services to Goleta

5.10. Manage the performance of Consultant's personnel and services and continually seek opportunities to enhance and improve performance.

5.11. Provide the City monthly service level reports to assess monitoring tools.

5.12. City st aff may participate in receiving alerts and alarms. (e.g., Wi -Fi, server room temperature, hardware issues).

6. Consultant will be required to measure and monitor customer service and provide monthly reports on customer service delivery. Consultant will als o provide a process for customer service escalations and remediation.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 35 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 23 of 47 ends

7. Desktop Client Services include:

7.1. Hardware break/fix

7.2. Software break/fix

7.3. Peripheral break/fix (i.e., printers, scanners, copiers, fax, audio/visual equipment Note: Consultant will not be expected to fix a/v related equipment but rather help diagnose issues and if necessary, recommend replacement hardware.)

7.4. Technology refresh (includes planning and coordination with City staff)

7.5. Training room setup (setup equipment in miscellaneous locations as needed)

7.6. Installations, moves, adds, and changes

7.7. Troubleshoot and fix desktop (on site or remotely) and network issues

7.8. Provide support to E mergency Operation Center (EOC) to ensure network connectivity to EOC internet connection and phone lines

8. Desktop Application Services include:

8.1. Basic troubleshooting/connectivity support to the City applications

8.2. Image management

8.3. Patch management (all applications)

8.4. Provide and maintain security on the desktops (antivirus)

8.5. Implement antivirus automat ed scheduled scans and automatic definition updates (no manual updates or scan)

8.6. Electronic software distribution

8.7. Integration and testing

8.8. Support laptops, tablets, iPad, and mobile devices (cell/smart phones)

9. Third-Party Software Support

Basic suppor t should include connectivity to the application, potential account setup, and upgrade support.

Provide first level support to all departmental operational third -party software in use, as defined in the City’s SB 272 Enterprise Catalog and core and criti cal software as defined by the City and will escalate issues to vendors as necessary.

Categories include:

9.1. Work Order System

9.2. Land Use, Planning, Permitting and Inspection Systems

9.3. Support integration with other software, such as Bluebeam and file management.

9.4. Financial

9.5. GIS

9.6. Adobe Acrobat DC Cloud
DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 36 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 24 of 47 ends

9.7. City Public Website(s)

9.8. Recreation Reservation Software

9.9. Miscellaneous Utility Software (i.e., Cisco WebEx, Zoom, Scanner/OCR, traffic signal software, etc.)

9.10. Business system (Microsoft 365)

9.11. GovCloud (Community Relations)

9.12. Agenda Management Software

9.13. File Storage Systems (All Users)

9.14. Departmental Tracking and project management systems

9.15. All Library systems

10. Microsoft Server Administration and Security

This section includes the maintenance of all aspects of serv er security, incident management, virus and malware protection, access control, and auditing.

Consultant responsibilities include, but are not limited to:

10.1. Microsoft server administration: with access provided by the City set up users, manage access to resources (file shares/printers), and implement security for each per Goleta requirements

10.2. Provide support for VMWare Server Environment

10.3. As needed support to VoIP system

10.4. Provide and support an antivirus solution (solution requires approval by Goleta, cur rently a combination of DNS filtering and built -in Windows security)

10.5. Ensure Goleta security policies are enforced on endpoints

10.6. Perform regular maintenance and auditing to ensure security on all devices

10.7. Monitor and respond to logs on endpoints, antivirus, patching

10.8. Ensure servers and devices have the latest available security patches and firmware installed

10.9. Implement a remote access tool to maintain a sec ure remote access environment using appropriate technologies

10.10. Provide remote access administration that comply with Goleta policies

10.11. Provide assistance to maintain Active Directory, Microsoft Azure, and Group Policies

10.12. Apply and maintain Goleta policies for file system security and user access.

10.13. Assist with the development of new IT related policies & proc edures and the updating of existing policies as needed

11. Storage and Backup, Restore & Disaster Recovery (BRDR)

Support the City’s storage environment ( hardware, software, and methodology) which is currently provided by the existing MSP.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 37 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 25 of 47 ends

Consultant shall manage (hardware, software, and methodology) and ensure the recoverability of all City data based on agreed upon backup and retention schedules.

Provide all support related to backup servers including but not limited to:

11.1. Provide hardware, software, and BRDR methodology

11.2. Manage backup system and Storage Area Network (SAN)

11.3. Perform backups and snapshots in accordance with established backup schedule

11.4. Maintain current upgraded backup software and infrastructure

11.5. Perform file and database recovery from backup media or snapshots as requested

11.6. Manage and monitor location of all backup media in accordance with media retention schedule

11.7. Schedule transport and destruction requests

11.8. Perform and document annual backup media disaster recovery test

12. Develop and implement a backup, restore and disaster recovery (BRDR) methodology following NIST SP 800

13. Secure Large File Transfer Services

13.1. City requires the ability to send, receive and share large files.

13.2. Consultant shall provide support to the City’s solution as needed.

14. Exchange

14.1. Microsoft 365 Exchange in the cloud

III – Service Delivery Area - Network and Security Services

1. Consultant shall manage the City of Goleta's network and provide network engineering, administration, maintenance, and projects services

2. Consultant will design, implement, and test the deployment of Active Directory Federation Services (ADFS), as well as enable and maintain two -factor authentication (2FA) in a production environment.

3. Network administration includes maintaining and moni toring communication through the Goleta network, ensuring optimal performance. This includes but is not limited to documentation and support of firewalls, switches, NAT, and VLANs.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 38 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 26 of 47 ends

4. Security administration includes the support and maintenance of all aspe cts of information security, security awareness and training, incident management, firewall services, intrusion protection, penetrating services, data loss prevention, system security and auditing.

5. The communication/network responsibilities include regul ar patching, updates, firmware and service pack updates, network operating system upgrades, and the monitoring, maintaining, and optimizing of all the services and devices. The network projects include documenting and ensuring standardizations across the network (e.g., VLANS, device management).

6. The network projects will also include maintaining the current environment and changes and improvements to exis ting operations, including new capabilities. Network projects may be scheduled in advance or may be required on an as-needed basis.

The above-mentioned responsibilities include, but are not limited to:

6.1. Maintaining all WAPs, controllers, switches, and VPNs; provide network design and engineering expertise to maintain network.

6.2. Evaluating and applying security patches and upgrades

6.3. Monitoring network performance and capacity

6.4. Identifying potential limitations before traffic on the network increases to the point that it affects system performance.

6.5. Supporting as needed the VoIP infrastructure (connectivity issues)

6.6. Keeping inventory and maintenance records for all network equipment and ensuring documentation and recoverability of network device configurations.

6.7. Providing or scheduling repairs and maintenance necessary to continue operations and meet approved service levels.

6.8. Timely coordination and communication with Goleta City staff regarding maintenance and upgrades to minimize impact on Goleta operations.

6.9. Diagnosing, investigating, and identifying root cause to network problems

6.10. Integration with other A gencies / Applications (e.g., Black Gold Cooperative Library System, etc.).

6.11. Ensure applications are available for internal/external access

6.12. Maintain security settings, software, and firmware on all network equipment, computers, and laptops.

6.13. Utilize NIST security framework and standards to manage Goleta's network security program.

6.14. Facilitate PCI DSS testing and compliance for payment card data

6.15. Network di agrams shall be revised, audited, and inventoried on an annual basis. A quarterly update will be sent to the designated IT DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 39 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 27 of 47 ends

contact for review.

IV - Implementation project plan with milestones for transition of services:

1. Consultant will develop and present to the City a detailed project plan to ensure a smooth and complete transition of services from the current managed service provider to Consultant.

The plan will contain tasks/activities and milestones to include:

1.1. Kickoff meeting

1.2. Coordination with existing manager service provider

1.3. Communication plan

1.4. Discovery phase to ensure data is gathered

1.5. Implement installation of all Consultant tools identified in proposal

1.6. Ensure continuous documentation of the City’s environment

1.7. Training of Consultant’s staff to support the City and sufficient resources assigned to support go-live.

2. Final dates will be mutually agreed upon after the plan is presented to the City, including an agreed upon cutover date from the current MSP provider.

The plan will enable implementa tion of Consultant’s full comprehensive services by July 1, 2024.

At minimum the implementation project plan will include:

1. Kickoff and Coordination with City and existing Managed Services Provider

1.1. Establish communication methods.

2. Discovery Phase

2.1. Update Onboarding Excel Document.

2.2. IT Glue import/export

2.3. Location information

2.4. Contact list of all users in the City for Auto Task ticketing

2.5. Workstation list

2.6. Server and Applications map list with Rack Diagrams

2.7. Helpdesk, Engineering documents

2.8. Credentials

2.9. Domain information

2.10. SSL Certificate information

2.10.1. Anti-virus details

2.10.2. Application and SME's

2.10.3. Internet WAN information

2.10.4. LAN information
DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 40 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 28 of 47 ends

2.10.5. Licensing details

2.10.6. Remote access details

2.11. Account Manager – Customer Information Gathering.

2.11.1. Point of contact

2.11.2. Point of contacts for emergencies

2.11.3. Point of contact for all maintenance, including monthly patching

2.11.4. Change request form for authorizations

2.11.5. Physical access keys for afterhours access

2.11.6. Maintenance schedule for Microsoft updates

2.11.7. Accounts payables point of contact

2.11.8. Purchasing process

2.11.9. Purchasing thresholds and procurement requirements per the Goleta Municipal Code.

2.11.10. New user onboarding form

2.11.11. Offboarding form for separated employees

2.11.12. Current login process

2.11.13. Third party vendor information

2.12. Others;

2.12.1. Backup documentation

2.12.2. Disaster recovery documentation

2.12.3. Seamless transfer of network equipment and licenses to City/Consultant

2.12.4. Business application list

2.12.5. Recommendation for a file storage system and
improvements

2.12.6. Desktop software(s)

2.12.7. Create and implement a “Dashboard” system for City use

2.12.8. Cybersecurity scan with review results and remediation

2.12.9. Option to improve WAN/LAN connectivity

2.12.9.1. Option to provide Internet redundancy for the City

2.12.9.2. Architecture diagrams

2.12.9.2.1. Network diagram

2.12.9.2.2. Wireless map

2.12.9.2.3. VoIP design

3. Implementation Phase

3.1. Create Communication Plan(s) for City employees

3.2. Create domain administration accounts "ATS"

3.3. Deploy Datto RMM

3.4. Deploy Auvik

3.5. Update IT Glue with ALL documentation provided in discovery phase

3.6. Update AutoTask with contacts

3.7. Training of Helpdesk team
DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 41 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 29 of 47 ends

3.8. Account Manager – Customer setup in IT Glue

3.8.1. Point of contact

3.8.2. Point of contacts for emergencies

3.8.3. Point of contact for all maintenance, including monthly patching

3.8.4. Change request form for authorizations

3.8.5. Physical access keys for afterhours access

3.8.6. Accounts payables point of contact

3.8.7. Maintenance schedule for Microsoft updates

3.8.8. Maximum purchasing amount without Council approved and/or three quotes

3.8.9. New user onboarding form

3.8.10. Offboarding form for separated employees

3.8.11. Purchasing process

3.8.12. Preferred vendors for IT purchases

3.8.13. Current login process

3.8.14. Customer welcome video with Consultant contact details

3.9. Provide access to City POC the following tools:

3.9.1. Datto RMM (Remote Access)

3.9.2. IT Glue (Documentation)

3.9.3. Auvik (Network Monitoring)

3.9.4. AutoTask (Ticketing)

3.9.5. Brightgauge (Reporting)

3.9.6. SmartSheets (Project Management and Reporting

3.9.7. ScalePad (Asset Management)

3.9.8. Other tools referenced in Consultant’s Proposal

4. Go Live Phase

4.1. Create helpdesk extension at the City

4.2. Forward IT emails to [email protected]

5. Complete Detailed Assessment and Findings

5.1. Vulnerability scan and cybersecurity review

5.2. Findings

5.3. Remediation Plan

5.4. Report

6. 100 Days Findings, Commitments, and Accomplishments

6.1. Documentation of City’s IT infrastructure and services

6.2. Comprehensive document of detailed IT inventory

6.3. Recommendations to improve site-to-site network connectivity

6.4. Recommendations to implement Internet redundancy at City Hall DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 42 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 30 of 47 ends

6.5. Recommendations to address internet connectivity and capacity issues

6.6. Recommendations on file storage project

7. Written report, attendance, and presentation to City Council on first 100 days findings, commitments, and accomplishments

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 43 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 31 of 47 ends

EXHIBIT B

SCHEDULE OF FEES

Variations to the monthly price: 07/01/2024 – 06/30/2027

All City sites $26,500 per/month*

This pricing is based on the number of City servers, workstations, and devices listed in the Standard Rates table below. Upon execution of the contract, the price pe r device listed on the Standard Rates table shall be fixed through the contract term, except as adjusted by CPI as discussed below. However, during the di scovery phase of the Transition Period, Consultant shall verify and document the actual number of devi ces by type. Consultant shall “true up” these first two months (rate times the true up count) and adjust initial charge.

Consultant shall verify the inventory monthly. Billing based on inventory will be adjusted semi-annually (true-up).

Additional serve rs, MDM devices and/or workstations, added by City will be charged at the rates below:

Network and Security Services $225.00 per unit/month Desktop Services $50.00 per unit/month
MDM Services $20.00 per unit/month

Reimbursement for Costs: S hould Consultant agree to procure equipment, software, licensing, or supplies at the request of City, City shall reimburse Consultant. Consultant shall pass through straight cost to City without markup.

Annual Adjustments

Pursuant to the Consultant’s proposals, a 3% annual adjustment will be app lied annually beginning July 1, 2025.

Other Mutual Adjustments/Discounts

Consultant has presented the City with discounted pricing as per the Standard Rates table below. Consultant shall honor the proportional discounting through Discovery Phase of the transition and will adjust the pricing within the first three months of the contract based upon the actual number of devices discovered.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 44 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 32 of 47 ends

Upon execution o f the contract, City will pay base rate of $26,500, once a true inventory is determined, Consultant shall “true up” these first two months (rate times the true up count) and adjust initial charge.

Emergency Operations Center Support

In the event of an emergency, Consultant shall immediately respond to the City’s Emergency Operation Center or remotely, a s directed by the City, to provide support to City staff. Work performed outside of business hours shall be billed at a rate of $125 per hour.

Billing by Location

Consultant and City will develop methodology to enable Consultant to segregate (bill) proportional monthly amounts by location for the following locations:

 City Hall and Corporation Yard
 Goleta Library
 Solvang Library
 Buellton Library
 Goleta Community Center
DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 45 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 33 of 47 ends

Standard Rates

Percentage of base and salary to be charged based on City determinatio n.

Workstations, Mobile and Cybersecurity per device based on inventory.

Unlimited Managed Services

QTY

Price

Monthly

Discount %

Discount
Amount

Price after
Discount

Base Services
Purchasing, PM, Documentation,
Support tracking, SLA, AM, Reporting,
CM, and Asset management

$4,500

Desktop,
MDM, and
Server
Services
Workstations management, 24x7x365
Helpdesk. All services listed on page 23
and 24 under the section Desktop and
Server Services of the RFP document.

316

$50

$15,800

27.15%

$6,149

$16,501
Servers’ management, 24x7x365
monitoring and management by NOC
team. All services listed on page 25 and
26 under the sub section Microsoft
Server Administration and Security, of
the RFP document.

2 $225

$450
Mobile Devices (iPads/Tablets) 70 $20 $1,400
Full Time Onsite Employee. Salary,
Benefits, Consultant provided laptop. 1 $5,000 $5,000

Network
and
Security
Services
24x7x365 Monitoring & Management.

Firewalls and IDS, IPS. Switches, WAPs,
NAT, VLANs, Bandwidth monitoring,
Network QoS via Auvik. Patching,
updates, firmware upgrades, Network
diagrams, troubleshooting, maintenance.

Network optimization. VOIP connectivity
issues. VPN management.

10 $75

$750

15.05%

$974

$5,500
Cybersecurity - 24x7x365 SOC team.

Anti- virus on all servers and
workstations.

Incident management, DLP. NIST
standards implementation and
maintenance including PCI DSS.

Vulnerability and penetration scan.

Support and maintenance of Security
awareness training.

318

$18

$5,724
EOC Support: During business Hours Included. EOC After Hours Support Hourly Cost $125.00 Monthly Total $26,500

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 46 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 34 of 47 ends

As-Needed additional Consulting Services Hourly Rate
Schedule

As needed consulting services for work deemed out-of-scope shall be charged to City at the rates shown below in the As -Needed Additional Consulting Services Hourly Rate Table.

Consulting Resource
Billing Rate Per
Hour
Sr. Project Manager 175
Project Manager 145
Sr Field Technician 175
Field Technician 125
Sr Server Engineer 175
Server Engineer 125
Sr Network Engineer 175
Network Engineer 155
Sr Database Administrator 175
Database Administrator 155
Sr Business Analyst 175
Business Analyst 155
Sr Trainer 175
Trainer 125
Sr Organizational Change Manager 175
Organizational Change Manager 125
Sr Contractor/Technology Subject Matter Expert 150
Contractor/Technology Subject Matter Expert 125
EOC after-hours support 125
Special Event after-hours support 125

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 47 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 35 of 47 ends

EXHIBIT C

FEDERAL CONTRACT PROVISIONS
During the performance of this contract, CU Technology, dba Acorn Technology Services (the “Consultant”) shall comply with all applicable federal laws and regulations including but not li mited to the federal contract provisions in this Exhibit. In this Exhibit, the term “Agency” shall mean the local agency entering into this contract with the Consultant.

1. CONTRACTING WITH SMALL AND MINORITY FIRMS, WOMEN’S
BUSINESS ENTERPRISE AND LABOR SURP LUS AREA FIRMS (2
C.F.R. § 200.321)

A. Consultant shall be subject to 2 C.F.R. § 200.321 and will take affirmative steps to assure that minority firms, wome n’s business enterprises, and labor surplus area firms are used when possible and will not be discrimi nated against on the grounds of race, color, religious creed, sex, or national origin in consideration for an award.

B. Affirmative steps shall include:

i. Placing qualified small and minority businesses and
women's business enterprises on solicitation lists;
ii. Assuring that small and minority businesses, and women's business enterprises are solicited whenever they are
potential sources;
iii. Dividing total requirements, when economically feasible, into smaller tasks or quantities to permit maximum participation by small and minority business, and women's business
enterprises;
iv. Establishing delivery schedules, where the requirement permits, which encourage participation by small and minority business, and women's business enterprises; and
v. Using the services/assistance of the Small Business Administration (SBA), and the Minority Business
Development Agency (MBDA) of the Department of
Commerce.

Consultant shall submit ev idence of compliance with the foregoing affirmative steps when requested by the Agency.

Notwithstanding the foregoing, the affirmative steps requirements detailed above do not apply in the case of a noncompetitive procurement made DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 48 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 36 of 47 ends

under the emergency exception/exigency exception to competitive procurements.

2. COST PRINCIPLES (2 C.F.R. PART 200, SUBPART E)

A. If any indirect costs will be charged to the Agency under this contract, such costs must conform to the cost principles set forth under the Uniform Rule s at 2 C.F.R. Part 200, subpart E (“Cost Principles”). In general, costs must (i) be necessary and reasonable; (ii) allocable to the grant award; (iii) conform to any limitations or exclusions set forth in the Cost Principles; (iv) be adequately documented; and (v) be determined in accordance with generally accepted accounting principles (“GAAP”), except, for state and local governments and Indian tribes only, as otherwise provided for in 2 C.F.R. Part 200, subpart E. 2 C.F.R. § 200.403.

Costs that are de termined unallowable pursuant to a federal audit are subject to repayment by Consultant.

3. ACCESS TO RECORDS & RECORD RETENTION (2 C.F.R. 200.336)

A. Consultant shall comply with 2 C.F.R. § 200.336 and provide the Federal Agency, Inspectors General, the Comptroller General of the United States, Agency, and the State of California or any of their authorized re presentatives access, during normal business hours, to documents, papers, books and records which are directly pertinent to this contract for the purposes of making and responding to audits, examinations, excerpts, and transcriptions. The right also includes timely and reasonable access to the Consultant personnel for the purpose of interview and discussion related to the books and records.

B. The Consultant agrees to permit any of the foregoing parties to reproduce by any means whatsoever or to copy excerpts and transcriptions as reasonably needed.

C. The Consultant agrees to provide the Federal Agency or its authorized representatives access to construction or other work sites pertaining to the work being completed under the contract.

4. REQUIRED CONTRACT PROVIS IONS IN ACCORDANCE WITH
APPENDIX II TO PART 200 – CONTRACT PROVISIONS FOR NON - FEDERAL ENTITY CONTRACTS UNDER FEDERAL AWARDS (2
C.F.R. § 200.326)
DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 49 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 37 of 47 ends

A. Appendix II to Part 200 (A); Appendix II to Part 200 (B): Remedies for Breach; Termination for Cause/Convenie nce. If the contract is in excess of $10,000 and the contract does not include provisions for both termination for cause and termination for convenience by the Agency, including the manner by which it will be effected and the basis for settlement, then the following termination clauses shall apply. If the contract is for more than the simplified acquisition threshold (see 2 C.F.R. § 200.88) at the time the contract is executed and does not provide for administrative, contractual, or legal remedies in inst ances where Contractor violates or breaches the terms of the contract, then the following termination clauses shall apply and have precedence over the con tract. Otherwise, the following termination clauses shall not be applicable to the contract.

i. Termination for Convenience. The Agency may, by written notice to Consultant, terminate this contract for convenience, in whole or in part, at any time by giving written notice to Consultant of such termination, and specifying the effective date thereof (“Noti ce of Termination for Convenience”). If the termination is for the convenience of the Agency, the Agency shall compensate Provider for work or materials fully and adequately provided through the effective date of
termination. No amount shall be paid for u nperformed work or materials not provided, including anticipated profit.

Consultant shall provide documentation deemed adequate
by the Agency to show the work actually completed or
materials provided by Consultant prior to the effective date of termination. This contract shall terminate on the effective date of the Notice of Termination.

ii. Termination for Cause. If Consultant fails to perform pursuant to th e terms of this contract, the Agency shall provide written notice to Consultant specifying the default (“Notice of Default”). If Consultant does not cure such default within ten (10) calendar days of receipt of Notice of Default, the Agency may terminate this contract for cause. If Consultant fails to cure a default as set forth above, the Agency may, by written notice to Consultant, terminate this contract for cause, in whole or in part, and specifying the effective date thereof (“Notice of Termination f or Cause”). If the termination is for cause, Consultant shall be
compensated for that portion of the work or materials
DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 50 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 38 of 47 ends

provided which has been fully and adequately completed
and accepted by the Agency as of the date the Agency
provides the Notice of Termination. In such case, the Agency shall have the right to take whatever steps it deems
necessary to com plete the project and correct Consultant’s deficiencies and charge the cost thereof to Consultant, who shall be liable for the full cost of the Agency's c orrective action, including reasonable overhead, profit and attorneys' fees.

iii. Reimbursement; Damages. The Agency shall be entitled to reimbursement for any compensation paid in excess of work rendered or materials provided and shall be entitled to withhold compensation for defective work or other damages caused by Consultant performance of the work.

iv. Additional Termination Provisions. Upon receipt of a Notice of Termination, either for cause or for convenience,
Consultant shall promptly discontinue the w ork unless the Notice directs to the contrary. Consultant shall deliver to the Agency and transfer ti tle (if necessary) to all provided materials and completed work, and work in progress
including drafts, documents, plans, forms, maps, products, graphics, computer programs and reports. The rights and remedies of the parties provided in this Section are i n addition to any other rights and remedies provided by law or under this contract. Consultant acknowledges the Agency’s right to terminate this contract with or without cause as provided in this Section, and hereby waives any and all claims for damages th at might arise from the Agency’s
termination of this contract. The Agency shall not be liable for any costs other than the charges or portions thereof which are specified herein. Consultant shall not be entitled to payment for unperformed work or materia ls not provided and shall not be entitled to damages or compensation for termination of work or supply of materials. If Agency
terminates this contract f or cause, and it is later determined that the termination for cause was wrongful, the termination shall automatically be converted to and treated as a
termination for convenience. In such event, Consultant shall be entitled to receive only the amounts payable under this Section, and Consultant specifically waives any claim for any DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 51 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 39 of 47 ends

other amounts or damages , including, but not limited to, any claim for consequential damages or lost profits. The rights and remedies of the Agency provided in this Section shall not be exclusive and are in addition to any other rights and remedies provided by law, equity or unde r this contract including, but not limited to, the right to specific performance.

B. Appendix II to Part 200 (C) – Equal Employment Opportunity:

Except as otherwise provided under 41 C.F.R. Part 60, Consultant shall comply with the following equal opportunit y clause, in accordance with Executive Order 11246 of September 24, 1965 entitled “Equal Employment Opportunity,” as amended by
Executive Order 11375 of O ctober 13, 1967 and implementation regulations at 41 C.F.R. Chapter 60:

i. Consultant will not discrimin ate against any employee or applicant for employment because of race, color, religion, sex, or national origin. Consultant will take affirmative action to insure that applicants are employed and that employees are treated equally during employment, without regard to race, color, religion, sex, or national origin. Such action shall include, but not be limited to, the following: employment upgrading, demotion , transfer, recruitment, or recruitment advertising; layoff or termination; rates of pay or other form s of compensation; and selection for training including
apprenticeship. Consultant agrees to post in conspicuous places, available to employees and applicants for
employment, notices to be provided by the Agency setting forth the provisions of this nondiscrimination clause.

ii. Consultant will, in all solicitations or advertisements for employees placed by or on behalf of Consultant, state that all qualified a pplicants will receive consideration for employment without regard to their race, color, religion, sex , or national origin.

iii. Consultant will not discharge or in any other manner discriminate against any employee or applicant for
employment because such employee or applicant has
inquired about, discussed, or disclosed the compensation of the employee or app licant or another employee or applicant.

This provision shall not apply to instances in which an employee who has access to the compensation information DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 52 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 40 of 47 ends

of other employees or applicants as a part of such
employee's essential job functions discloses the
compensation of such other employees or applicants to
individuals who do not otherwise have access to such
information, unless such disclosure is in response to a formal complaint or charge, in furtherance of an
investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or is consistent with Consultant‘s legal duty to furnish information.

iv. Consultant will send to each labor union or representative of workers with which he has a collective bargaining agreement or other contract or understanding, a notice, to be provided by the agency contracting officer, advising the labor union or workers' representative of the contractor's commitments under Section 202 of Executive Order No. 11246 of
September 24, 1965, and shall post copies of the notice in conspicuous places available to employees and applicants for employment.

v. Consultant will comply with all provisions of Executive Order 11246 of September 24, 1965, and of the rules, regulations, and relevant orders of the Secretary of Labor.

vi. Consultant will furnish all information and reports required by Executive Order No. 11246 of September 24, 1965, and by the rules, regulations, and orders of the Secretary of Labor, or pursuant thereto, and will permit access to his books, records, and accounts by the contracting agency and the Secretary of Labor for purposes of investigation to ascertain compliance with such rules, regulations, and orders.

vii. In the event of Consultant’s noncompliance with the nondiscrimination clauses of this contract or with any of such rules, regulations, or orders, this contract may be cancelled, terminated or suspended in whole or in part and the
contractor may be declared ineligible for further Government contracts in accordance with procedures authorized in
Executive Order No.11246 of Sept. 24, 1965, and such other sanctions may be imposed and remedies invoked as
provided in Executive Order No.11246 of Septe mber 24,
1965, or by rule, regulation, or order of the Secretary of Labor, or as otherwise provided by law.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 53 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 41 of 47 ends

viii. Consultant will include the provisions of paragraphs (i) through (viii) in every subcontract or purchase order unless exempted by rules, regulations, or orders of the Secretary of Labor issued pursuant to Section 204 of Executive Order No. 11246 of September 24,1965, so that such provisions will be binding upon each subcontractor or Consultant. Consultant will take such action with respect to any sub contract or purchase order as may be directed by the Secretary of Labor as a means of enforcing such p rovisions including sanctions for noncompliance: Provided, however, that in the event Consultant becomes involved in, or is threatened with,
litigation with a subcontractor or Consultant as a result of such direction, Consultant may request the United Stat es to enter into such litigation to protect the interests of the United States.

C. Appendix II to Part 200 (D) – Davis-Bacon Act; Copeland Act: Not applicable to this contract.

D. Appendix II to Part 200 (E) – Contract Work Hours and Safety Standards Act:

i. If this contract is in excess of $100,000 and involves the employment of mechanics or laborers, Consultant shall
comply with 40 U.S.C. 3702 and 3704, as supplemented by Department of Labor regulations (29 C.F.R. Part 5). Under 40 U.S.C. 3702, each contract or must be required to
compute the wages of every mechanic and laborer on the
basis of a standard work week of 40 hours. Work in excess of the standard wo rk week is permissible provided that the worker is compensated at a rate of not less than one and a half times the basic rate of pay for all hours worked in excess of 40 hours in the work week. The requirements of 40 U.S.C. 3704 are applicable to construction work and
provide that no laborer or mechanic must be required to work in surroundings or under wor king conditions which are unsanitary, hazardous or dangerous. These requirements do not apply to the purchases of supplies or materials or articles ordinarily available on the open market, or contracts for transportation or transmission of intelligence.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 54 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 42 of 47 ends

ii. No contractor or subcontractor contracting for any part of the contract work which may require or involve the employment of laborers or mechanics shall require or permit any such laborer or mechanic in any workweek in which he or she is employed on such wor k to work in excess of forty hours in such workweek unless such laborer or mechanic receives
compensation at a rate not less than one and one -half times the basic rate of pay for all hours worked in excess of forty hours in such workweek.

iii. In the event o f any violation of the clause set forth in paragraph (ii) of this section the contractor and any
subcontractor responsible therefore shall be liable for the unpaid wages. In addition, such contractor and
subcontractor shall be liable to the United States (in the case of work done under contract for the District of Columbia or a territory, to such District or to such territory), for liquidated damages. Such liquidated damages shall be computed with respect to each individual laborer or mechanic, including watchmen and guards, employed in violation of the clause set forth in paragraph (ii) of this section, in the sum of $10 for each calendar day on which such individual was required or permitted to work in excess of the standard workweek of forty hours without payment of the overtime wages required by the clause set forth in paragraph (ii) of this section.

iv. The Agency shall upon its own action or upon written request of an authorized representative of the Department of Labor withhold or cause to be withheld, fr om any moneys payable on account of work performed by the Consultant or subcontractor under any such contract or any other Federal contract with the same prime contractor, or any other
federally-assisted contract subject to the Contract Work Hours and Safe ty Standards Act, which is held by the same prime contractor, such sums as may be determined to be
necessary to satisfy any liabilities of such contractor or subcontractor for unpaid wages and liquidated damages as provided in the clause set forth in parag raph (iii) of this section.

v. The Consultant or subcontractor shall insert in any
subcontracts the clauses set forth in paragraph (ii) through (v) of this Section and also a clause requiring the
DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 55 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 43 of 47 ends

subcontractors to include these clauses in any lower tier subcontracts. The Contractor shall be responsible for
compliance by any subcontractor or lower tier subcontractor with the clauses set forth in paragraphs (ii) through (v) of this Section.

E. Appendix II to Part 200 (F) – Rights to Inventions Made Under a Contract or Agreement:

i. If the Federal award meets the definition of “funding agreement” under 37 C.F.R. § 401.2(a) and the non -Federal entity wishes to enter into a contract with a small business firm or nonprofit organization regarding the substitution of parties, assignment or performance of experimental,
developmental, or research work under that “funding
agreement,” the non -Federal entity must comply with the requirements of 37 C.F.R. Part 401 (Rights to Inventions Made by Nonprofit Organizations and Smal l Business Firms Under Government Grants, Contracts and Cooperative
Agreements), and any implementing regulations issued by the Agency.

ii. The regulation at 37 C.F.R. § 401.2(a) currently defines “funding agreement” as any contract, grant, or cooperative agreement entered into between any Federal agency, other than the Tennessee Valley Authority, and any contractor for the performance of experimental, devel opmental, or
research work funded in whole or in part by the Federal government. This term also includ es any assignment,
substitution of parties, or subcontract of any type entered into for the performance of experimental, developmental, or research work under a funding agreement as defined in the first sentence of this paragraph.

iii. This requirement does n ot apply to the Public Assistance , Hazard Mitigation Grant Program, Fire Management
Assistance Grant Program, Crisis Counseling Assistance
and Training Gr ant Program, Disaster Case Management
Grant Program, and Federal Assistance to Individuals and Households – Other Needs Assistance Grant Program, as
FEMA awards under these programs do not meet the
definition of “funding agreement.”

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 56 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 44 of 47 ends

F. Appendix II to Part 200 (G) – Clean Air Act and Federal Water Pollution Control Act: If this contract is in excess of $150,0 00, Consultant shall comply with all applicable standards, orders, or requirements issued pursuant to the Clean Air Act (42 U.S.C. 7401 - 7671q) and the Fed eral Water Pollution Control Act as amended (33 U.S.C. 1251-1387).

i. Pursuant to the Clean Air Act, ( 1) Consultant agrees to comply with all applicable standards, orders or regulations issued pursuant to the Clean Air Act, as amended, 42 U.S.C. § 7401 et seq., (2) Consultant agrees to report each violation to the Agency and understands and agrees that the Agency will, in turn, report each violation as required to assure notification to the Federal awarding agency and the
appropriate Environmental Protectio n Agency Regional
Office, and (3) Consultant agrees to include these
requirements in each subcontract exceeding $150,000.

ii. Pursuant to the Federal Water Pollution Control Act, (1) Consultant agrees to comply with all applicable standards, orders or regulations issued pursuant to the Federal Water Pollution Control Act, as amended, 33 U.S.C. 1251 et seq., (2) Consultant agrees to report each violation to the Agency and understands and agrees that the Agency will, in turn, report each violation as required to assure notification to the Federal awarding agency and the appropriate Environmental Protection Age ncy Regional Office, and (3) Consultant
agrees to include these requirements in each subcontract exceeding $150,000.

G. Appendix II to Part 200 (H) – Debarment and Suspension: A contract award (see 2 C.F.R. § 180.220) must not be made to parties listed on th e government wide exclusions in the System for Award Management (SAM), in accordance with the OMB guidelines at 2 CFR 180 that implement Executive Orders 12549 (3 C.F.R. part 1986 Comp., p. 189) and 12689 (3 C.F.R. part 1989 Comp., p. 235), “Debarment and Suspension.” SAM Exclusions contains the names of parties debarred, suspended, or otherwise excluded by agencies, as well as parties declared ineligible under statutory or regulatory authority other than Executive Order 12549.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 57 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 45 of 47 ends

i. This contract is a covere d transaction for purposes of 2 C.F.R. pt. 180 and 2 C.F.R. pt. 3000. As such Consultant is required to verify that none of the Consultant, its principals (defined at 2 C.F.R. § 180.995), or its affiliates (defined at 2 C.F.R. § 180.905) are excluded (defi ned at 2 C.F.R. §
180.940) or disqualified (defined at 2 C.F.R. § 180.935).

ii. Consultant must comply with 2 C.F.R. pt. 180, subpart C and 2 C.F.R. pt. 3000, subpart C and must include a requirement to comply with these regulations in any lower tier covered transaction it enters into.
iii. This certification is a material representation of fact relied upon by Agency. If it is later determined that Consultant did not comply with 2 C.F.R. pt. 180, subpart C and 2 C.F.R. pt. 3000, subpart C, in addition to remedies a vailable to the Agency, the Federal Government may pursue available
remedies, including but not limited to suspension and/or debarment.

iv. Consultant warrants that it is not debarred, suspended, or otherwise excluded from or ineligible for participation in a ny federal programs. Consultant also agrees to verify that all subcontractors performing work under this contract are not debarred, disqualified, or other wise prohibited from
participation in accordance with the requirements above .

Consultant further agree s to notify the Agency in writing immediately if Consultant or its subcontractors are not in compliance during the term of this contract.

H. Appendix II to Part 200 (I) – Byrd Anti-Lobbying Act: If this contract is in excess of $100,000, Consultant shall have submitted and filed the required certification pursuant to the Byrd Anti -Lobbying Amendment (31 U.S.C. § 1353). If at any time during the contract term funding exceeds $100,000.00, Consultant shall file with the Agency the Federal Standard Form LLL tit led “Disclosure Form to Report Lobbying.” Consultants that apply or bid for an award exceeding $100,000 must file the required certification. Each tier certifies to the tier above that it will not and has not used Federal appropriated funds to pay any person or organization for influencing or attempting to influence an officer or employee of any agency, a member of Congress, officer or employee of Congress , or an employee of a member of Congress in connection with obtaining any Federal contract, grant or a ny other award covered by 31 DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 58 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 46 of 47 ends

U.S.C. 1352. Each tier must also disclose any lobbying with non - Federal funds that takes place in connection with obtaining any Federal award. Such disclosures are forwarded from tier to tier up to the recipient.

I. Appendix II to Part 200 (J) – Procurement of Recovered Materials:

i. Consultant shall comply with section 6002 of the Solid Waste Disposal Act, as amended by the Resour ce Conservation
and Recovery Act. The requirements of Section 6002 include procuring only items design ated in guidelines of the
Environmental Protection Agency (EPA) at 40 C.F.R. part 247 that contain the highest percentage of recovered
materials practicable, consistent with maintaining a
satisfactory level of competition, where the purchase price of the i tem exceeds $10,000 or the value of the quantity
acquired during the preceding fiscal year exceeded $10,000; procuring solid waste management services in a manner that maximizes energy and resource recovery; and establishing an affirmative procurement.

ii. In the performance of this contract, the Consultant shall make maximum use of products containing recovered
materials that are EPA -designated items unless the product cannot be acquired: Competitively within a timeframe
providing for compliance with the cont ract performance schedule; Meeting contract performance requirements; or at a reasonable price.

iii. Information about this requirement, along with the list o f EPA-designate items, is available at EPA’s Comprehensive Procurement Guidelines web site,
https://www.epa.gov/smm/comprehensive-procurement-
guideline-cpg-program.

5. MISCELLANEOUS PROVISIONS

A. The Consultant shall not use the DHS seal(s), logos, crests, or reproductions of flags or likenesses of DHS agency officials without specific FEMA preapproval.

B. This is an acknowledgement that FEMA financial assistance will be used to fund the contract only. The Consultant will comply with all DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 59 City of Goleta
General Services Department and CU Technology, dba Acorn Technology Services

Page 47 of 47 ends

applicable federal law, regulations, executive orders, FEMA policies, procedures, and directives.

C. Consultant acknowledges that 31 U.S.C. Chapter 38
(Administrative Remedies for False Claims and Statements) applies to the Consultant’s actions pertaining to this contract.

D. The Federal Gove rnment is not a party to this contract and is not subject to any obligations or liabilities to the Agency, Consultant, any subcontractors or any other par ty pertaining to any matter resulting from the contract.

E. General and Administrative Expenses And Prof it For Time And Materials Contracts/Amendments.

i. General and administrative expenses shall be negotiated and must conform to the Cost Principles.

ii. Profit shall be negotiated as a separate element of the cost.

To establish a fair and reasonable profit, co nsideration must be given to the complexity of the work to be performed, the risk borne by the Consultant, the Consultant’s investment, the amount of subcontracting, the quality of its record of past performance, and industry profit rates in the surroundin g geographical area for similar work.

iii. Any agreement, amendment or change order for work
performed on a time and materials basis shall include a ceiling price that Consultant exceeds at its own risk.

DocuSign Envelope ID: 36F67C09-3552-490D-9FB6-B21874D8D3C0 DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 60 SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORE

THE EXPIRATION DATE THEREOF, NOTICE WILL BE DELIVERED IN ACCORDANCE WITH THE POLICY PROVISIONS.

INSURER(S) AFFORDING COVERAGE
INSURER F :

INSURER E :

INSURER D :

INSURER C :

INSURER B :

INSURER A :

NAIC #
NAME:

CONTACT
(A/C, No):

FAX
E-MAIL
ADDRESS:

PRODUCER
(A/C, No, Ext):

PHONE

INSURED
REVISION NUMBER:CERTIFICATE NUMBER:COVERAGES
IMPORTANT: If the certificate holder is an ADDITIONAL INSURED, the policy(ies) must have ADDITIONAL INSURED provisions or be endorsed.

If SUBROGATION IS WAIVED, subject to the terms and conditions of the policy, certain policies may require an endorsement. A statement on this certificate does not confer rights to the certificate holder in lieu of such endorsement(s).

THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THIS

CERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND, EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES BELOW. THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S), AUTHORIZED REPRESENTATIVE OR PRODUCER, AND THE CERTIFICATE HOLDER.

OTHER:
(Per accident)
(Ea accident)
$
$
N / A
SUBR
WVD
ADDL
INSD

THIS IS TO CERTIFY THAT THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIOD INDICATED. NOTWITHSTANDING ANY REQUIREMENT, TERM OR CONDITION OF ANY CONTRACT OR OTHER DOCUMENT WITH RESPECT TO WHICH THIS

CERTIFICATE MAY BE ISSUED OR MAY PERTAIN, THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS, EXCLUSIONS AND CONDITIONS OF SUCH POLICIES. LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS. $ $
$
$PROPERTY DAMAGE
BODILY INJURY (Per accident)
BODILY INJURY (Per person)

COMBINED SINGLE LIMIT

AUTOS ONLY

AUTOSAUTOS ONLY

NON-OWNED

SCHEDULEDOWNED

ANY AUTO

AUTOMOBILE LIABILITY
Y / N

WORKERS COMPENSATION

AND EMPLOYERS' LIABILITY
OFFICER/MEMBER EXCLUDED?
(Mandatory in NH)
DESCRIPTION OF OPERATIONS below
If yes, describe under

ANY PROPRIETOR/PARTNER/EXECUTIVE
$
$
$
E.L. DISEASE - POLICY LIMIT
E.L. DISEASE - EA EMPLOYEE
E.L. EACH ACCIDENT
ER
OTH-

STATUTE
PER

LIMITS(MM/DD/YYYY)

POLICY EXP
(MM/DD/YYYY)

POLICY EFF

POLICY NUMBERTYPE OF INSURANCELTR
INSR
DESCRIPTION OF OPERATIONS / LOCATIONS / VEHICLES (ACORD 101, Additional Remarks Schedule, may be attached if more space is required)

EXCESS LIAB
UMBRELLA LIAB $EACH OCCURRENCE
$AGGREGATE
$
OCCUR

CLAIMS-MADE
DED RETENTION $
$PRODUCTS - COMP/OP AGG
$GENERAL AGGREGATE
$PERSONAL & ADV INJURY
$MED EXP (Any one person)
$EACH OCCURRENCE

DAMAGE TO RENTED
$PREMISES (Ea occurrence)

COMMERCIAL GENERAL LIABILITY

CLAIMS-MADE OCCUR
GEN'L AGGREGATE LIMIT APPLIES PER:

POLICY PRO-

JECT LOC

CERTIFICATE OF LIABILITY INSURANCE

DATE (MM/DD/YYYY)

CANCELLATION

AUTHORIZED REPRESENTATIVE
ACORD 25 (2016/03)
© 1988-2015 ACORD CORPORATION. All rights reserved.

CERTIFICATE HOLDER
The ACORD name and logo are registered marks of ACORD
HIRED

AUTOS ONLY
614-842-6686 614-888-2739
Katie Baughan
04/23/2024
techrug
Technology Risk Underwriting Group
596-600 Enterprise Drive
Lewis Center, Ohio 43035
CU Technology LLC dba Acorn Technology Services
1960 Chicago Ave. Suite E9 and Suite C3
Riverside, CA 92507
[email protected]
RLI INS CO 13056
Hamilton Insurance DAC A0765
✔
✔
A
✔
✔
✔
Y 06/01/2023 06/01/2024PTB0001949
06/01/2024A
PTA0001217 06/01/2023
06/01/2024
✔
A 06/01/2023
B Errors and Omissions Insurance B1180D221573/038 06/01/2023 06/01/2024 Each Claim Aggregate
PTW0001346
City of Goleta
130 Cremona Dr
Goleta, CA 93117
The City of Goleta are additional insured per terms of the attached scheduled endorsement with respect to the General Liability Policy (Form PPB 313G 04 13).

The Errors & Omissions Insurance has insuring agreements for Tech & Professional Services Wrongful Act, Media Wrongful Act, Data & Network Wrongful Act and Breach Response "Cyber".
2,000,000
1000,000
10,000
2,000,000
4,000,000
4,000,000
1,000,000
1,000,000
1,000,000
1,000,000
$2,000
$2,000,000
By Sandra Rodriguez at 3:27 pm, Apr 30, 2024
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 61 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 1 of 76
CALIFORNIA SURPLUS LINES NOTICE 2
This insurance is issued pursuant to the California Insurance Code, Sections 1760 through 1780, and is placed in an insurer or insurers not holding a Certificate of Authority from or regulated by the California Insurance Commissioner.

LMA9030
01 September 2013
CALIFORNIA SURPLUS LINES NOTICE 1 (POST BIND)

IMPORTANT NOTICE

1. The insurance policy that you have purchased is being issued by an insurer that is not licensed by the State of California. These companies are called “nonadmitted” or “surplus line” insurers.

2. The insurer is not subject to the financial solvency regulation and enforcement that apply to California licensed insurers.

3. The insurer does not participate in any of the insurance guarantee funds created by California law. Therefore, these funds will not pay your claims or protect your assets if the insurer becomes insolvent and is unable to make payments as promised.

4. The insurer should be licensed either as a foreign insurer in another state in the United States or as a non -United States (alien) insurer. You should ask questions of your insurance agent, broker, or “surplus line” broker or contact the California Department of Insurance at the toll-free number 1-800-927-4357 or internet website www.insurance.ca.gov. Ask whether or not the insurer is licensed as a foreign or non -United States (alien) insurer and for additional information about the insurer. You may also visit the NAIC’s internet website at www.naic.org. The NAIC – the National Association of Insurance Commissioners – is the regulatory support organization created and governed by the chief insurance regulators in the United States.

5. Foreign insurers should be licensed by a state in the United States and you may contact that state’s department of insurance to obtain more information about that insurer. You can find a link to each state from the NAIC internet website: https://naic.org/state_web_map.htm.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 62 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 2 of 76

6. For non -United States (alien) insurers, the insurer should be licensed by a country outside of the United States and should be on the NAIC’s International Insurers Department (IID) listing of approved nonadmitted non-United States insurers. Ask your agent, broker, or “surplus line” broker to obtain more information about that insurer.

7. California maintains a “List of Approved Surplus Line Insurers (LASLI).” Ask your agent or broker if the insurer is on that list, or view that list at the internet website of the California Department of Insurance: www.insurance.ca.gov/01-consumers/120-company/07- lasli/lasli.cfm.

8. If you, as the applicant, required that the insurance policy you have purchased be effective immediately, either because existing coverage was going to lapse within two business days or because you were required to have coverage within two business days, and you did not receive this disclosure form and a request for your signature until after coverage became effective, you have the right to cancel this policy within five days of receiving this disclosure. If you cancel cove rage, the premium will be prorated and any broker’s fee charged for this insurance will be returned to you.

LMA9098B
01 January 2020

CALIFORNIA COMPLAINTS NOTICE

To request assistance or make an initial complaint, you should contact TechRUG at:

TechRUG,
596 Enterprise Drive, Lewis Center, Delaware
County, Ohio 43035, United States
Compliance Officer:

Telephone Number:

Email:

In the alternative, or if you are dissatisfied with the resolution of your complaint by the above party, you may wish to contact the Lloyd’s Complaints Department at:

Lloyd’s Complaints Department
c/o Lloyd’s America Inc.
280 Park Avenue,
East Tower, 25th Floor
New York, NY 10017
USA

Phone: 1-844-849-7828
Email: [email protected]

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 63 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 3 of 76
The California Department of Insurance should be contacted only after discussions with the insurer, its agent, or representative, have failed to produce a satisfactory resolution. You may contact the California Department of Insurance to obtain information on your rights or make a complaint at:

Consumer Hotline
1-800-927-4357 (HELP)

TDD Number
1-800-482-4833 (TTY)

California Department of Insurance
Consumer Services Division
300 South Spring Street, South Tower
Los Angeles, CA 90013

LMA9136A
18 August 2020

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 64 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services SLC-3 (USA) NMA2868 (amended) (24/08/2000)
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 4 of 76

Lloyd’s Certificate

This Insurance is effected with certain Underwriters at Lloyd's, London.

This Certificate is issued in accordance with the limited authorization granted by certain Underwriters at Lloyd's, London whose syndicate numbers and the proportions underwritten by them appear in the Schedule attached (such Underwriters being hereinafter called "Underwriters") and in consideration of the premium specified herein, Underwriters hereby bind themselves severally and not jointly, each for his own part and not one for another, their Executors and Administrators.

The Assured is requested to read this Certificate, and if it is not correct, return it immediately to the Correspondent for appropriate alteration.

All inquiries regarding this Certificate should be addressed to the following Correspondent:

TechRUG
596 Enterprise Drive, Lewis Center, Delaware County, Ohio 43035, United States

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 65 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 5 of 76

CERTIFICATE PROVISIONS

1. Signature Required. This Certificate shall not be valid unless signed by the Intermediary on the attached Declaration Page.

2. Correspondent / Intermediary Not Insurer. Neither the Correspondent nor the Intermediary is an Insurer hereunder and neither is nor shall not be liable for any loss or claim whatsoever. The Insurers hereunder are those Underwriters at Lloyd's, London whose syndicate numbers can be ascertained as hereinbefore set forth.

As used in this Certificate "Underwriters" shall be deemed to include incorporated as well as unincorporated persons or entities that are Underwriters at Lloyd's, London.

3. Cancellation. If this Certificate provides for cancellati on and this Certificate is cancelled after the inception date, earned premium must be paid for the time the insurance has been in force.

4. Service of Suit. It is agreed that in the event of the failure of Underwriters to pay any amount claimed to be due hereunder, Underwriters, at the request of the Assured, will submit to the jurisdiction of a Court of competent jurisdiction within the United States. Nothing in this Clause constitutes or should be understood to constitute a waiver of Underwriters' rights to commence an action in any Court of competent jurisdiction in the United States, to remove an action to a United States District Court, or to seek a transfer of a case to another Court as permitted by the laws of the United States or of any State in the United States. It is further agreed that service of process in such suit may be made upon the firm or person named in the 'Service of Suit' item on the attached Declaration page, and that in any suit instituted against any one of them upon this contract, Underwriters will abide by the final decision of such Court or of any Appellate Court in the event of an appeal.

The Service of Suit Designee named on the Declarations Page is authorized and directed to accept service of process on behalf of Underwriters i n any such suit and/or upon request of the Assured to give a written undertaking to the Assured that they will enter a general appearance upon Underwriters' behalf in the event such a suit shall be instituted.

Further, pursuant to any statute of any state, territory or district of the United States which makes provision therefor, Underwriters hereby designate the Superintendent, Commissioner or Director of Insurance or other officer specified for that purpose in the statute, or his successor or successors in office, as their true and lawful attorney upon whom may be served any lawful process in any action, suit or proceeding instituted by or on behalf of the Assured or any beneficiary hereunder arising out of this contract of insurance, and hereby designate the above-mentioned as the person to whom the said officer is authorized to mail such process or a true copy thereof.

5. Assignment. This Certificate shall not be assigned either in whole or in part without the written consent of the Correspondent endorsed hereon.

6. Attached Conditions Incorporated . This Certificate is made and accepted subject to all the provisions, conditions and warranties set forth herein, attached or endorsed, all of which are to be considered as incorporated herein.

7. Claims. All claims and other enquiries shall be addressed to the Correspondent.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 66 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 6 of 76

8. Short Rate Cancellation. If the attached provisions provide for cancellation, the table below will be used to calculate the short rate proportion of the premium when applicable under the terms of cancellation.

Short Rate Cancellation Table For Term of One Year.

Days
Insurance in
Force
Per Cent
of one year
Premium
Days
Insurance in
Force
Per Cent
of one year
Premium
Days
Insurance in
Force
Per Cent
of one year
Premium
Days
Insurance in
Force
Per Cent
of one year
Premium

1 ........................... 5%
2 ........................... 6
3 - 4 ............................ 7
5 - 6 ............................ 8
7 - 8 ............................ 9
9 - 10 ........................... 10
11 - 12 ........................... 11
13 - 14 ........................... 12
15 - 16 ........................... 13
17 - 18 ........................... 14
19 - 20 ........................... 15
21 - 22 ........................... 16
23 - 25 ........................... 17
26 - 29 ........................... 18
30 - 32 ( 1 mos ) ........... 19
33 - 36 ........................... 20
37 - 40 ........................... 21
41 - 43 ........................... 22
44 - 47 ........................... 23
48 - 51 ........................... 24
52 - 54 ........................... 25
55 - 58 ........................... 26
59 - 62 ( 2 mos ) ........... 27
63 - 65 ........................... 28
66 - 69 ........................ 29%
70 - 73 ........................ 30
74 - 76 ........................ 31
77 - 80 ........................ 32
81 - 83 ........................ 33
84 - 87 ........................ 34
88 - 91 ( 3 mos )......... 35
92 - 94 ........................ 36
95 - 98 ........................ 37
99 - 102 ........................ 38
103 - 105 ........................ 39
106 - 109 ........................ 40
110 - 113 ........................ 41
114 - 116 ........................ 42
117 - 120 ........................ 43
121 - 124 ( 4 mos )......... 44
125 - 127 ........................ 45
128 - 131 ........................ 46
132 - 135 ........................ 47
136 - 138 ........................ 48
139 - 142 ........................ 49
143 - 146 ........................ 50
147 - 149 ........................ 51
150 - 153 ( 5 mos )......... 52
154 - 156 ......................... 53%
157 - 160 ......................... 54
161 - 164 ......................... 55
165 - 167 ......................... 56
168 - 171 ......................... 57
172 - 175 ......................... 58
176 - 178 ......................... 59
179 - 182 ( 6 mos ) ......... 60
183 - 187 ......................... 61
188 - 191 ......................... 62
192 - 196 ......................... 63
197 - 200 ......................... 64
201 - 205 ......................... 65
206 - 209 ......................... 66
210 - 214 ( 7 mos ) ......... 67
215 - 218 ......................... 68
219 - 223 ......................... 69
224 - 228 ......................... 70
229 - 232 ......................... 71
233 - 237 ......................... 72
238 - 241 ......................... 73
242 - 246 ( 8 mos ) ......... 74
247 - 250 ......................... 75
251 - 255 ......................... 76
256 - 260 ........................ 77%
261 - 264 ........................ 78
265 - 269 ........................ 79
270 - 273 ( 9 mos ) ........ 80
274 - 278 ........................ 81
279 - 282 ........................ 82
283 - 287 ........................ 83
288 - 291 ........................ 84
292 - 296 ........................ 85
297 - 301 ........................ 86
302 - 305 ( 10 mos ) ....... 87
306 - 310 ........................ 88
311 - 314 ........................ 89
315 - 319 ........................ 90
320 - 323 ........................ 91
324 - 328 ........................ 92
329 - 332 ........................ 93
333 - 337 ( 11 mos ) ....... 94
338 - 342 ........................ 95
343 - 346 ........................ 96
347 - 351 ........................ 97
352 - 355 ........................ 98
356 - 360 ........................ 99
361 - 365 ( 12 mos ) ....... 100

Rules applicable to insurance with terms less than or more than one year:

A. If insurance has been in force for one year or less, apply the short rate table for annual insurance to the full annual premium determined as for insurance written for a term of one year.

B. If insurance has been in force for more than one year:

1. Determine full annual premium as for insurance written for a term of one year.

2. Deduct such premium from the full insurance premium, and on the remainder calculate the pro rata earned premium on the basis of the ratio of the length of time beyond one year the insurance has been in force to the length of time beyond one year for which the policy was originally written.

3. Add premium produced in accordance with items (1) and (2) to obtain earned premium during full period insurance has been in force.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 67 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 7 of 76

9. Complaints: All complaints must be referred in the first instance to the Correspondent.

DECUS INSURANCE BROKERS LIMITED COMPLAINTS PROCEDURE
How to make a complaint : Should you wish to make a complaint against Decus Insurance Brokers Limited [A complaint is any written communication where there is an expression of dissatisfaction with an insu rance product or service], you may do so at any time by referring the matter to:

Decus Insurance Brokers Ltd
The Scalpel, 18th Floor,
52 Lime Street,
London,
EC3M 7AF,

ENGLAND
Telephone Number: +44 203 006 6630
Fax Number: +44 203 006 6631
Email: [email protected]
DECUS INSURANCE BROKERS LIMITED’S COMMITMENT TO CUSTOMERS Decus Insurance Brokers Limited are committed to handing all customers complaints received promptly, fairly and in line with regulatory guidelines.

In the event that you remain dissatisfied with the way your complaint has been handled, you may refer the matter to the Complaints team at Lloyd’s. Their address is:

Complaints,
Lloyd’s
One Lime Street,
London, EC3M 7HA
Tel No: +44 (0)20 7327 5693
Fax No: +44 (0)20 7327 5225
Email: [email protected]
Website: https://www.lloyds.com

At any time if you are dissatisfied with the way your complaint has been handled, you may refer the matter to your State Department of Insurance

10. Lloyd’s is Authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 68 Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 8 of 76 D231573

This Declaration Page is attached to and forms part of Certificate provisions.

Previous
Number
New Authority
Reference
Number
B1180D231573 (100%) Certificate
Number
B1180D231573/009
Insurance is effective with certain Percentage
Underwriters at Lloyd’s, London One Lime Street, London, EC3M 7HA 100.00%

SCHEDULE

Type: Technology Professional Liability and Cyber Insurance as more fully defined in the policy wording

Form: TechR.U.G. Technology, Cyber and Media Policy Wording – 2022

Name of Insured: CU Technology d.b.a. Acorn Technology Services

Type of Insured: Corporation

Insured Email: [email protected]

Mailing Address of
Insured:
1960 Chicago Avenue, Suite E9, Riverside, CA 92507

Period of Insurance: Effective from Thu Jun 01 2023 to Sat Jun 01 2024 Both days at 12.01a.m. Local Standard Time

Premium (annual) Premium USD 9,479.25
Policy Fee USD 100.00
Provider Policy Fee USD 100.00
Surplus Lines Tax USD 293.25
Stamping Fee USD 17.60
TRIA Premium USD 95.75
TOTAL USD 10,085.85

Deductible: Breach Response Services: USD 0 each and every claim Cyber Extortion Loss: USD 5,000 each and every claim
All Other Coverages USD 5,000 each and every claim
Waiting Period (Business Income Loss): 8 hours

Limit of Liability: Per Claim and in the Policy Aggregate. USD 2,000,000

Insuring Agreement Aggregate Limit

2. A. Media Tech, Data & Network Liability USD 2,000,000

2. B. Breach Response USD 2,000,000

2. C. Regulatory Defense & Penalties USD 2,000,000

2. D. Payment Card Liabilities & Costs USD 2,000,000

2. E. First Party Data & Network Loss – Dependent Business Loss USD 100,000

2. E. First Party Data & Network Loss – All Other Coverage Under 2. E. USD 2,000,000

2. F. eCrime USD 250,000

2. G. Criminal Reward USD 50,000

Coverage: Worldwide

Conditions: Includes the following terms and conditions:

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 69 Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 9 of 76 D231573

LMA 5389 U.S. Terrorism Risk Insurance Act of 2002 As Amended New and Renewal Business Endorsement
LMA 9030 California Surplus Lines Notice 2
LMA 9098B California Surplus Lines Notice 1 (Post Bind) LMA 9136A California Complaints Notice
LMA 9191 Lloyd's CCPA Privacy Policy
LSW 585 (amended) Premium Payment Warranty
LSW 1001 (Insurance) Several Liability Notice
NMA 1168 (amended) Small Additional or Return Premiums Clause (U.S.A.) NMA 1998 Service of Suit Clause (U.S.A.)
Choice Of Law And Service Of Suit
Computer Hardware Replacement Cost
Crisis Management Expense Coverage
Cryptojacking Endorsement
Cyber Insurance - Incident Response Directions
Employee Device Endorsement
GDPR Cyber Endorsement
Data Privacy Notice
Invoice Manipulation Coverage Endorsement
Reputation Loss
State Consumer Privacy Statutes Endorsement
TechRUG Technology, Cyber and Media
Voluntary Shutdown Coverage

Exclusions: Includes the following exclusions:

LMA 3100 Sanction Limitation And Exclusion Clause
LMA5567A (amended) War and Cyber Operation Exclusion No.4 NMA 1256 Nuclear Incident Exclusion Clause - Liability - Direct (Broad) (U.S.A.)
NMA 1477 Radioactive Contamination Exclusion Clause - Liability - Direct (U.S.A.)
Asbestos, Pollution, and Contamination Exclusion
Endorsement

Website: https://www.acorntechservices.com

Industry: Technology - B2B

Gross Annual
Revenue:

USD 5,000,000

Historic Coverage Full Prior Acts

Continuity Date: Thu Jun 01 2023

US Classification: Surplus Lines
naming:

Peachtree Special Risk Brokers
3525 Piedmont Rd NE Bldg 5 Suite 700 Atlanta GA 30305
California License #: 0E28855

US Surplus lines broker is responsible for collecting and paying all surplus lines taxes and fees.

Claim Notification: BatesCarey LLP
191 North Wacker, Suite 2400, Chicago, IL 60606
Email: [email protected]
Tel: 001-312-762-3256

Service of Suit: Lloyd's America Inc.,
Attention: Legal Department,
280 Park Avenue, East Tower, 25th Floor,
New York, NY 10017

Insurer: Lloyd’s of London, AM Best Rating A XV (Non-admitted)

Commission: As per contract
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 70 Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 10 of 76 D231573

Order Hereon: 100% of 100%

Security: Authority Ref. D231573 – Order: 100%

75.0000% 4000 HAM

100.0000%

25.0000% 2121 ARG

100.0000%

Losses: No Known Losses in the past 5 years

It is understood and agreed that for the purposes of this insurance in the event of any discrepancy between the above referenced proposal form and this Certificate, the terms, conditions, definitions, exclusions and other provisions of this Certificate shall prevail.

It is understood and agreed that wherever the words “Named Insured, Company and Policy” appear in this wording they are deemed to read “Named Assured, Underwriters and Certificate” respectively.

Correspondent: TechRUG
596 Enterprise Drive, Lewis Center, Delaware County, Ohio 43035, United States Intermediary: Decus Insurance Brokers Ltd
The Scalpel, 18th Floor,
52 Lime Street,
London,
EC3M 7AF,

ENGLAND

In witness whereof this certificate has been signed on 5th day of June, 2023 By

Authorized Signatory
Tracey Titley - Decus

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 71 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 1 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 11 of 76

TechR.U.G.

Technology, Cyber and Media
Policy Wording

Underwritten on behalf of:

Certain Underwriters at Lloyd’s of London

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 72 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 2 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 12 of 76

Table of Contents:

1. Introductory Clause

2. Insuring Agreements
A. Media, Tech, Data & Network Liability
B. Breach Response
C. Regulatory Defense & Penalties
D. Payment Card Liabilities & Costs
E. First Party Data & Network Loss
F. eCrime
G. Criminal Reward

3. Defense and Settlement of Claims

4. Definitions

5. Exclusions

6. General Conditions

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 73 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 3 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 13 of 76

1. Introductory Clause:

IMPORTANT NOTICE:

THIS POLICY’S LIABILITY INSURING AGREEMENTS PROVIDE COVERAGE ON A CLAIMS

MADE AND REPORTED BASIS AND APPLY ONLY TO CLAIMS FIRST MADE AGAINST THE

INSURED DURING THE POLICY PERIOD OR THE OPTIONAL EXTENSION PERIOD (IF

APPLICABLE) AND REPORTED TO THE UNDERWRITERS IN ACCORDANCE WITH THE TERMS OF THIS POLICY. AMOUNTS INCURRED AS CLAIMS EXPENSES UNDER THIS

POLICY WILL REDUCE AND MAY EXHAUST THE LIMIT OF LIABILITY AND ARE SUBJECT TO RETENTIONS.

PLEASE REFER TO THE DECLARATIONS, WHICH SHOW THE INSURING AGREEMENTS THAT THE NAMED INSURED PURCHASED. IF AN INSURING AGREEMENT HAS NOT BEEN

PURCHASED, COVERAGE UNDER THAT INSURING AGREEMENT OF THIS POLICY WILL NOT APPLY.

THE UNDERWRITERS AGREE WITH THE NAMED INSURED, IN CONSIDERATION OF THE

PAYMENT OF THE PREMIUM AND RELIANCE UPON THE STATEMENTS CONTAINED IN

THE INFORMATION AND MATERIALS PROVIDED TO THE UNDERWRITERS IN

CONNECTION WITH THE UNDERWRITING AND ISSUANCE OF THIS INSURANCE POLICY (HEREINAFTER REFERRED TO AS THE "POLICY") AND SUBJECT TO ALL THE PROVISIONS, TERMS AND CONDITIONS OF THIS POLICY:

2. Insuring Agreements:

A. Media, Tech, Data & Network Liability

To pay Damages and Claims Expenses, which the Insured is legally obligated to pay because of any Claim first made against any Insured during the Policy Period for a:

1. Tech Wrongful Act;

2. Tech Product Wrongful Act;

3. Media Wrongful Act; or

4. Data & Network Wrongful Act.

B. Breach Response

To indemnify the Insured Organization for Breach Response Costs incurred by the Insured Organization because of an actual or reasonably suspected Data Breach or Security Breach that the Insured first discovers during the Policy Period.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 74 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 4 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 14 of 76

C. Regulatory Defense & Penalties

To pay Penalties and Claims Expenses , which the Insured is legally obligated to pay because of a Regulatory Proceeding first made against any Insured during the Policy Period for a Data Breach or a Security Breach.

D. Payment Card Liabilities & Costs

To indemnify the Insured Organization for PCI Fines, Expenses and Costs which it is legally obligated to pay because of a Claim first made against any Insured during the Policy Period.

E. First Party Data & Network Loss

To indemnify the Insured Organization for:

Business Interruption Loss

Business Interruption Loss that the Insured Organization sustains as a result of a Security Breach or System Failure that the Insured first discovers during the Policy Period.

Dependent Business Interruption Loss

Dependent Business Loss that the Insured Organization sustains as a result of a Dependent Security Breach that the Insured first discovers during the Policy Period.

Cyber Extortion Loss

Cyber Extortion Loss that the Insured Organization incurs as a resul t of an Extortion Threat first made against the Insured Organization during the Policy Period.

Data Recovery Costs

Data Recovery Costs that the Insured Organization incurs as a direct result of a Security Breach or System Failure that the Insured first discovers during the Policy Period.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 75 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 5 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 15 of 76

F. eCrime

To indemnify the Insured Organization for any direct financial loss sustained resulting from:

1. Fraudulent Instruction;

2. Funds Transfer Fraud; or

3. Telephone Fraud;

that the Insured first discovers during the Policy Period.

G. Criminal Reward

To indemnify the Insured Organization for Criminal Reward Funds.

3. Defense and Settlement of Claims:

Defense of Claims

Except with respect to coverage under the Payment Card Liabilities & Costs insuring agreement, the Underwriters have the right and duty to defend any covered Claim or

Regulatory Proceeding. Defense counsel will be mutually agreed by the Named Insured and the Underwriters but, in the absence of such agreement, the Underwriters’ decision will be final.

With respect to the Payment Card Liabilities & Costs insuring agreement, coverage will be provided on an indemnity basis and legal counsel will be mutually agreed by the Named Insured and the Underwriters.

The Underwriters will pay actual loss of salary a nd reasonable expenses resulting from the attendance by a corporate officer of the Insured Organization at any mediation meetings, arbitration proceedings, hearings, depositions, or trials relating to the defense of any Claim, subject to a maximum of USD 2,000 per day and USD 100,000 in the aggregate, which amounts will be part of and not in addition to the Policy Aggregate Limit of Liability.

Settlement of Claims

If the Insured refuses to consent to any settlement recommended by the Underwriters and acceptable to the Claimant, the Underwriters’ liability for such Claim will not exceed:

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 76 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 6 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 16 of 76

1) the amount for which the Claim could have been settled, less the remaining Retention, plus the Claims Expenses incurred up to the time of such refusal; plus

2) sixty percent (60%) of any Claims Expenses incurred after the date such settlement or compromise was recommended to the Insured plus sixty percent (60%) of any Damages, Penalties and PCI Fines, Expenses and Costs above the amount for which the Claim could have been settled;

and the Underwriters will have the right to withdraw from the further defense of such Claim.

The Insured may settle any Claim where the Damages, Penalties, PCI Fines, Expenses and Costs and Claims Expenses do not exceed 50% of the Retention, provided that the entire Claim is resolved and the Insured obtains a full release on behalf of all Insureds from all Claimants.

4. Definitions:

Additional Insured means any person or entity that the Insured Organization has agreed in writing to add as an Additional Insured under this Policy prior to the commission of any act for which such person or entity would be provided coverage under this Policy, but only to the extent the Insured Organization would have been liable and coverage would have been afforded under the terms and conditions of this Policy had such Claim been made against the Insured Organization.

Breach Notice Law means any statute or regulation that requires notice to persons whose personal information was accessed or reasonably may have been accessed by an unauthorized person.

Breach Notice Law also includes any statute or regulation requiring notice of a Data Breach to be provided to governmental or regulatory authorities.

Breach Response Costs means the following fees and costs incurred by the Insured Organization with the Underwriters' prior written consent in response to an actual or reasonably suspected Data Breach or Security Breach:

1. for an attorney to provide necessary legal advice to the Insured Organization to evaluate its obligations pursuant to Breach Notice Laws or a Merchant Services Agreement;

2. for a computer security expert to determine the existence, cause and scope of an actual or reasonably suspected Data Breach, and if such Data Breach is actively in progress on the Insured Organization’s Computer Systems, to assist in containing it;

3. for a PCI Forensic Investigator to investigate the existence and extent of an actual or reasonably suspected Data Breach involving payment card data and for a Qualified Security Assessor to certify and assist in attesting to the Insured Organization's PCI compliance, as required by a Merchant Services Agreement;
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 77 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 7 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 17 of 76

4. to notify those individuals whose Personally Identifiable Information was potentially impacted by a Data Breach;

5. to provide a call center to respond to inquiries about a Data Breach;

6. to provide a credit monitoring, identity monitoring or other personal fraud or loss prevention solution, to be approved by the Underwriters, to individuals whose Personally Identifiable Information was potentially impacted by a Data Breach; and

7. public relations and crisis management costs directly related to mitigating harm to the Insured Organization which are approved in advance by the Underwriters in their discretion.

Breach Response Costs will not include any internal salary or overhead expenses of the Insured Organization.

Business Interruption Loss means:

1. Income Loss;

2. Forensic Expenses; and

3. Extra Expense;

actually sustained during the Period of Restoration as a result of the actual interruption of the Insured Organization’s business op erations caused by a Security Breach or System Failure.

Coverage for Business Interruption Loss will apply only after the Waiting Period has elapsed.

Business Interruption Loss will not include (i) loss arising out of any liability to any third party; (ii) legal costs or legal expenses; (iii) loss incurred as a result of unfavorable business conditions; (iv) loss of market or any other consequential loss; (v) Dependent Business Loss; or (vi) Data Recovery Costs.

Claim means:

1. a written demand received by any Insured for money, services, or any non - monetary or injunctive relief;

2. a written request for mediation or arbitration received by any Insured;

3. a civil proceeding a gainst any Insured commenced by service of a complaint or similar proceeding;

4. a written request to toll or waive any applicable statute of limitations;

5. with respect to coverage provided under the Regulatory Defense & Penalties insuring agreement only, institution of a Regulatory Proceeding against any Insured; and DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 78 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 8 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 18 of 76

Multiple Claims arising from the same or a series of related, repeated or continuing acts, errors, omissions or events will be considered a single Claim for the purposes of this Policy. All such Claims will be deemed to have been made at the time of the first such Claim.

Claims Expenses means:

1. all reasonable and necessary legal costs and expenses resulting from the investigation, defense and appeal of a Claim, if incurred by the Underwriters, or by the Insured with the prior written consent of the Underwriters; and

2. the premium cost for appeal bonds for covered judgments or bonds to release property used to secure a legal obligation; provided the Underwriters will have no obligation to appeal or to obtain bonds.

Claims Expenses will not include any salary, overhead, or other charges by the Insured for any time spent in cooperating in the defense and investigation of any Claim, or costs to comply with any regulatory orders, settlements or judgments.

Computer Systems means computers, any software residing on such compu ters and any associated devices or equipment (including computers, hardware, software and input and output devices which are part of an industrial control system, including a supervisory control and data acquisition (SCADA) system):

1. operated by and either owned by or leased to the Insured Organization; or

2. with respect to coverage under Part 4. of the Media, Tech, Data & Network Liability insuring agreement, as well as the Breach Response, Regulatory Defense & Penalties and Payment Card Liabilities & Costs insuring agreements, operated by a third party pursuant to written contract with the Insured Organization and used for the purpose of providing hosted computer application services to the Insured Organization or for processing, maintaining, hosting or storing the Insured Organization’s electronic Data.

Continuity Date means:

1. the Continuity Date listed in the Declarations; and

2. with respect to any Subsidiaries acquired after the Continuity Date listed in the Declarations, the date the Named Insured acquired such Subsidiary.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 79 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 9 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 19 of 76

Control Group means any principal, partner, corporate officer, director, general counsel (or most senior legal counsel) or risk manager of the Insured Organization and any individual in a substantially similar position.

Criminal Reward Funds means any amount offered a nd paid by the Insured Organization with the Underwriters’ prior written consent for information that leads to the arrest and conviction of any individual(s) committing or trying to commit any illegal act related to any coverage under this Policy; but will not include any amount based upon information provided by the Insured, the Insured’s auditors or any individual hired or retained to investigate the illegal acts. All Criminal Reward Funds offered pursuant to this Policy must expire no later than 6 months following the end of the Policy Period.

Cyber Extortion Loss means:

1. any Extortion Payment that has been made by or on behalf of the Insured Organization with the Underwriters’ prior written consent to prevent or terminate an Extortion Threat; and

2. reasonable and necessary expenses incurred by the Insured Organization with the Underwriters’ prior written consent to prevent or respond to an Extortion Threat.

Damages means a monetary judgment, award or settlement, including any award of prejudgment or post-judgment interest. With the prior written consent of the Underwriters, Damages also include the direct net cost of providing any future service credits offered by t he Insured Organization in lieu of a monetary payment.

Damages will not include:

1. future profits, restitution, disgorgement of unjust enrichment or profits by an Insured, or the costs of complying with orders granting injunctive or equitable relief;

2. return or offset of fees, charges or commissions charged by or owed to an Insured for goods or services already provided or contracted to be provided;

3. taxes or loss of tax benefits;

4. fines, sanctions or penalties against any Insured;

5. punitive or e xemplary damages or any damages which are a multiple of compensatory damages, unless insurable by law;

6. discounts, coupons, prizes, awards or other incentives offered to the Insured’s customers or clients;

7. liquidated damages, but only to the extent th at such damages exceed the amount for which the Insured would have been liable in the absence of such liquidated damages agreement;

8. fines, costs or other amounts an Insured is responsible to pay under a Merchant Services Agreement; or

9. any amounts for which the Insured is not liable, or for which there is no legal recourse against the Insured.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 80 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 10 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 20 of 76

Data means any software or electronic data that exists in Computer Systems and that is subject to regular back-up procedures.

Data Breach means the theft, loss, or Unauthorized Disclosure of Personally Identifiable Information or Third Party Information that is in the care, custody or control of the Insured Organization or a third party for whose theft, loss or Unauthorized Disclosure of Personally Identifiable Information or Third Party Information the Insured Organization is liable.

Data & Network Wrongful Act means:

1. a Data Breach;

2. a Security Breach;

3. failure to timely disclose a Data Breach or Security Breach; or

4. a Privacy Policy Violation.

Data Recovery Costs means the reasonable and necessary costs incurred by the Insured Organization to regain access to, replace, or restore Data, or if Data cannot reasonably be accessed, replaced, or restored, then the reasonable and necessary costs incurred by the Insured Organization to reach this determination.

Data Recovery Costs will not include:
(i) the monetary value of profits, royalties, or lost market share related to Data, including but not limited to trade secrets or other proprietary information or any other amount pertaining to the value of Data;
(ii) legal costs or legal expenses;
(iii) loss arising out of any liability to any third party; or (iv) Cyber Extortion Loss.

Dependent Business means any entity that is not a part of the Insured Organization but which provides necessary products or services to the Insured Organization pursuant to a written contract.

Dependent Business Loss means:

1. Income Loss; and

2. Extra Expense;

actually sustained during the Period of Restoration as a result of an actual interruption of the Insured Organization’s business operations caused by a Dependent Security Breach. Coverage for Dependent Business Loss will apply only after the Waiting Period has elapsed.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 81 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 11 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 21 of 76

Dependent Business Loss will not include
(i) loss arising out of any liability to any third party; (ii) legal costs or legal expenses;
(iii) loss incurred as a result of unfavorable business conditions; (iv) loss of market or any other consequential loss;
(v) Business Interruption Loss; or
(vi) Data Recovery Costs.

Dependent Security Breach means a failure of computer security to prevent a breach of Computer Systems operated by a Dependent Business.

Digital Currency means a type of Digital Currency that:

1. requires cryptographic techniques to regulate the generation of units of currency and verify the transfer thereof;

2. is both stored and transferred electronically; and

3. operates independently of a central bank or other central authority.

Extortion Payment means Money, Digital Currency, marketable goods or services demanded to prevent or terminate an Extortion Threat.

Extortion Threat means a threat to:

1. alter, destroy, damage, delete or corrupt Data;

2. perpetrate the Unauthorized Access or Use of Computer Systems;

3. prevent access to Computer Systems or Data;

4. steal, misuse or publicly disclose Data, Personally Identifiable Information or Third Party Information;

5. introduce malicious code into Computer Systems or to third party Computer Systems from Computer Systems; or

6. interrupt or suspend Computer Systems;

unless an Extortion Payment is received from or on behalf of the Insured Organization.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 82 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 12 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 22 of 76

Financial Institution means a bank, credit union, saving and loan association, trust company or other licensed financial service, Securities broker-dealer, mutual fund, or liquid assets fund or similar investment company where the Insured Organization maintains a bank account.

Forensic Expenses means reasonable and necessary expenses incurred by the Insured Organization to investigate the source or cause of a Business Interruption Loss.

Fraudulent Instruction means the transfer, payment or delivery of Money or Securities by an Insured as a result of fraudulent written, electronic, telegraphic, cable, teletype or telephone instructions provided by a third party, that is intended to mislead an Insured through th e misrepresentation of a material fact which is relied upon in good faith by such Insured.

Fraudulent Instruction will not include loss arising out of:

1. any actual or alleged use of credit, debit, charge, access, convenience, customer identification or other cards;

2. any transfer involving a third party who is not a natural person Insured, but had authorized access to the Insured’s authentication mechanism;

3. the processing of, or the failure to process, credit, check, debit, personal identification number debit, electronic benefit transfers or mobile payments for merchant accounts;

4. accounting or arithmetical errors or omissions, or the failure, malfun ction, inadequacy or illegitimacy of any product or service;

5. any liability to any third party, or any indirect or consequential loss of any kind;

6. any legal costs or legal expenses; or

7. proving or establishing the existence of Fraudulent Instruction.

Funds Transfer Fraud means the loss of Money or Securities contained in a Transfer Account at a Financial Institution resulting from fraudulent written, electronic, telegraphic, cable, teletype or telephone instructions by a third party issued to a Financial Institution directing such institution to transfer, pay or deliver Money or Securities from any account maintained by the Insured Organization at such institution, without the Insured Organization's knowledge or consent.

Funds Transfer Fraud will not include any loss arising out of:

1. the type or kind covered by the Insured Organization’s financial institution bond or commercial crime policy;

2. any actual or alleged fraudulent, dishonest or criminal act or omission by, or involving, any natural person Insured;

3. any indirect or consequential loss of any kind;

4. punitive, exemplary or multiplied damages of any kind or any fines, penalties or loss of any tax benefit;
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 83 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 13 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 23 of 76

5. any liability to any third party, except for direct compensatory damages arising directly from Funds Transfer Fraud;

6. any legal costs or legal expenses; or proving or establishing the existence of Funds Transfer Fraud;

7. the theft, disappearance, destruction of, unauthorized access to, or unauthorized use of confidential information, including a PIN or security code;

8. any forged, altered or frau dulent negotiable instruments, securities, documents or instructions; or

9. any actual or alleged use of credit, debit, charge, access, convenience or other cards or the information contained on such cards.

Income Loss means:
an amount equal to:

1. net profit or loss before interest and tax that the Insured Organization would have earned or incurred; and

2. continuing normal operating expenses incurred by the Insured Organization (including payroll), but only to the extent that such operating expenses must necessarily continue during the Period of Restoration.

Individual Contractor means:
any natural person who performs labor or service for the Insured Organization pursuant to a written contract or agreement with the Insured Organization. The status of an individual as an Individual Contractor will be determined as of the date of an alleged act, error or omission by any such Individual Contractor.

Insured means:

1. the Insured Organization;

2. any director or officer of the Insured Organization, but only with respect to the performance of his or her duties as such on behalf of the Insured Organization;

3. an employee (including a part time, temporary, leased or seasonal employee or volunteer) or Individual Contractor of the Insured Organization, but only for work done while acting within the scope of his or her employment and related to the conduct of the Insured Organization’s business;

4. a principal if the Named Insured is a sole proprietorship, or a partner if the Named Insured is a partnership, but only with respect to the performance of his or her duties as such on behalf of the Insured Organization;

5. any person who previously qualified as an Insured under parts 2. through 4., but only with respect to the performance o f his or her duties as such on behalf of the Insured Organization;

6. an Additional Insured, but only as respects Claims against such person or entity for acts, errors or omissions of the Insured Organization;
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 84 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 14 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 24 of 76

7. the estate, heirs, executors, administrators, assigns and legal representatives of any Insured in the event of such Insured's death, incapacity, insolvency or bankruptcy, but only to the extent that such Insured would otherwise be provided coverage under this Policy; and

8. the lawful spouse, including any natural person qualifying as a domestic partner of any Insured, but solely by reason of any act, error or omission of an Insured other than such spouse or domestic partner.

Insured Organization means the Named Insured and any Subsidiaries.

Loss means Breach Response Costs, Business Interruption Loss, Claims Expenses, Criminal Reward Funds, Cyber Extortion Loss, Damages, Data Recovery Costs, Dependent Business Loss, PCI Fines, Expenses and Costs , Penalties, loss covered under the eCrime insuring agreement and any other amounts covered under this Policy.

Any Loss arising from the same or a series of related, repeated or continuing acts, errors, omissions, incidents or events will be considered a single Loss for the purposes of this Policy.

With respect to the Breach Response and First Party Data & Network Loss insuring agreements, all acts, errors, omissions, incidents or events (or series of related, repeated or continuing acts, errors, omissions, incidents or events) giving rise to Loss in connection with such insuring agreements will be deemed to have been discovered at the time the first such act, error, omission, incident or event is discovered.

Media Activities means creating, displaying, broadcasting, disseminating or releasing Media Material by or on behalf of the Insured Organization to the public, including any blog, webcasts, websites, broadcast or cable stations, or social media web pages, created and maintained by or on behalf of the Insured Organization, but only where such Media Activities and Media Material are intended to inform others of the Insured Organization’s own products, services or activities.

Media Material means any information, including words, sounds, numbers, images or graphics, but will not include computer software or the actual goods, products or services described, illustrated or displayed in such Media Material.

Media Wrongful Act means one or more of the following acts committed on or after the Retroactive Date and before the end of the Policy Period in the course of the Insured Organization’s performance of Media Activities or Tech Services:

1. defamation, libel, slander, product disparagement, trade libel, infliction of emotional distress, outrage, outrageous conduct, or other tort related to disparagement or harm to the reputation or character of any person or organization;

2. a violation of th e rights of privacy of an individual, including false light, intrusion upon seclusion and public disclosure of private facts;

3. invasion or interference with an individual’s right of publicity, including misappropriation of any name, persona, voice or likeness for commercial advantage; DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 85 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 15 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 25 of 76

4. false arrest, detention or imprisonment;

5. invasion of or interference with any right to private occupancy, including trespass, wrongful entry or wrongful eviction;

6. plagiarism, piracy or misappropriation of ideas under implied contract;

7. infringement of copyright;

8. infringement of trade dress, domain name, title or slogan, or the dilution or infringement of trademark or service mark, or improper deep -linking or framing or infringement of domain name including cybersquatting violations;

9. negligence regarding the content of any Media Activities, including harm caused through any reliance or failure to rely upon such content;

10. misappropriation of a trade secret;

11. unfair competition including a violation of Section 43(a) of the Lanham Act, but only if alleged in conjunction with and arising out of any of the acts listed in paragraphs 7. or 8. above.

Merchant Services Agreement means any agreement between an Insured and a financial institution, credit/debit card company, credit/debit card processor or independent service operator enabling an Insured to accept credit card, debit card, prepaid card or other payment cards for payments or donations.

Money means a medium of exchange in current use authorized or adopted by a domestic or foreign government as a part of its currency.

Named Insured means the Named Insured listed in the Declarations.

PCI Fines, Expenses and Costs means:
the monetary amount owed by the Insured Organization under the terms of a Merchant Services Agreement as a direct result of a suspected Data Breach . With the prior consent of the Underwriters, PCI Fines, Expenses and Costs includes reasonable and necessary legal costs and expenses incurred by the Insured Organization to appeal or negotiate an assessment of such monetary amount. PCI Fines, Expenses and Costs will not include any charge backs, interchange fees, discount fees or other fees unrelated to a Data Breach.

Penalties means:

1. any monetary civil fine or penalty payable to a governmental entity that was imposed in a Regulatory Proceeding; and

2. amounts which the Insured is legally obligated to deposit in a fund as equitable relief for the payment of consumer claims due to an adverse judgment or settlement of a Regulatory Proceeding (including such amounts required to be paid into a “Consumer Redress Fund”); DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 86 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 16 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 26 of 76

but will not include:
(i) costs to remediate or improve Computer Systems;
(ii) costs to establish, implement, maintain, improve or remediate security or privacy practices, procedures, programs or policies;
(iii) audit, assessment, compliance or reporting costs; or (iv) costs to protect the confidentiality, integrity and/or security of Personally Identifiable Information or other information.

The insurability of Penalties will be in accordance with the law in the applicable venue that most favors coverage for such Penalties.

Period of Restoration means the 180-day period of time that begins upon the actual and necessary interruption of the Insured Organization’s business operations.

Personally Identifiable Information means:

1. any information concerning an individual that is defined as persona l information under any Breach Notice Law; and

2. an individual’s drivers license or state identification number, social security number, unpublished telephone number, and credit, debit or other financial account numbers in combination with associated secu rity codes, access codes, passwords or PINs; if such information allows an individual to be uniquely and reliably identified or contacted or allows access to the individual’s financial account or medical record information.

but will not include information that is lawfully made available to the general public.

Policy Period means the period of time between the inception date listed in the Declarations and the effective date of termination, expiration or cancellation of this Policy and specifically exclude s any Optional Extension Period or any prior policy period or renewal period.

Privacy Policy means the Insured Organization’s public declaration of its policy for collection, use, disclosure, sharing, dissemination and correction or supplementation of, an d access to Personally Identifiable Information.

Privacy Policy Violation means the failure by the Insured to comply with that part of a Privacy Policy that specifically:

1. prohibits or restricts the Insured Organization’s disclosure, sharing or selling of Personally Identifiable Information;

2. requires the Insured Organization to provide an individual access to Personally Identifiable Information or to correct incomplete or inaccurate Personally Identifiable Information after a request is made;
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 87 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 17 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 27 of 76

3. mandates procedures and requirements to prevent the loss of Personally Identifiable Information;

4. prevents or prohibits improper, intrusive or wrongful collection of Personally Identifiable Information from another person;

5. requires notice to a person of the Insured Organization’s collection or use of, or the nature of the collection or use of his or her Personally Identifiable Information; or

6. provides a person with the ability to assent to or withhold assent for (e.g. opt -in or opt-out) the Insured Organization’s collection or use of his or her Personally Ide ntifiable Information;

provided the Insured Organization has in force, at the time of such failure, a Privacy Policy that addresses those subsections above that are relevant to such Claim.

Regulatory Proceeding means a request for information, civil investigative demand, or civil proceeding brought by or on behalf of any federal, state, local or foreign governmental entity in such entity’s regulatory or official capacity.

Retroactive Date means the applicable date listed in the Declarations.

Securities means negotiable and non-negotiable instruments or contracts representing either Money or tangible property that has intrinsic value.

Security Breach means a failure of computer security to prevent:

1. Unauthorized Access or Use of Computer Systems, including Unauthorized Access or Use resulting from the theft of a password from a Computer System or from any Insured;

2. a denial of service attack affecting Computer Systems;

3. with respect to coverage under the Liability insuring agreements, a denial of service attack affecting computer systems that are not owned, operated or controlled by an Insured; or

4. infection of Computer Systems by malicious code or transmission of malic ious code from Computer Systems.

Subsidiary means any entity:

1. which, on or prior to the inception date of this Policy, the Named Insured owns, directly or indirectly, more than 50% of the outstanding voting securities ("Management Control"); and

2. which the Named Insured acquires Management Control after the inception date of this Policy; provided that:

(i) the revenues of such entity do not exceed 15% of the Named Insured’s annual revenues; or
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 88 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 18 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 28 of 76

(ii) if the revenues of such entity exceed 15% of the Named Insured’s annual revenues, then coverage under this Policy will be afforded for a period of 60 days, but only for any Claim that arises out of any act, error, omission, incident or event first occurring after the entity becomes so owned. Coverage beyond such 60 day period will only be available if the Named Insured gives the Underwriters written notice of the acquisition, obtains the written consent of Underwriters to extend coverage to the entity beyond such 60 day period and agrees to pay any additional premium required by Underwriters.

This Policy provides coverage only for acts, errors, omissions, incidents or events that occur while the Named Insured has Management Control over an entity.

System Failure means an unintentional and unplanned interruption of Computer Systems.

System Failure will not include any interruption of computer systems resulting from (i) a Security Breach, or
(ii) the interruption of any third party computer system.

Tech Products means a computer or telecommunications hardware or software product, or related electronic product, that is created, manufactured or developed by the Insured Organization for others, or distributed, licensed, leased or sold by the Insured Organization to others, for compensation, including software updates, service packs and other maintenance releases provided for such products.

Tech Wrongful Act means any negligent act, error, omission, misstatement, misleading statement, misrepresentation or unintentional brea ch of a contractual obligation by the Insured, or by any person or entity for whom the Insured is legally liable, in rendering or failing to render Tech Services that occurs on or after the Retroactive Date and before the end of the Policy Period, but does not mean a Media Wrongful Act.

Tech Product Wrongful Act means:

1. any negligent act, error, omission, misstatement, misleading statement, misrepresentation or unintentional breach of a contractual obligation by the Insured that results in the failure o f Tech Products to perform the function or serve the purpose intended; or

2. software copyright infringement by the Insured with respect to Tech Products; that occurs on or after the Retroactive Date and before the end of the Policy Period.

Tech Services means computer, cloud computing, and electronic technology services, including:

1. data processing, software as a service (SaaS), platform as a service (PaaS), infrastructure as a service (IaaS), network as a service (NaaS);
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 89 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Hamilton – Technology, Cyber and Media Page 19 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 29 of 76

2. data and application hosting, Computer Systems analysis, and technology consulting and training; or

3. custom software programming for a specific client of the Insured Organization and, computer and software systems installation and integration;

performed by the Insured, or by others acting under the Insured Organization’s trade name, for others for a fee.

Telephone Fraud means the act of a third party gaining access to and using the Insured Organization’s telephone system in an unauthorized manner.

Third Party Information means any trade secret, data, design, interpretation, forecast, formula, method, practice, credit or debit card magnetic strip information, process, record, report or other item of information of a third party not insured under this Policy which is not available to the general public.

Transfer Account means an account maintained by the Insured Organization at a Financial Institution from which the Insured Organization can initiate the transfer, payment or delivery of Money or Securities.

Unauthorized Access or Use means the gaining of access to or use of Computer Systems by an unauthorized person(s) or the use of Computer Systems in an unauthorized manner.

Unauthorized Disclosure means the disclosure of (including disclosure resulting from phishing) or access to information in a manner that is not authorized by the Insured Organization and is without knowledge of, consent or acquiescence of any member of the Control Group.

Waiting Period means the period of time that begins upon the actual interruption of the Insured Organization’s business operations caused by a Security Breach, System Failure, or Dependent Security Breach, and ends after the elapse of the number of hours listed as the Waiting Period in the Declarations.

Exclusions:

The coverage under this Policy will not apply to any Loss arising out of:

Bodily Injury or Property Damage

1. physical injury, sickness, disease or death of any person, including any mental anguish or emotional distress resulting from such physical injury, sickness, disease or death; or DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 90 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Hamilton – Technology, Cyber and Media Page 20 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 30 of 76

2. physical injury to or destruction of any tangible property, including the loss of use thereof; but electronic data will not be considered tangible property; except, however, this exclusion does not apply to:
(i) the wrongful infliction of mental injury, mental anguish, humiliation, shock, or emotional distress alleged in a loss arising out of Data Breach or Security Breach Conformance with Advertising
any actual or alleged failure of any products designed, manufactured, marketed or sold by an Insured Organizati on or on an Insured Organization’s behalf to confirm with any advertisements or representations made by the Insured Organization or on the Insured Organization’s behalf, or to perform as advertised or promised. However, this exclusion shall only apply to Claims for a Media Wrongful Act;

Contractual
with respect to coverage under parts 1. and 3. of the Media, Tech, Data & Network Liability insuring agreement:
any obligation the Insured has under contract; but this exclusion will not apply to:

1. the obligation to perform Tech Services, or

2. a Claim for misappropriation of ideas under implied contract, or

3. to the extent the Insured would have been liable in the absence of such contract;

Criminal, Intentional or Fraudulent Acts
any criminal, dishonest, fraudulent, or malicious act or omission, or int entional or knowing violation of the law, if committed by an Insured, or by others if the Insured colluded or participated in any such conduct or activity; but this exclusion will not apply to:

1. Claims Expenses incurred in defending any Claim alleging the foregoing until there is a final non-appealable adjudication establishing such conduct; or

2. with respect to a natural person Insured, if such Insured did not personally commit, participate in or know about any act, error, omission, incident or event gi ving rise to such Claim or Loss.

For purposes of this exclusion, only acts, errors, omissions or knowledge of a member of the Control Group will be imputed to the Insured Organization; DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 91 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Hamilton – Technology, Cyber and Media Page 21 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 31 of 76

Deceptive Business Practices, Antitrust & Consumer Protection any actual or alleged false, deceptive or unfair trade practices, antitrust violation, restraint of trade, unfair competition (except as provided under part 3. of the Media, Tech, Data & Network Liability insuring agreement), violation of consumer protection law, false, deceptive or misleading advertising, inaccurate cost estimates or failure of goods or services to conform with any represented quality or performance, or violation of the Sherman Antitrust Act, the Clayton Act, or the Robinson-Patman Act; but this exclusion will not apply to:

1. the Breach Response insuring agreement; or

2. coverage for a Data Breach or Security Breach, provided no member of the Control Group participated or colluded in such Data Breach or Security Breach;

Dependent System Failure
The unintentional and unplanned interruption of computer systems operated by a Dependent Business

Distribution of Information
the distribution of unsolicited email, text messages, direct mail, facsimiles or other communications, wire tapping, audio or video recording, or telemarketing, if such distribution, wire tapping, recording or telemarketing is done by or on behalf of the Insured Organization; but this exclusion will not apply to Claims Expenses incurred in defending the Insured against allegations of unlawful audio or video recording;

FCRA
any actual or alleged violation of the Fair Credit Reporting Act, as amended, or any similar federal, state or local law;

First Party Data & Network Loss
with respect to the First Party Data & Network Loss insuring agreements:

1. seizure, nationalization, confiscation, or destruction of property or data by order of any governmental or public authority;

2. costs or expenses incurred by the Insured to identify or remediate software program errors or vulnerabilities or update, replace, restore, assemble, reproduce, recollect or enhance data or Computer Systems to a level beyond that which e xisted prior to a Security Breach, System Failure, Dependent Security Breach or Extortion Threat;

3. fire, flood, earthquake, volcanic eruption, explosion, lightning, wind, hail, tidal wave, landslide, act of God or other physical event.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 92 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Hamilton – Technology, Cyber and Media Page 22 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 32 of 76

Governmental Actions
a Claim brought by or on behalf of any state, federal, local or foreign governmental entity, in such entity’s regulatory or official capacity; but this exclusion will not apply to the Regulatory Defense & Penalties insuring agreement, or any Claim made against the Insured Organization by a governmental entity solely in its capacity as a customer of the Insured Organization;

Harassment or Discrimination
any actual or alleged harassment or discrimination of any kind, including, but not limited to, age, colour, race , gender, creed, national origin, marital status, sexual preference, disability or pregnancy;

Inaccurate Pricing
the actual or alleged inaccurate, inadequate, or incomplete description of the price of goods, products or services, or the quality of goods products or services;

Infrastructure Failure
failure or malfunction of satellites or of power, utility, mechanical or telecommunications (including internet) infrastructure or services that are not under the Insured Organization’s direct operational control;

Licensing Bodies & Joint Ventures

1. the actual or alleged obligation to make licensing fee or royalty payments; or any Claim brought by or on behalf of any intellectual property licensing bodies or organizations;

2. any Claim made by or on behalf of any independent contractor, joint venturer or venture partner arising out of or resulting from disputes over ownership of rights in Media Material or services provided by such independent contractor, joint venturer or venture partner;

Other Insureds & Related Enterprises
a Claim made by or on behalf of:

1. any Insured; but this exclusion will not apply to a Claim made by an individual that is not a member of the Control Group for a Data & Network Wrongful Act , or a Claim made by an Additional Insured; or

2. any business enterprise in which any Insured has greater than 15% ownership interest or made by any parent company or other entity which owns more than 15% of the Named Insured;
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 93 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Hamilton – Technology, Cyber and Media Page 23 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 33 of 76

Patent & Misappropriation of Information

1. infringement, misuse or abuse of patent or patent rights;

2. misappropriation of trade secret arising out of or related to Tech Products or any other products;

3. with respect to any Data & Network Wrongful Act , misappropriation of any Third Party Information (i) by or on behalf of the Insured Organization, or (ii) by any other pers on or entity if such misappropriation is done with the knowledge, consent or acquiescence of a member of the Control Group; or

4. disclosure, misuse or misappropriation of any ideas, trade secrets or confidential information that came into the possession of any person or entity prior to the date he or she became an Insured or Subsidiary of the Insured Organization;

Prior Known Acts & Prior Noticed Claims

1. any act, error, omission, incident or event committed or occurring prior to the inception date of this Policy if any member of the Control Group on or before the Continuity Date knew or could have reasonably foreseen that such act, error or omission, incident or event might be expected to be the basis of a Claim or Loss;

2. any Claim, Loss, incident or c ircumstance for which notice has been provided under any prior policy of which this Policy is a renewal or replacement;

Prohibited, Restricted and Regulated Activities
the sale, provision or marketing of prohibited, restricted or regulated items, including, but not limited to, alcoholic beverages, firearms, tobacco and related products (including vaping devices and products), or drugs whether considered legal or illegal. However, this exclusion shall only apply to Claims for Media Wrongful Act;

Racketeering, Benefit Plans, Employment Liability & Discrimination

1. any actual or alleged violation of the Organized Crime Control Act of 1970 (commonly known as Racketeer Influenced and Corrupt Organizations Act or RICO), as amended;

2. any actual or alleged acts, errors or omissions related to any of the Insured Organization’s pension, healthcare, welfare, profit sharing, mutual or investment plans, funds or trusts;

3. any employer -employee relations, policies, practices, acts or omissions, or any actual or alleged refusal to employ any person, or misconduct with respect to employees; or

4. any actual or alleged discrimination;
but this exclusion will not apply to coverage under the Breach Response insuring agreement or coverage for a Data Breach or Security Breach, provided no member of the Control Group participated or colluded in such Data Breach or Security Breach; DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 94 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Hamilton – Technology, Cyber and Media Page 24 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 34 of 76

Recall
any costs or expenses incurred or to be incurred by the Insured or others for the reprinting, reposting, recall, inspection, repair, replacement, removal or disposal of any Tech Products, Media Material or work product, including when resulting from or incorporating the results of

Retroactive Date
any related or continuing act, error, omission, misstatement, misleading statement, misrepresentation, unintentional breach of a contractual obligation, incident or event where the first such act, error, omission, misstatement, misleading statement,misrepresentation or unintentional breach of a contractual obligation, incident or event was committed or occurred prior to the Retroactive Date;

Sale or Ownership of Securities & Violation of Securities Laws

1. the ownership, sale or purchase of, or the offer to sell or purchase stock or other securities; or

2. an actual or alleged violation of a securities law or regulation;

Tech Services ; but this exclusion will not apply to the resulting loss of use of such Tech Products, Media Material or work product resulting from or incorporating the results of Tech Services;

Trading Losses & Loss of Money

1. any trading losses, trading liabilities or change in value of accounts;

2. any loss, transfer or theft of monies, securities or tangible property of the Insured or others in the care, custody or control of the Insured Organization; or

3. the monetary value of any transactions or electronic fund transfers by or on behalf of the Insured which is lost, diminished, or damaged during transfer from, into or between accounts; but this exclusion will not apply to coverage under the eCrime insuring agreement; DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 95 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Hamilton – Technology, Cyber and Media Page 25 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 35 of 76

Unsolicited Marketing and Communications
Distribution of unsolicited marketing materials by means of email, direct mail, SMS, chat room postings, bulleti n board postings, news group postings, pop -up or pop -under internet advertising, facsimile blasting, direct mailing or telemarketing or any actual or alleged violation of CAN -SPAM Act of 2003 or any subsequent amendments to that act, or the Telephone Consumer Protection Act of 1991 or any subsequent amendments to that act or any law, regulation or statute relating to unsolicited communication, distribution, marketing, sending, or transmitting of any communication via telephone or any other electronic or telecommunications device.

Over-Redemption

1. any actual or alleged gambling, contest, lottery, promotional game or other game of chance; or

2. the value of coupons, price discounts, prizes, awards, or any other valuable consideration given in excess of the total contracted or expected amount;

War and Civil War
or resulting from, directly or indirectly occasioned by, happening through or in consequence of:
war, invasion, acts of foreign enemies, hostilities (whether war be declared or not), civil war, rebellion, revolution, insurrection, military or usurped power or confiscation or nationalization or requisition or destruction of or damage to property by or under the order of any government or public or local authority; provided, that this exclusion will not apply to Cyber Terrorism.

For purposes of this exclusion, “ Cyber Terrorism” means the premeditated use of disruptive activities, or threat to use disruptive activities, against a computer system or network with the intention to cause harm, further social, ideological, religious, political or similar objectives, or to intimidate any person(s) in furtherance of such objectives.

5. General Conditions:

Limit of Liability and Coverage
The Policy Aggregate Limit of Liability listed in the Declarations (the “ Policy Aggregate Limit of Liability”) is the Underwriters’ combined total limit of liability for all Loss payable under this Policy.

The limit of liability payable under each insuring agreement will be an amount equal to the Policy Aggregate Limit of Liability unless another amount is listed in the Declarations. Such amount is the aggregate amount payable under this Policy pursuant to such insuring agreement and is part of, and not in addition to, the Policy Aggregate Limit of Liability.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 96 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Hamilton – Technology, Cyber and Media Page 26 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 36 of 76

All Dependent Business Loss payable under this Policy is part of and not in addition to the Business Interruption Loss limit listed in the Declarations.

The Underwriters will not be obligated to pay any Loss, or to defend any Claim, after the Policy Aggregate Limit of Liability has been exhausted, or after deposit of the Policy Aggregate Limit of Liability in a court of competent jurisdiction.

Retentions
The Retention listed in the Declarations applies separately to each act, error, omission, incident, event or related acts, errors, omissions, incidents or events giving rise to a Claim or Loss. The Retention will be satisfied by monetary payments by the Named Insured of covered Loss under each insuring agreement. If any Loss arising out of an incident or Claim is subject to more than one Retention, the Retention for each a pplicable insuring agreement will apply to such Loss, provided that the sum of such Retention amounts will not exceed the largest applicable Retention amount.

Coverage for Business Interruption Loss and Dependent Business Loss will apply after the Waiting Period has elapsed and the Underwriters will then indemnify the Named Insured for all Business Interruption Loss and Dependent Business Loss sustained during the Period of Restoration in excess of the Retention.

Satisfaction of the applicable Retention is a condition precedent to the payment of any Loss under this Policy, and the Underwriters will be liable only for the amounts in excess of such Retention.

Optional Extension Period
Upon non -renewal or cancellation of this Policy for any reason except the n on-payment of premium, the Named Insured will have the right to purchase, for additional premium in the amount of the Optional Extension Premium percentage listed in the Declarations of the full Policy Premium listed in the Declarations, an Optional Extension Period for the period of time listed in the Declarations. Coverage provided by such Optional Extension Period will only apply to Claims first made against any Insured during the Optional Extension Period and reported to the Underwriters during the Opti onal Extension Period, and arising out of any act, error or omission committed on or after the Retroactive Date (if applicable) and before the end of the Policy Period. In order for the Named Insured to invoke the Optional Extension Period option, the payment of the additional premium for the Optional Extension Period must be paid to the Underwriters within 60 days of the termination of this Policy.

The purchase of the Optional Extension Period will in no way increase the Policy Aggregate Limit of Liability or any sublimit of liability. At the commencement of the Optional Extension Period the entire premium will be deemed earned, and in the event the Named Insured terminates the Optional Extension Period for any reason prior to its natural expiration, the Underwriters will not be liable to return any premium paid for the Optional Extension Period.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 97 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Hamilton – Technology, Cyber and Media Page 27 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 37 of 76

All notices and premium payments with respect to the Optional Extension Period option will be directed to the Underwriters through entity listed for Administrative Notice in the Declarations.

Notice of Claim or Loss

The Insured must notify the Underwriters of any Claim as soon as practicable, but in no event later than: (i) 60 days after the end of the Policy Period; or (ii) the end of the Optional Extension Period (if applicable). Notice must be provided through the contacts listed for Notice of Claim, Loss or Circumstance in the Declarations.

With respect to Breach Response Costs, the Insured must notify the Underwriters of any actual or reasonably suspected Data Breach or Security Breach as soon as practicable after discovery by the Insured, but in no event later than 60 days after the end of the Policy Period. Notice must be provided through the contacts listed for Notice of Claim, Loss or Circumstance in the Declarations. Notice of an actual or reasonably suspected Data Breach or Security Breach in conformance with this paragraph will also constitute notice of a circumstance that could reasonably be the basis for a Claim.

With respect to Cyber Extortion Loss, the Named Insured must notify the Underwriters via the email address listed in the Notice of Claim, Loss or Circumstance in the Declarations as soon as practicable after discovery of an Extortion Threat but no later than 60 days after the end of the Policy Period. The Named Insured must obtain the Underwriters’ consent prior to incurring Cyber Extortion Loss.

With respect to Data Recovery Costs, Business Interruption Loss and Dependent Business Loss the Named Insured must notify the Underwriters through the contacts for Notice of Claim, Loss or Circumstance in the Declarations as soon as practicable after discovery of the circumstance, incident or event giving rise to such Loss. The Named Insured will provide the Underwriters a proof of Data Recovery Costs, Business Interruption Loss and Dependent Business Loss, and this Policy will cover the reasonable and necessary costs, not to exceed USD 50,000, that the Named Insured incurs to contract with a third party to prepare such proof. All Loss described in this paragraph must be reported, and all proofs of loss must be provided, to the Underwriters no later than 6 months after the end of the Policy Period.

The Named Insured must notify the Underwriters of any loss covered under the eCrime insuring agreement as soon as practicable, but in no event later than 60 days after the end of the Policy Period. Notice must be provided through the contacts listed for Notice of Claim, Loss or Circumstance in the Declarations.

Any Claim arising out of a Loss that is covered under the Breach Response, First Party Data & Network Loss or eCrime insuring agreements and that is reported to the Underwriters in conformance with the foregoing will be considered to have been made during the Policy Period.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 98 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Hamilton – Technology, Cyber and Media Page 28 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 38 of 76

Notice of Circumstance

With respect to any circumstance that could reasonably be the basis for a Claim, the Insured may give written notice of such circumstance to the Underwriters through the contacts listed for Notice of Claim, Loss or Circumstance in the Declarations as soon as practicable during the Policy Period. Such notice must include:

1. the specific details of the act, error, omission or event that could reasonably be the basis for a Claim;

2. the injury or damage which may result or has resulted from the circumstance; and

3. the facts by which the Insured first became aware of the act, error, omission or event.

Any subsequent Claim made against the Insured arising out of any circumstance reported to Underwriters in conformance with the foregoing will be considered to have been made at the time written notice complying with the above requirements was first given to the Underwriters during the Policy Period.

Assistance and Cooperation

The Underwriters will have the right to make any investigation they deem necessary, and the Insured will cooperate with the Underwriters in all investigations, including investigations regarding coverage under this Policy and the information and materials provided to the underwriters in connection with the underwriting and issuance of this Policy. The Insured will execute or cause to be executed all papers and render all assistance as is requested by the Underwriters. The Insured agrees not to take any action which in any way increases the Underwriters’ exposure under this Policy. Expenses incurred by the Insured in assisting and cooperating with the Underwriters do not constitute Claims Expenses under the Policy.

The Insured will not admit liability, make any payment, assume any obligations, incur any expense, enter into any settlement, stipulate to any judgment or award or dispose of any Claim without the written consent of the Underwriters, except as specifically provided in the Settlement of Claims clause above. Compliance with a Breach Notice Law will not be considered an admission of liability.

Subrogation

If any payment is made under this Policy and there is available to the Underwriters any of the Insured’s rights of recovery against any other party, then the Underwriters will maintain all such rights of recovery. The Insured will do whatever is reasonably necessary to secure such rights and will not do anything after an incident or event giving rise to a Claim or Loss to prejudice such rights. If the Insured has waived its right to subrogate against a third party through written agreement made before an incident or event giving rise to a Claim or Loss has occurred, then the Underwriters waive their rights to subrogation against such third party.

Any recoveries will be applied first to subrogation expenses, second to Loss paid by the Underwriters, and lastly to the Retention. Any additional amounts recovered will be paid to the Named Insured.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 99 Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Hamilton – Technology, Cyber and Media Page 29 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 39 of 76

Other Insurance

The insurance under this Policy will apply in excess of any other valid and collectible insurance available to any Insured unless such other insurance is written only as specific excess insurance over this Policy. Provided, however, this Policy will become primary and non-contributory insurance as respects any insurance maintained by an Additional Insured if primary insurance is required by a contract in place between the Additional Insured and the Insured Organization, but only with respect to any Claim arising solely from the Media, Tech, Data & Network Liability insuring agreements.

Action Against the Underwriters

No action will lie against the Underwriters or the Underwriters' representatives unless and until, as a condition precedent thereto, the Insured has fully complied with all provisions, terms and conditions of this Policy and the amount of the Insured’s obligation to pay has been finally determined either by judgment or award against the Insured after trial, regulatory proceeding, arbitration or by written agreement of the Insured, the claimant, and the Underwriters.

No person or organization will have the right under this Policy to join the Underwriters as a party to an action or other proceeding against the Insured to determine the Insured’s liability, nor will the Underwriters be impleaded by the Insured or the Insured’s legal representative.

The Insured’s bankruptcy or insolvency of the Insured’s estate will not relieve the Underwriters of their obligations hereunder.

Entire Agreement

By acceptance of the Policy, all Insureds agree that this Policy embodies all agreements between the Underwriters and the Insured relating to this Policy. Notice to any agent, or knowledge possessed by any agent or by any other person, will not effect a waiver or a change in any part of this Policy or stop the Underwriters from asserting any right under the terms of this Policy; nor will the terms of this Policy be waived or changed, except by endorsement issued to form a part of this Policy signed by the Underwriters.

Mergers or Consolidations

If during the Policy Period the Named Insured consolidates or merges with or is acquired by another entity, or sells more than 50% of its assets to another entity, then this Policy will continue to remain in effect through the end of the Policy Period, but only with respect to events, acts or incidents that occur prior to such consolidation, merger or acquisition. There will be no coverage provided by this Policy for any other Claim or Loss unless the Named Insured provides written notice to the Underwriters prior to such consolidation, merger or acquisition, the Named Insured has agreed to any additional premium and terms of coverage required by the Underwriters and the Underwriters have issued an endorsement extending coverage under this Policy.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 100
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Hamilton – Technology, Cyber and Media Page 30 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 40 of 76

Assignment

The interest hereunder of any Insured is not assignable. If the Insured dies or is adjudged incompetent, such insurance will cover the Insured’s legal representative as if such representative were the Insured, in accordance with the terms and conditions of this Policy.

Cancellation

This Policy may be cancelled by the Named Insured by giving written notice to the Underwriters through the entity listed for Administrative Notice in the Declarations stating when the cancellation will be effective.

This Policy may be cancelled by the Underwriters by mailing to the Named Insured at the address listed in the Declarations written notice stating when such cancellation will be effective. Such date of cancellation will not be less than 60 days (or 10 days for cancellation due to non-payment of premium) after the date of notice.

If this Policy is canceled in accordance with the paragraphs above, the earned premium will be computed pro rata; but the premium will be deemed fully earned if any Claim, or any circumstance that could reasonably be the basis for a Claim or Loss, is reported to the Underwriters on or before the date of cancellation. Payment or tender of unearned premium is not a condition of cancellation.

Singular Form of a Word

Whenever the singular form of a word is used herein, the same will include the plural when required by context.

Headings

The titles of paragraphs, clauses, provisions or endorsements of or to this Policy are intended solely for convenience and reference, and are not deemed in any way to limit or expand the provisions to which they relate and are not part of the Policy.

Representation by the Insured

All Insureds agree that the statements contained the information and materials provided to the Underwriters in connection with the underwriting and issuance of this Policy are true, accurate and are not misleading, and that the Underwriters issued this Policy, and assume the risks hereunder, in reliance upon the truth thereof.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 101
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Page 31 of 31 ends

Named Insured as Agent

The Named Insured will be considered the agent of all Insureds, and will act on behalf of all Insureds with respect to the giving of or receipt of all notices pertaining to this Policy, and the acceptance of any endorsements to this Policy. The Named Insured is responsible for the payment of all premiums and Retentions and for receiving any return premiums.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 102
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 42 of 76 Page | 1

Cyber Insurance – Incident Response Directions

Hamilton Policy Reference: B1180D231573/009
Named Insured: CU Technology d.b.a. Acorn Technology Services Policy Period: Effective from Thu Jun 01 2023 to Sat Jun 01 2024 Both days at 12.01a.m. Local Standard Time

IMPORTANT INFORMATION

IN THE EVENT OF AN INCIDENT AFFECTING THIS POLICY YOU SHOULD

CONTACT HAMILTON’S 24/7 INCIDENT RESPONSE PARTNER

BATES CAREY LLP

+1 312 762 3256 or [email protected]

AND

QUOTE THE HAMILTON POLICY REFERENCE AND NAMED INSURED ABOVE

WHAT YOU SHOULD DO WHAT YOU SHOULD NOT DO

Contact Bates Carey LLP

Quote the Hamilton Policy Reference above

Quote the Named Insured above

State you hold a Hamilton policy

Cooperate fully with Bates Carey LLP

Ignore or do nothing

Contact another incident Response company

Negotiate with cyber criminals

Pay money to anyone

Contact another law firm

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 103
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 43 of 76

CONDITIONS SECTION
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 104
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 44 of 76
U.S. Terrorism Risk Insurance Act of 2002 as amended
New & Renewal Business Endorsement

This Endorsement is issued in accordance with the terms and conditions of the "U.S. Terrorism Risk Insurance Act of 2002" as amended, as summarized in the disclosure notice.

In consideration of an additional premium of USD 95.75 paid, it is hereby noted and agreed with effect from inception that the Terrorism exclusion to which this Insurance is subject, shall not apply to any “insured loss” directly resulting from any "act of terrorism" as defined in the "U.S. Terrorism Risk Insurance Act of 2002", as amended ("TRIA").

The coverage afforded by this Endorsement is only in respect of any “insured loss” of the type insured by this Insurance directly resulting from an "act of terrorism" as defined in TRIA. The coverage provided by this Endorsement shall expire at 12:00 midnight December 31, 2027, the date on which the TRIA Program is scheduled to terminate, or the expiry date of the policy whichever occurs first, and sha ll not cover any losses or events which arise after the earlier of these dates. The Terrorism exclusion, to which this Insurance is subject, applies in full force and effect to any other losses and any act or events that are not included in said definition of "act of terrorism".

This Endorsement only affects the Terrorism exclusion to which this Insurance is subject. All other terms, conditions, insured coverage and exclusions of this Insurance including applicable limits and deductibles remain unchanged and apply in full force and effect to the coverage provided by this Insurance.

Furthermore the Underwriter(s) will not be liable for any amounts for which they are not responsible under the terms of TRIA (including subsequent action of Congress pursuant to the Act) due to the application of any clause which results in a cap on the Underwriter’s liability for payment for terrorism losses.

LMA5389
09 January 2020

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 105

D231573009
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 45 of 76
LLOYD'S CCPA PRIVACY POLICY1

UNDERWRITERS AT LLOYD'S, LONDON
This CCPA Privacy Policy explains how Certain Underwriters at Lloyd's, London (“we” or “us”) collect, use, and disclose personal information subject to the California Consumer Privacy Act (“CCPA”). “Personal information” is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident (“consumer”) or household. This CCPA Privacy Policy also describes the privacy rights of California consumers and how they can exercise those rights.

The CCPA does not apply to certain types of information, such as information subject to the Gramm - Leach-Bliley Act (“GLBA”) or the Fair Credit Reporting Act (“FCRA”). This means that this CCPA Privacy Policy may not apply to personal information that we collect about individuals who seek, apply for, or obtain insurance products or services for personal, family, or household purposes. The CCPA also has limited application to personal information we collect in connection with providing a product or service to a business.

PERSONAL INFORMATION WE COLLECT
We collect, and in the past 12 months have collected, the categories of personal information described below from the sources described below. Some of this personal information may be subject to GLBA or FCRA.

Directly From You
We collect, and in the past 12 months have collected, the following categories of personal information about you that you include in your application or other forms that you submit, or that you otherwise provide to us:
• [Personal identifiers, such as name, postal address, email address, Social Security number, policy number, account number, driver’s license number, or passport number • Customer records information, such as bank account number, credit or debit card number, other financial information, phone number, health insurance information, or medical history • Protected information, such as race, religion, sexual orientation, gender, age, or marital status • Commercial information, such as records of personal property and insurance products or services purchased or obtained, purchasing or consuming histories, or transaction or account information
• Professional or employment related information, such as work history • Education information, such as school and date of graduation] 2

From Our Affiliates and Third Parties
We collect the following categories of personal information about you from our affiliates and other third parties, such as agents, brokers, consumer reporting agencies, or loss adjusters:
• [Personal identifiers, such as name, postal address, email address, Social Security number, policy number, account number, driver’s license number, or passport number • Customer records information, such as bank account number, credit or debit card number, other financial information, phone number, health insurance information, or medical history • Protected information, such as race, religion, sexual orientation, gender, age, or marital status DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 106

D231573009
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 46 of 76
• Commercial information, such as records of personal property and insurance products or services purchased or obtained, purchasing or consuming histories, or transaction or account information
• Professional or employment related information, such as work history • Education information, such as school and date of graduation] 3

We may also draw inferences from the personal information we collect directly from you or from our affiliates and third parties.

HOW WE USE PERSONAL INFORMATION
The purposes for which we use personal information depend on our relationship or interaction with a specific California consumer. We may use, and in the past 12 months have used, personal information to underwrite your insurance policy and evaluate claims under your policy; to operate and manage our business; to provide and maintain our insurance products and services; to verify your identity; to detect and prevent fraud; for vendor management purposes; to operate, manage, and maintain our business, such as developing and marketing our products and services; to conduct research and data analysis; to comply with applicable laws; to respond to civil, criminal, or regulatory lawsuits or investigations; to exercise our rights or defend against legal claims; to resolve complaints and disputes; to perform compliance activities; and to perform institutional risk control.

PERSONAL INFORMATION WE DISCLOSE
We disclose, and in the past 12 months have disclosed, the categories of personal information described in “Personal Information We Collect” for the purposes described in “How We Use Personal Information” to the following categories of third parties: 4 • Affiliates
• Agents
• Brokers
• Service providers, such as loss adjusters, fraud prevention services, and software provider s • Regulatory and law enforcement agencies
• Attorneys, auditors, and other business partners
In the past 12 months, we did not sell personal information, as the term “sell” is defined under the CCPA.

YOUR RIGHTS
You may have certain rights under the CCPA. These rights are subject to certain conditions and exceptions. Your rights under the CCPA may include: 5
• Right to Request to Know. You have the right to request to know the following information about our practices over the past 12 months: (i) the categories of personal information we collected about you; (ii) the categories of sources from which we collected the personal information about you; (iii) the categories of third parties with whom we shared personal information, (iv) the categories of personal information we sold or disclosed about you and the categories of third parties to whom we sold or disclosed that particular category of personal information; (v) our business or commercial purpose for collecting or selling your personal information; and (vi) the specific pieces of personal information we collected about you.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 107

D231573009
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 47 of 76
You may exercise your right to request to know twice a year, free of charge. If we are unable to fulfil your request to know, we will let you know the reason why. Please note, in response to a request to know, we are prohibited from disclosing your Social Security number; driver’s license number or other government-issued identification number; financial account number; any health insurance or medical identification number; an account password, security questions, or answers; and unique biometric data generated from measurements or technical analysis of human characteristics.
• Right to Request to Delete. You have the right to request that we delete the personal information that we have collected from you. We may deny your request under certain circumstances, such as if we need to retain your personal information to comply with our legal obligations or if retaining the information is necessary to complete a transaction for which your personal information was collected. If we deny your request to delete, we will let you know the reason why.
• Right to Non-Discrimination. If you choose to exercise any of these rights, we will not discriminate against you in any way.

If you, or your authorized agent, would like to make a request to know or request to delete, contact us at [toll-free number]6 or email your agent or broker who handled this insurance at the email address under “Contact Us” below.

We will take steps to verify your identity before processing your request to know or request to delete.

We will not fulfil your request unless you have provided sufficient information for us to reasonably verify that you are the individual about whom we collected personal information. We may request additional information about you so that we can verify your identity. We will only use additional personal information you provide to verify your identity and to process your request.

You may use an authorized agent to submit a request to know or a request to delete. When we verify your agent’s request, we may verify both your and your agent’s identity and request a signed document from you that authorizes your agent to make the request on your behalf. To protec t your personal information, we reserve the right to deny a request from an agent that does not submit proof that they have been authorized by you to act on your behalf. You may also make a consumer request on behalf of your minor child.

UPDATES TO PRIVACY NOTICE
We may change or update this CCPA Privacy Policy from time to time. If we make material changes to this CCPA Privacy Policy, we will provide you with an updated copy of the policy.

CONTACTING US
If you have any questions or concerns about this CCPA Privacy Policy or would like to learn more about how we protect your privacy, please contact the agent or broker through whom you purchased this insurance policy at [response].

Effective Date: Thu Jun 01 2023
LMA 9191
18 September 2020

1 This privacy policy does not cover agents of the Underwriters or visitors to the Underwriters’ websites. If the Underwriters are selling personal information of agents and coverholders, or they have a website, they will need a separate policy for these individuals.
2 The categories of personal information under the CCPA that are most likely being collected have been listed. The categories of personal information we did not include are biometric information; geolocation information; internet or other electronic network activity; or audio, electronic, visual, or olfactory information since it seemed unlikely that the Underwriters are collecting this DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 108

D231573009
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 48 of 76
information. This section should be customized so that categories or types of personal information not being collected are deleted. If a specific type of personal information is collected that is not included, that specific piece of personal information should be added to the relevant category.
3 The categories of personal information under the CCPA that are most likely being collected have been listed. The categories of personal information we did not include are biometric information; geolocation information; internet or other electronic network activity; or audio, electronic, visual, or olfactory information since it seemed unlikely that the Underwriters are collecting this information. This section should be customized so that categories or types of personal information not being collected are deleted. If a specific type of personal information is collected that is not included, that specific piece of personal information should be added to the relevant category.
4 Underwriters should confirm this section is accurate as to the parties with whom personal information is shared. 5 It has been assumed that the Underwriters are not selling consumers’ personal information and the right to opt-out of the sale of personal information has therefore not been included. If personal information is being sold, this notice will need to be amended/updated.
6 CCPA requires that insurers provide a toll free contact number, for consumers to make requests. This is an obligation that Underwriters will need to rely on their coverholders for, so this should be provided /completed by the coverholder. It is not required that the toll-free number be answered by a live individual.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 109
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 49 of 76

PREMIUM PAYMENT WARRANTY

IT IS WARRANTED that all Premiums due to the London Intermediary under this Policy are paid within 60 days from Inception.

Non-receipt by the London Intermediary of such premiums by Midnight on the Premium Due date shall render this Insurance Policy void with effect from Inception.

11/93

LSW585 (amended)

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 110
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 50 of 76
SMALL ADDITIONAL OR RETURN PREMIUMS CLAUSE (U.S.A.)
NOTWITHSTANDING anything to the contrary contained herein and in consideration of the premium for which this Insurance is written, it is understood and agreed that whenever an additional or return premium of $50 or less becomes due from or to the Assured on account of the adjustment of a deposit premium, or of an alteration in coverage or rate during the term or for any other reason, the collection of such premium from the Assured will be waived or the ret urn of such premium to the Assured will not be made, as the case may be.

NMA1168 (amended)

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 111
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 51 of 76
SERVICE OF SUIT CLAUSE (U.S.A.)
It is agreed that in the event of the failure of the Underwriters hereon to pay any amount claimed to be due hereunder, the Underwriters hereon, at the request of the Insured (or Reinsured), will submit to the jurisdiction of a Court of competent jurisdiction within the United States. Nothing in this Clause constitutes or should be understood to constitute a waiver of Underwriters' rights to commence an action in any Court of competent jurisdiction in the United States, to remove an action to a United Stat es District Court, or to seek a transfer of a case to another Court as permitted by the laws of the United States or of any State in the United States.

It is further agreed that service of process in such suit may be made upon

Lloyd's America Inc.,
Attention: Legal Department,
280 Park Avenue, East Tower, 25th Floor,
New York, NY 10017

and that in any suit instituted against any one of them upon this contract, Underwriters will abide by the final decision of such Court or of any Appellate Court in the event of an appeal.

The above-named are authorized and directed to accept service of pr ocess on behalf of Underwriters in any such suit and/or upon the request of the Insured (or Reinsured) to give a written undertaking to the Insured (or Reinsured) that they will enter a general appearance upon Underwriters' behalf in the event such a suit shall be instituted.

Further, pursuant to any statute of any state, territory or district of the United States which makes provision therefor, Underwriters hereon hereby designate the Superintendent, Commissioner or Director of Insurance or other officer specified for that purpose in the statute, or his successor or successors in office, as their true and lawful attorney upon whom may be served any lawful process in any action, suit or proceeding instituted by or on behalf of the Insured (or Reinsured) or any beneficiary hereunder arising out of this contract of insurance (or reinsurance), and hereby designate the above-named as the person to whom the said officer is authorized to mail such process or a true copy thereof.

NMA1998

24/04/1986
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 112
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 52 of 76 Page 1 of 1

CHOICE OF LAW AND SERVICE OF SUIT

In consideration of the premium charged for the Policy, it is hereby understood and agreed that GENERAL CONDITIONS is amended to include:

Service of Suit
It is agreed that in the event of the Underwriters’ failure to pay any amount claimed to be due under this Policy, the Underwriters will, at the Insured’s request, submit to the jurisdiction of a court of competent jurisdiction within the United States. No thing in this provision constitutes or should be understood to constitute a waiver of the Underwriters’ rights to commence an action in any court of competent jurisdiction in the United States, to remove an action to a United States District Court, or seek a transfer of a case to another court as permitted by the laws of the United States or any state in the United States. It is further agreed that service of processing such suit may be made upon the Underwriters’ representative:

Lloyd's America Inc.,
Attention: Legal Department,
280 Park Avenue, East Tower, 25th Floor,
New York, NY 10017

and that in any suit instituted against any one of them upon this contract, the Underwriters will abide by the final decision of such court or of any appellate court in the event of an appeal.

The person or entity named above is authorized and directed to accept service of process on the Underwriters’ behalf in any such suit and/or upon the Insured’s request to give a written undertaking to the Insured that they will enter a general appearance upon the Underwriters’ behalf in the event such a suit shall be instituted.

Pursuant to any statute of any state, territory, or district of the United States which makes provision therefore, the Underwriters hereby designate the Superintendent, Commissioner, or Director of Insurance or other officer specified for that purpose in the statute, or his successor in office, as their true and lawful attorney upon whom may be served any lawful process in any action, suit, or proceeding instituted by or on the Insured’s behalf or any beneficiary hereunder arising out of this Policy, and hereby designate the person or entity named above as the persons to whom said officer is authorized to mail such process or a true copy thereof.

Choice of Law

Any disputes involving this Policy will be resolved applying the law of the state of New York.

All other terms and conditions of this Policy remain unchanged.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 113
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 53 of 76 Page 1 of 1

COMPUTER HARDWARE REPLACEMENT COST

This endorsement modifies insurance provided under the following:

Hamilton Technology, Cyber and Media Policy Wording

In consideration of the premium charged for the Policy, it is hereby understood and agreed that:

1. The definition of Extra Expense is deleted in its entirety and replaced with the following:

Extra Expense means reasonable and necessary expenses incurred by the Insured Organization during the Period of Restoration to minimize, reduce or avoid Income Loss, over and above those expenses the Insured Organization would have incurred had no Security Breach , System Failure or Dependent Security Breach occurred; and includes reasonable and necessary expenses incurred by the Insured Organization to replace computers or any associated devices or equipment operated by, and either owned by or leased to, the Insured Organization that are unable to function as intended due to corruption or destruction of software or firmware directly resulting from a Security Breach, provided however that the maximum sublimit applicable to Extra Expense incurred to replace such devices or equipment is USD $100,000.

2. Part 2. of the Bodily Injury or Property Damage exclusion is deleted in its entirety and replaced with the following:

2. physical injury to or destruction of any tangible property, including the loss of use thereof; but this will not apply to the loss of use of computers or any associated devices or equipment operated by, and either owned by or leased to, the Insured Organization that are unable to function as intended due to corruption or destruction of software or firmware directly resulting from a Security Breach . Electronic data shall not be considered tangible property;

All other terms and conditions of this Policy remain unchanged.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 114
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 54 of 76 Page 1 of 1

CRISIS MANAGEMENT EXPENSE COVERAGE

This endorsement modifies insurance provided under the following:

Hamilton Technology, Cyber and Media Policy Wording
In consideration of the premium charged for the Policy, it is hereby understood and agreed that:

1. The Limits listed in the Declarations under COVERAGE SCHEDULE are amended to include:

Crisis Management Expenses: $1,000,000

2. INSURING AGREEMENTS is amended to include the following:

To indemnify the Named Insured for 100% of the costs of a public relations consultancy incurred by the Insured Organization with Underwriters’ prior written consent, for the purpose of averting or mitigating material damage to the Insured Organization’s reputation that results or reasonably will result from a Claim covered under by the Policy and publicized through any media channel (“Crisis Management Expenses”); provided, this coverage shall only apply when covered Damages other than (crisis management expenses) exceeds the applicable Retention.

3. The definition of Damages is amended to include Crisis Management Expenses.

All other terms and conditions of this Policy remain unchanged.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 115
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 55 of 76 Page 1 of 1

CRYPTOJACKING ENDORSEMENT

This endorsement modifies insurance provided under the following:

Hamilton Technology, Cyber and Media Policy Wording

In consideration of the premium charged for the Policy, it is hereby understood and agreed that:

1. The aggregate sublimit applicable to all loss under this endorsement is USD $100,000.

2. The Retention applicable to each incident, event, or related incidents or events, giving rise to an obligation to pay loss under this endorsement shall be USD $2,500.

3. INSURING AGREEMENTS is amended to include:

Cryptojacking

To indemnify the Insured Organization for any direct financial loss sustained resulting from Cryptojacking that the Insured first discovers during the Policy Period.

4. DEFINITIONS is amended to include:

Cryptojacking means the Unauthorized Access or Use of Computer Systems to mine for Digital Currency that directly results in additional costs incurred by the Insured Organization for electricity, natural gas, oil, or internet (the “Utilities”); provided, however, that such additional costs for the Utilities are:

1. incurred pursuant to a written contract between the Insured Organization and the respective utility provider, which was executed before the Cryptojacking first occurred;

2. billed to the Insured Organization by statements issued by the respective utility provider, which include usage or consumption information;

3. not charged to the Insured Organization at a flat fee that does not scale with the rate or use of the respective utility; and

4. incurred pursuant to statements issued by the respective utility provider and due for payment during the Policy Period.

All other terms and conditions of this Policy remain unchanged.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 116
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 56 of 76 Page 1 of 1

EMPLOYEE DEVICE ENDORSEMENT
This endorsement modifies insurance provided under the following:

Hamilton Technology, Cyber and Media Policy Wording
In consideration of the premium charged for the Policy, it is hereby understood and agreed that the definition of Computer Systems is amended to include computers, any software residing on such computers and any associated devices or equipment (including b ut not limited to wireless or mobile devices), operated by any person listed in parts 2., 3. or 4. of the Insured definition, but only for work done while acting within the scope of his or her employment and related to the conduct of the Insured Organization’s business.

All other terms and conditions of this Policy remain unchanged.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 117
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 57 of 76 Page 1 of 1

GDPR CYBER ENDORSEMENT

This endorsement modifies insurance provided under the following:

Hamilton Technology, Cyber and Media Policy Wording

In consideration of the premium charged for the Policy, it is hereby understood and agreed that the definition of Data & Network Wrongful Act is amended to include the following:

5. non-compliance with the following obligations under the EU General Data Protection Regulation:

(i) Article 5.1(f), also known as the Security Principle;

(ii) Article 32, Security of Processing;

(iii) Article 33, Communication of a Personal Data Breach to the Supervisory Authority; or

(iv) Article 34, Communication of a Personal Data Breach to the Data Subject.

All other terms and conditions of this Policy remain unchanged.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 118
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 58 of 76
Data Privacy Notice

This privacy notice is provided by Hamilton Insurance DAC and its London Branch. These firms are collectively referred to as Hamilton, we, our and us throughout this notice. Details on each legal entity is contained within the Companies section below.

Your Personal Information

Hamilton is committed to respecting your privacy and
that of the information you provide to us in our
business with you. This data privacy notice seeks to
provide you with information about how and why we
will use your personal data. We keep our data privacy
notice under regular review.

When we ask you for your personal data, we will
explain why we need it. Reasons we may require your
personal data include:

• To perform the contract we have entered into
with you.
• To meet our legal obligations.
• For our legitimate interests, where these do
not compromise your interests, rights and
freedoms.

If we are not being sufficiently clear in our explanation, we invite you to tell us. Where we are required to seek your specific consent to process your personal data we
will explain what we are asking you to agree and why.

In this situation, you have the choice as to whether to give your consent or not. If you do give consent, you
may withdraw it at a later date. Where we require your
consent but you choose to withhold or withdraw it, we
may not be able to perform the contract we have
entered into with you.

When you provide us with your personal data, we will
use it only for the purpose you have provided it. We
respect your privacy and will protect your data from
unintended use in the same way that we protect our
own confidential information. We may disclose your
personal data in the following circumstances:

• Where we are required to do so by law or
regulation.
• To other companies within Hamilton
• Insurance Group to facilitate the effective
management of the group of companies.

We will keep your personal data only for so long as is
necessary for the purpose it was provided and
otherwise in accordance with legal and regulatory
requirements. If you would like further information
regarding the periods for which your personal
information will be stored, please contact us using the details contained within the Contact us section below
Policyholders, Insureds and Claimants Insurance
involves the use and disclosure of your personal data
by various insurance market participants such as
intermediaries, insurers and reinsurers. Our core uses
and disclosures are consistent with the London Market
Core Uses Information Notice (see
londonmarketgroup.Co.Uk/gdpr). We recommend you
review this notice.

Business Partners
We have a legitimate interest in data required to
facilitate the business arrangement between us
and for normal exchanges in the course of business.

We may also lawfully process your information to
perform the contract agreed between us. Unless you
have signed up to receive news updates, we will not
send this information to you. You may withdraw your
consent to receiving news by using the options in the
communication sent to you or by contacting us using
the details contained within the Contact us section
below.

Prospective Employees
We have a legitimate interest in data required to make
contact with you. We may lawfully process data
required for pre-employment activities and have a legal obligation to undertake certain checks.

Website Users
When you visit our website (hamiltongroup.com), your
internet browser may provide us with some of your
personal information, including:
• The time and date you access our website.
• Information about your software and your
internet protocol address (ip address).
• Your location.
• The pages you visited.

We use this information to improve the delivery of
relevant information to you.

We may also leave a cookie on your internet browser.

Hamilton’s cookies policy can be found at
hamiltongroup.com/cookies-policy.

Data Sharing
We may share your personal data with other
companies within the Hamilton Insurance Group, some
of whom are based outside of the European Union.

To fulfil the need for which you have provided us with
your personal data, we may share your data with

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 119
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 59 of 76
companies based outside of the European Union. Not
all countries of the world have data protection
standards that are the equivalent of those in Ireland.

Where we share your personal data with companies
that are based outside of the European Union, we will
make sure that your information is protected to an
equivalent standard by, for example:

• Contracting with the receiving company with
clauses approved by the European Union
authorities as providing adequate protection or
through the use of Binding Corporate Rules.
• Sharing the data with companies in countries
considered by the European Commission as
having suitably high standards of data
protection legislation. A list of these countries
can be found on the European Union website
at ec.europa.eu/info/law/law-topic/data-
protection.
• Sharing the data with companies that have
committed to adequate levels of protection
through participation in schemes such as the
Privacy Shield agreed between the data
protection authorities of the European Union
and United States.

Website Users
The website hamiltongroup.com is hosted outside of
the European Union by a third party. Your Rights In
relation to your personal data, you may have the right
to require us to:

• Give further details of the use we make of your
personal data
• Give you a copy of your personal data that we
have, including in a structured and commonly
used format.
• Correct any incorrect personal data that we
have.
• Delete any personal data that we have no
lawful basis to hold.

Where our processing is based on consent, you may
withdraw your consent at any time. You may also
object to our processing of your personal data. If you
would like to exercise your rights in relation to your
personal data, you should contact us using the details
contained within the Contact us section below. We will
not charge you for exercising your rights, though if
your request for access to your personal information is clearly unfounded or excessive we are permitted to
charge a reasonable fee or refuse to comply with the
request.

Where we require your consent to process your data
but you choose to withhold or withdraw it, we may not
be able to perform the contract we have entered into
with you. Contact Us If you have any questions in
relation to this privacy notice or otherwise how
Hamilton processes personal data, including requests
to exercise a data subject’s legal rights, please contact the Data Protection Manager using the details below.
+353 (0) 1232 1900, 2 Shelbourne Buildings,
Crampton Avenue, Ballsbridge, Dublin 4, Ireland.

[email protected]

Complaint Should you believe we have failed to
process your personal information appropriately, you
are invited to discuss the matter with Hamilton. Our
contact details are at the Contact us section above.

You may at any time lodge a complaint with either the
Data Protection Commission (DPC) at 21 Fitzwilliam
Square South, Dublin 2, D02 RD28, Ireland +353
(0)761 104 800 https://www.dataprotection.ie/ or the
Information Commissioner’s Office (ICO), Wycliffe
House, Water Lane, Wilmslow Cheshire, SK9 5AF,
United Kingdom 0303 123 1113 or +44 (0) 162 554
5700 www.ico.org.uk
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 120
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 60 of 76 Page 1 of 1

INVOICE MANIPULATION COVERAGE

This endorsement modifies insurance provided under the following:

Hamilton Technology, Cyber and Media Policy Wording

In consideration of the premium charged for the Policy, it is hereby understood and agreed that:

1. The aggregate sublimit applicable to all loss under this endorsement is USD $100,000.

2. The Retention applicable to each incident, event, or related incidents or events, giving rise to an obligation to pay loss under this endorsement shall be USD $2,500.

3. INSURING AGREEMENTS is amended to include:

Invoice Manipulation

To indemnify the Insured Organization for Direct Net Loss resulting directly from the Insured Organization’s inability to collect Payment for any goods, products or services after such goods, products or services have been transferred to a third party, as a result of Invoice Manipulation that the Insured first discovers during the Policy Period:

4. DEFINITIONS is amended to include:

Direct Ne t Loss means the direct net cost to the Insured Organization to provide goods, products or services to a third party. Direct Net Loss will not include any profit to the Insured Organization as a result of providing such goods, products or services.

Invoice Manipulation means the release or distribution of any fraudulent invoice or fraudulent payment instruction to a third party as a direct result of a Security Breach or a Data Breach.

Payment means currency, coins or bank notes in current use and having a face value.

All other terms and conditions of this Policy remain unchanged.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 121

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 61 of 76 Page 1 of 3

REPUTATION LOSS

This endorsement modifies insurance provided under the following:

Hamilton Technology, Cyber and Media Policy Wording

In consideration of the premium charged for the Policy, it is hereby understood and agreed that:

1. Limit listed in the Declarations under COVERAGE SCHEDULE is amended to include:

Reputation Loss: USD $1,000,000

2. Retention listed in the Declarations under COVERAGE SCHEDULE is amended to include: Each incident giving rise to Reputation Loss: USD $2,500

3. INSURING AGREEMENTS is amended by the addition of:

Reputation Loss

To indemnify the Insured Organization for Reputation Loss that the Insured Organization sustains solely as a result of an Adverse Media Event that occurs during the Policy Period, concerning:

1. a Data Breach, Security Breach, or Extortion Threat that the Insured first discovers during the Policy Period; or

2. if this policy is a Renewal, a Data Breach, Security Breach, or Extortion Threat that the Insured first discovers during the last 90 days of the prior policy period.

4. DEFINITIONS is amended to include:

Adverse Media Event means:

1. publication by a third party via any medium, including but not limited to television, print, radio, electronic, or digital form of previously non -public information specifically concerning a Data Breach, Security Breach , or Extortion Threat; or

2. notification of individuals pursuant to part 4. of the Breach Response Costs definition.

Multiple Adverse Media Events arising from the same or a series of related, repeated or continuing Data Breaches, Security Breaches, or Extortion Threats , shall be considered a single Adverse Media Event, and shall be deemed to occur at the time of the first such Adverse Media Event.

Claims Preparation Costs means reasonable and necessary costs that the Named Insured incurs to contract with a third party to prepare a proof of loss demonstrating Reputational Loss.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 122
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 62 of 76 Page 2 of 3 Protection Period means the period beginning on the date the Adverse Media Event occurs, and ends after the earlier of:

1. 180 days; or

2. the date that gross revenues are restored to the level they would have been but for the Adverse Media Event.

Renewal means an insurance policy issued by the Underwriters to the Named Insured for the policy period immediately preceding this Policy Period that provides coverage for a Data Breach, Security Breach, or Extortion Threat otherwise covered under this Policy.

Reputation Loss means:

1. the net profit or loss before interest and tax that the Insured Organization would have earned during the Protection Period but for an Adverse Media Event; and

When calculating any Reputation Loss, due consideration will be given to any amounts made up during, or within a reasonable time after the end of, the Protection Period.

Reputation Loss will not mean and no coverage will be available under this endorsement for any of the following:

(i) loss arising out of any liability to any third party;

(ii) legal costs or legal expenses of any type;

(iii) loss incurred as a result of unfavorable business conditions;

(iv) loss of market or any other consequential loss;

(v) Breach Response Costs; or

(vi) Cyber Extortion Loss;

There will be no coverage available under this endorsement if there is an actual interruption of the Insured Organization’s business operations for any period of time.

5. Limits of Liability under LIMIT OF LIABILITY AND COVERAGE is amended to include:

Reputational Loss and Claims Preparation Costs covered under this Policy arising from an Adverse Media Event concerning any Data Breach, Security Breach, or Extortion Threat (including a series of related, repeated or continuing Data Breaches, Security Breaches, or Extortion Threats) first discovered during the last 90 days of the prior policy period, will be considered to have been noticed to the Underwriters during the prior policy period and will be subject to the Policy Aggregate Limit of Liability of the prior policy period. Under such circumstances, if the Policy Aggregate Limit of Liability of the prior policy period is exhausted due to payments made under the prior policy, the Underwriter’s obligation to pay Reputational Loss or Claims Preparation Costs under this Policy shall be completely fulfilled and extinguished.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 123
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 63 of 76 Page 3 of 3

6. Notice of Claim or Loss under GENERAL CONDITIONS is amended to include:

With respect to Reputation Loss, the Named Insured must notify the Underwriters through the contacts listed for Notice of Claim, Loss or Circumstance in the Declarations as soon as practicable after discovery of the circumstance, incident or event giving rise to such loss.

All Reputation Loss must be reported, and all proofs of loss must be provided, to the Underwriters no later than four (4) months after the end of the Protection Period.

7. This Policy will cover up to USD 50,000 of Claims Preparation Costs in excess of the Retention stated in Section 2. of this endorsement.

All other terms and conditions of this Policy remain unchanged.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 124
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 64 of 76 Page 1 of 1

STATE CONSUMER PRIVACY STATUTES ENDORSEMENT
This endorsement modifies insurance provided under the following:

Hamilton Technology, Cyber and Media Policy Wording

In consideration of the premium charged for the Policy, it is hereby understood and agreed that:

1. The Policy is amended to include the following insuring agreement:

State Consumer Privacy Statutes

To pay Penalties and Claims Expenses which the Insured is legally obligated to pay because of any Regulatory Proceeding first made against any Insured during the Policy Period for a violation of the California Consumer Privacy Act or any similar state statutes or state regulations specifically governing the Insured Organization’s collection, use, disclosure, sale, processing, profiling, acquisition, sharing, maintenance, retention or storage of or provision of access to personal information or personal data as defined under the California Consumer Privacy Act o r similar state statutes or state regulations.

2. The definition of Claim is amended to include institution of a Regulatory Proceeding against any Insured under the State Consumer Privacy Statutes insuring agreement for a violation of the California Consumer Privacy Act or any similar state statutes or state regulations specifically governing the Insured Organization’s collection, use, disclosure, sale, processing, profiling, acquisition, sharing, maintenance, retention or storage of or provision of access to personal information or personal data as defined under the California Consumer Privacy Act or similar state statutes or state regulations.

3. The Governmental Actions exclusion will not apply to the State Consumer Privacy Statutes insuring agreement.

4. Solely with respect to the State Consumer Privacy Statutes insuring agreement, the Deceptive Business Practices, Antitrust & Consumer Protection exclusion is deleted in its entirety and replaced with the following:

Deceptive Business Practices and Consumer Protection

any actual or alleged false, deceptive or unfair trade practices, unfair competition, or violation of consumer protection law; but this exclusion will not apply to coverage under the State Consumer Privacy Statutes insuring agreement, provided no member of the Control Group participated in or colluded in the activities or incidents giving rise to coverage under such insuring agreement;

Antitrust

any actual or alleged antitrust violation, restraint of trade, false, deceptive or misleading advertising, violation of the Sherman Antitrust Act, the Clayton Act, or the Robinson-Patman Act, or inaccurate cost estimates or failure of goods or services to conform with any represented quality or performance;

All other terms and conditions of this Policy remain unchanged.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 125
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 65 of 76 Page 1 of 1

VOLUNTARY SHUTDOWN COVERAGE
This endorsement modifies insurance provided under the following:

Hamilton Technology, Cyber and Media Policy Wording

In consideration of the premium charged for the Policy, it is hereby understood and agreed that the definition of Security Breach is deleted in its entirety and replaced with the following:

Security Breach means:

1. A failure of computer security to prevent:

(i) Unauthorized Access or Use of Computer Systems, including Unauthorized Access or Use resulting from the theft of a password from a Computer System or from any Insured;

(ii) a denial of service attack affecting Computer Systems;

(iii) with respect to coverage under parts 3. and 4. of the Media, Tech, Data & Network Liability insuring agreement, the Regulatory Defense & Penalties insuring agreement, and the Payment Card Liabilities & Costs insuring agreement, a denial of service attack affecting computer systems that are not owned, operated or controlled by an Insured; or

(iv) infection of Computer Systems by malicious code or transmission of malicious code from Computer Systems; or

2. Solely with respect to the Business Interruption insuring agreement:

(i) the voluntary and intentional shutdown of Computer Systems by the Insured Organization, but only to the extent necessary to limit the Loss during an active or on - going Unauthorized Access or Use of Computer Systems or infection of Computer Systems by malicious code, as covered by 1.(i) or 1.(iv) above; or

(ii) the intentional shutdown of Computer Systems by the Insured Organization as expressly required by any federal, state, local or foreign governmental entity in such entity’s regulatory or official capacity resulting from a situation described in 1.(i) or 1.(iv) above.

All other terms and conditions of this Policy remain unchanged.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 126
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 66 of 76

EXCLUSIONS SECTION
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 127
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 67 of 76

SANCTION LIMITATION AND EXCLUSION CLAUSE

No (re)insurer shall be deemed to provide cover and no (re)insurer shall be liable to pay any claim or provide any benefit hereunder to the extent that the provision of such cover, payment of such claim or provision of such benefit would expose that (re)insurer to any sanction, prohibition or restriction under United Nations resolutions or the trade or economic sanctions, laws or regulations of the European Union, United Kingdom or United States of America.

LMA3100
15 September 2010
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 128
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services LMA5567A (amended 2023)
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 68 of 76

War and Cyber Operations Exclusion No.4
(For use on commercial cyber insurance contracts)

If there is a conflict between any provision in this policy and this Endorsement, the terms of this Endorsement will prevail.

1. Notwithstanding any provision to the contrary in this insurance, this insurance does not cover that part of any loss, damage, cost, or expense, of any kind:

1.1 directly or indirectly arising from war, and/or

1.2 arising from a cyber operation that is carried out as part of a war, or the immediate preparation for a war, and/or

1.3 arising from a cyber operation that causes a state to become an impacted state.

Paragraph 1.3 shall also apply to exclude the direct or indirect effect of a cyber operation on a computer system used by an insured or its third party service provider that is not physically located in the impacted state.

Attribution of a cyber operation to a state

2. Notwithstanding the insurer’s burden of proof, which shall remain unchanged by this clause, in determining attribution of a cyber operation to a state, the insured and insurer will consider such objectively reasonable evidence that is available to them. This may include formal or official attribution by the government of the state in which the computer system affected by the cyber operation is physically located to another state or those acting at such other state’s direction or under its control.

3. The parties shall attempt in good faith to resolve any dispute arising out of or relating to the determination of attribution to this exclusion promptly by negotiation. Should the parties be not able to resolve the issue of attribution within thirty (30) days of the issue being raised in writing, either party may submit the dispute for a binding decision from a competent and disinterested umpire with the relevant knowledge and experience in international law matters to determine the attribution of a state backed cyber-attack to one or more states.

All applicable statutes of limitations and defences based upon the passage of time shall be tolled, or a standstill agreement shall be agreed by the parties, until the attribution issue is determined. The parties will take such action, if any, required to effectuate such tolling or standstill agreement.

The parties agree that no suit will be filed by either party against the other party seeking resolution of any dispute arising out of or relating to this exclusion no sooner than thirty (30) days after the conclusion of a binding decision from a competent and disinterested umpire, or the parties have otherwise resolved the attribution issue if sooner.

Definitions

4. Computer system means any computer, hardware, software, communications system, electronic device, server, cloud infrastructure or microcontrol ler including any similar system or any configuration of the aforementioned and including any associated input, output, data storage device, networking equipment or back up facility. If there is any inconsistency between definitions of computer system in this exclusion and the contract of insurance, the definition in the contract of insurance shall apply.

5. Cyber operation means the use of a computer system by, at the direction of, or under control of a state to:

5.1. disrupt, deny access to, or degrade functionality of a computer system, and/or

5.2 copy, remove, manipulate deny access to or destroy information in a computer system.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 129
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services LMA5567A (amended 2023)
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 69 of 76

6. Essential service means a service that is essential for the maintenance of vital functions of a state including, but not limited to, financial institutions and associated financial market infrastructure, health service or utility services.

7. Impacted state means any state where a cyber operation has a major detrimental impact on:

7.1 the functioning of that state due to disruption to the availability, integrity or delivery of an essential service in that state, and/or

7.2 the security or defence of that state.

8. State means sovereign state and any non-member observer state as classified by the United Nations.

9. War means armed conflict involving physical force:

9.1 by a state against another state, or

9.2 as part of a civil war, rebellion, revolution, insurrection, military action or usurpation of power, whether war be declared or not.

LMA5567A (amended)

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 130
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

NMA 1256 Nuclear Incident Exclusion Clause Liability Page 1 of 2 Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 70
of 76

NUCLEAR INCIDENT EXCLUSION CLAUSE-LIABILITY-DIRECT (BROAD) (U.S.A.) For attachment to insurances of the following classifications in the U.S.A., its Territories and Possessions, Puerto Rico and the Canal Zone:

Owners, Landlords and Tenants Liability, Contr actual Liability, Elevator Liability, Owners or Contractors (including railroad) Protective Liability, Manufacturers and Contractors Liability, Product Liability, Professional and Malpractice Liability, Storekeepers Liability, Garage Liability, Automobile Liability (including Massachusetts Motor Vehicle or Garage Liability),
not being insurances of the classifications to which the Nuclear Incident Exclusion Clause -Liability-Direct (Limited) applies.

This Policy* does not apply:

I. Under any Liability Coverage, to injury, sickness, disease, death or destruction:
(a) with respect to which an insured under the Policy is also an insured under a nuclear energy liability policy issued by Nuclear Energy Liability Insurance Association, Mutual Atomic Energy Liabilit y Underwriters or Nuclear Insurance Association of Canada, or would be an insured under any such policy but for its termination upon exhaustion of its limit of liability; or (b) resulting from the hazardous properties of nuclear material and with respect to which (1) any person or organization is required to maintain financial protection pursuant to the Atomic Energy Act of 1954, or any law amendatory thereof, or (2) the insured is, or had this Policy not been issued would be, entitled to indemnity from the United States of America, or any agency thereof, under any agreement entered into by the United States of America, or any agency thereof, with any person or organization.

II. Under any Medical Payments Coverage, or under any Supplementary Payments Provisi on relating to immediate medical or surgical relief, to expenses incurred with respect to bodily injury, sickness, disease or death resulting from the hazardous properties of nuclear material and arising out of the operation of a nuclear facility by any person or organization.

III. Under any Liability Coverage, to injury, sickness, disease, death or destruction resulting from the hazardous properties of nuclear material, if:
(a) the nuclear material (1) is at any nuclear facility owned by, or operated by or on behalf of, an insured or (2) has been discharged or dispersed therefrom;
(b) the nuclear material is contained in spent fuel or waste at any time possessed, handled, used, processed, stored, transported or disposed of by or on behalf of an insured; or (c) the injury, sickness, disease, death or destruction arises out of the furnishing by an insured of services, materials, parts or equipment in connection with the planning, construction, maintenance, operation or use of any nuclear facility, but if such facility is located within the United States of America, its territories or possessions or Canada, this exclusion (c) applies only to injury to or destruction of property at such nuclear facility.

IV. As used in this endorsement:

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 131
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

NMA 1256 Nuclear Incident Exclusion Clause Liability Page 2 of 2 Tue Jun 06 2023 @ 8:09:42 | 277157 |

Page 71 of 76 ends

"hazardous properties" include radioactive, toxic or explosive properties; "nuclear material" means source material, special nuclear material or by -product material; "source material", "special nuclear material", and "by-product material" have the meanings given them in the Atomic Energy Act 1954 or in any law amendatory thereof; "spent fuel" means any fuel element or fuel component, solid or liquid, which has been used or exposed to radiation in a nuclear reactor; "waste" means any waste material (1) containing by-product material and (2) resulting from the operation by any person or organization of any nuclear facility included within the definition of nuclear facility under paragraph (a) or (b) thereof; " nuclear facility" means:
(a) any nuclear reactor,
(b) any equipment or device designed or used for (1) separating the isotopes of uranium or plutonium, (2) processing or utilizing spent fuel, or (3) handling, processing or packaging waste,
(c) any equipment or device used for the processing, fabricating or alloying of special nuclear material if at any time the total amount of such material in the custody of the insured at the premises where such equipment or device is located consists of or contains more than 25 grams of plutonium or uranium 233 or any combination thereof, or more than 250 grams of uranium 235,
(d) any structure, basin, excavation, premises or place prepared or used for the storage or disposal of waste,
and includes the site on which any of the foregoing is located, all operations conducted on such site and all premises used for such operations; "nuclear reactor" means any apparatus designed or used to sustain nuclear fission in a self-supporting chain reaction or to contain a critical mass of fissionable material. With respect to injury to or destruction of property, the word "injury" or "destruction" includes all forms of radioactive contamination of property.

It is understood and agreed that, except as specifically provided in the foregoing to the contrary, this clause is subject to the terms, exclusions, conditions and limitations of the Policy to which it is attached. * NOTE: As respects policies which afford liability coverages and other forms of coverage in addition, the words underlined should be amended to designate the liability coverage to which this clause is to apply.
17/3/60
NMA1256
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 132
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 72 of 76
RADIOACTIVE CONTAMINATION EXCLUSION CLAUSE-LIABILITY-DIRECT (U.S.A.) For attachment (in addition to the appropriate Nuclear Incident Exclusion Clause-Liability-Direct) to liability insurances affording worldwide coverage.

In relation to liability arising outside the U.S.A., its Territories or Possessions, Puerto Rico or the Canal Zone, this Policy does not cover any liability of whatsoever nature directly or indirectly caused by or contributed to by or arising from ionising radiations or contamination by radioactivity from any nuclear fuel or from any nuclear waste from the combustion of nuclear fuel.

NMA 1477

13/02/1964
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 133
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 73 of 76 Page 1 of 1

ASBESTOS, POLLUTION, AND CONTAMINATION EXCLUSION ENDORSEMENT

This endorsement modifies insurance provided under the following:

Hamilton Technology, Cyber and Media Policy Wording

In consideration of the premium charged for the Policy, it is hereby understood and agreed that the coverage under this Policy will not apply to any Loss arising out of either in whole or in part, directly or indirectly arising out of or resulting from or in consequence of, or in any way involving:

1. asbestos, or any materials containing asbestos in whatever form or quantity;

2. the actual, potential, alleged or threatened formation, growth, presence, release or dispersal of any fungi, molds, spores or mycotox ins of any kind; any action taken by any party in response to the actual, potential, alleged or threatened formation, growth, presence, release or dispersal of fungi, molds, spores or mycotoxins of any kind, such action to include investigating, testing for, detection of, monitoring of, treating, remediating or removing such fungi, molds, spores or mycotoxins; and any governmental or regulatory order, requirement, directive, mandate or decree that any party take action in response to the actual, potential, alleged or threatened formation, growth, presence, release or dispersal of fungi, molds, spores or mycotoxins of any kind, such action to include investigating, testing for, detection of, monitoring of, treating, remediating or removing such fungi, molds, spores or mycotoxins;

The Underwriters will have no duty or obligation to defend any Insured with respect to any Claim or governmental or regulatory order, requirement, directive, mandate or decree which either in whole or in part, directly or indirectly, arises out of or results from or in consequence of, or in any way involves the actual, potential, alleged or threatened formation, growth, presence, release or dispersal of any fungi, molds, spores or mycotoxins of any kind;

3. the existence, emission or discharge of any electromagnetic field, electromagnetic radiation or electromagnetism that actually or allegedly affects the health, safety or condition of any person or the environment, or that affects the value, marketability, condition or use of any prope rty; or

4. the actual, alleged or threatened discharge, dispersal, release or escape of Pollutants; or any governmental, judicial or regulatory directive or request that the Insured or anyone acting under the direction or control of the Insured test for, monitor, clean up, remove, contain, treat, detoxify or neutralize Pollutants. Pollutants means any solid, liquid, gaseous or thermal irritant or contaminant including gas, acids, alkalis, chemicals, heat, smoke, vapor, soot, fumes or waste.

Waste includes but is not limited to materials to be recycled, reconditioned or reclaimed.

All other terms and conditions of this Policy remain unchanged.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 134
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 74 of 76

SEVERAL LIABILITY NOTICE
The subscribing insurers' obligations under contracts of insurance to which they subscribe are several and not joint and are limited solely to the extent of their individual subscriptions. The subscribing insurers are not responsible for the subscription of any co-subscribing insurer who for any reason does not satisfy all or part of its obligations. 08/94
LSW1001 (Insurance)

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 135
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 75 of 76

Attaching to and forming part of Certificate Number: B1180D231573/009 (100%)

SCHEDULE OF LLOYD’S UNDERWRITERS

Authority Ref. B1180D231573 : Hereon 100%

75.00000% 4000 HAM

25.00000% 2121 ARG

100.0000%

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 136
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 76 of 76

One Lime Street London EC3M 7HA

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 137

SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORE

THE EXPIRATION DATE THEREOF, NOTICE WILL BE DELIVERED IN ACCORDANCE WITH THE POLICY PROVISIONS.

INSURER(S) AFFORDING COVERAGE
INSURER F :

INSURER E :

INSURER D :

INSURER C :

INSURER B :

INSURER A :

NAIC #
NAME:

CONTACT
(A/C, No):

FAX
E-MAIL
ADDRESS:

PRODUCER
(A/C, No, Ext):

PHONE

INSURED
REVISION NUMBER:CERTIFICATE NUMBER:COVERAGES
IMPORTANT: If the certificate holder is an ADDITIONAL INSURED, the policy(ies) must have ADDITIONAL INSURED provisions or be endorsed.

THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THIS

OTHER:
(Per accident)
(Ea accident)
$
$
N / A
SUBR
WVD
ADDL
INSD

COMBINED SINGLE LIMIT

AUTOS ONLY

AUTOSAUTOS ONLY

NON-OWNED

SCHEDULEDOWNED

ANY AUTO

AUTOMOBILE LIABILITY
Y / N

WORKERS COMPENSATION

AND EMPLOYERS' LIABILITY
OFFICER/MEMBER EXCLUDED?
(Mandatory in NH)
DESCRIPTION OF OPERATIONS below
If yes, describe under

ANY PROPRIETOR/PARTNER/EXECUTIVE
$
$
$
E.L. DISEASE - POLICY LIMIT
E.L. DISEASE - EA EMPLOYEE
E.L. EACH ACCIDENT
ER
OTH-

STATUTE
PER

LIMITS(MM/DD/YYYY)

POLICY EXP
(MM/DD/YYYY)

POLICY EFF

POLICY NUMBERTYPE OF INSURANCELTR
INSR
DESCRIPTION OF OPERATIONS / LOCATIONS / VEHICLES (ACORD 101, Additional Remarks Schedule, may be attached if more space is required)

EXCESS LIAB
UMBRELLA LIAB $EACH OCCURRENCE
$AGGREGATE
$
OCCUR

CLAIMS-MADE
DED RETENTION $
$PRODUCTS - COMP/OP AGG
$GENERAL AGGREGATE
$PERSONAL & ADV INJURY
$MED EXP (Any one person)
$EACH OCCURRENCE

DAMAGE TO RENTED
$PREMISES (Ea occurrence)

COMMERCIAL GENERAL LIABILITY

CLAIMS-MADE OCCUR
GEN'L AGGREGATE LIMIT APPLIES PER:

POLICY PRO-

JECT LOC

CERTIFICATE OF LIABILITY INSURANCE

DATE (MM/DD/YYYY)

CANCELLATION

CERTIFICATE HOLDER
The ACORD name and logo are registered marks of ACORD
HIRED

AUTOS ONLY
614-842-6686 614-888-2739
Katie Baughan
04/08/2024
techrug
Technology Risk Underwriting Group
596-600 Enterprise Drive
Lewis Center, Ohio 43035
CU Technology LLC dba Acorn Technology Services
1960 Chicago Ave. Suite E9 and Suite C3
Riverside, CA 92507
[email protected]
RLI INS CO 13056
Hamilton Insurance DAC A0765
✔
✔
A
✔
✔
✔
06/01/2023 06/01/2024PTB0001949
06/01/2024A
PTA0001217 06/01/2023
06/01/2024
✔
A 06/01/2023
B Errors and Omissions Insurance B1180D221573/038 06/01/2023 06/01/2024 Each Claim Aggregate
PTW0001346
City of Goleta
130 Cremona Dr
Goleta, CA 93117
2,000,000
1000,000
10,000
2,000,000
4,000,000
4,000,000
1,000,000
1,000,000
1,000,000
1,000,000
$2,000
$2,000,000
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 138
Policy Number: RLI Insurance Company
Named Insured:

PPB 304G 04 13 Page 1 of 1
THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY.

RLIPack® FOR PROFESSIONALS

BLANKET ADDITIONAL INSURED ENDORSEMENT
This endorsement modifies insurance provided under the following:

BUSINESSOWNERS COVERAGE FORM - SECTION II – LIABILITY

1. C. WHO IS AN INSURED is amended to include as
an additional insured any person or organization that
you agree in a contract or agreement requiring
insurance to include as an additional insured on this
policy, but only with respect to liability for "bodily
injury", "property damage" or "personal and
advertising injury" caused in whole or in part by you
or those acting on your behalf:
a. In the performance of your ongoing operations;
b. In connection with premises owned by or rented
to you; or
c. In connection with “your work” and included
within the “product-completed operations
hazard”.

2. The insurance provided to the additional insured by
this endorsement is limited as follows:
a. This insurance does not apply on any basis to
any person or organization for which coverage
as an additional insured specifically is added by
another endorsement to this policy.
b. This insurance does not apply to the rendering
of or failure to render any professional services.
c. This endorsement does not increase any of the
limits of insurance stated in D. Liability And
Medical Expenses Limits of Insurance.

3. The following is added to SECTION III H.2. Other
Insurance – COMMON POLICY CONDITIONS
(BUT APPLICABLE ONLY TO SECTION II –

LIABILITY)
However, if you specifically agree in a contract or
agreement that the insurance provided to an
additional insured under this policy must apply on a
primary basis, or a primary and non-contributory
basis, this insurance is primary to other insurance
that is available to such additional insured which
covers such additional insured as a named insured,
and we will not share with that other insurance,
provided that:
a. The "bodily injury" or "property damage" for
which coverage is sought occurs after you have
entered into that contract or agreement; or
b. The "personal and advertising injury" for which
coverage is sought arises out of an offense
committed after you have entered into that
contract or agreement.

4. The following is added to SECTION III K. 2.

Transfer of Rights of Recovery Against Others to
Us – COMMON POLICY CONDITIONS (BUT
APPLICABLE TO ONLY TO SECTION II –

LIABILITY)
We waive any rights of recovery we may have
against any person or organization because of
payments we make for "bodily injury", "property
damage" or "personal and advertising injury" arising
out of "your work" performed by you, or on your
behalf, under a contract or agreement with that
person or organization. We waive these rights only
where you have agreed to do so as part of a
contract or agreement with such person or
organization entered into by you before the "bodily
injury" or "property damage" occurs, or the "personal
and advertising injury" offense is committed.

ALL OTHER TERMS AND CONDITIONS OF THIS POLICY REMAIN UNCHANGED.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 139
Policy Number: RLI Insurance Company
Named Insured:

PPB 313G 04 13 Page 1 of 1
THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ IT CAREFULLY.

RLIPack® FOR PROFESSIONALS

SCHEDULED ADDITIONAL INSURED ENDORSEMENT

This endorsement modifies insurance provided under the following:

BUSINESSOWNERS COVERAGE FORM – SECTION II – LIABILITY

Schedule

Name of Person(s) or Organization(s):

1. SECTION II C. W ho Is An Insured is amended to
include as an additional insured the person or
organization shown in the schedule above, but only
with respect to liability for "bodily injury", "property damage" or "personal and advertising injury"
caused in whole or in part by you or those acting on
your behalf:
a. In the performance of your ongoing operations;
b. In connection with premises owned by or rented
to you; or
c. In connection with “your work” and included
within the “product -completed operations
hazard”.

2. The insurance provided to the additional insured by
this endorsement is limited as follows:
a. This insurance does not apply to the render ing
of or failure to render any professional services.
b. This endorsement does not increase any of the
limits of insurance stated in D. Liability And
Medical Expenses Limits of Insurance.

3. The following is added to SECTION III H.2. Other
Insurance – C OMMON POLICY CONDITIONS
(BUT APPLICABLE ONLY TO SECTION II –

LIABILITY)
However, if you specifically agree in a contract or
agreement that the insurance provided to an
additional insured under this policy must apply on a
primary basis, or a primary and non- contributory
basis, this insurance is primary to other insuranc e
that is available to such additional insured which
covers such additional insured as a named insured,
and we will not share with that other insurance,
provided that:
a. The "bodily injury" or "property damage" for
which coverage is sought occurs after you have
entered into that contract or agreement; or
b. The "personal and advertising injury" for which
coverage is sought arises out of an of fense
committed after you have entered into that
contract or agreement.

4. The following is added to SECTION III K.2 Transfer
of Rights of Recovery Against Others to Us –

COMMON POLICY CONDITIONS (BUT
APPLICABLE TO SEC TION I – PROPERTY AND
SECTION II – LIABILITY)
We waive any rights of recovery we may have
against any person or organization because of
payments we make for "bodily injury", "property
damage" or "personal and advertising injury" arising
out of "your work" performed by you, or on your
behalf, under a contract or agreement with that
person or organization. We waive these rights only
where you have agreed to do so as part of a
contract or agreement with such person or
organization entered into by you before the "bodily
injury" or "property damage" occurs, or the "per sonal
and advertising injury" offense is committed.

ALL OTHER TERMS AND CONDITIONS OF THIS POLICY REMAIN UNCHANGED.

PTB0001949
CU Technology LLC
City of Goleta
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 140
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

LMA9030
01 September 2013
CALIFORNIA SURPLUS LINES NOTICE 1 (POST BIND)

IMPORTANT NOTICE

2. The insurer is not subject to the financial solvency regulation and enforcement that apply to California licensed insurers.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 141
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 2 of 76

LMA9098B
01 January 2020

CALIFORNIA COMPLAINTS NOTICE

To request assistance or make an initial complaint, you should contact TechRUG at:

TechRUG,
596 Enterprise Drive, Lewis Center, Delaware
County, Ohio 43035, United States
Compliance Officer:

Telephone Number:

Email:

In the alternative, or if you are dissatisfied with the resolution of your complaint by the above party, you may wish to contact the Lloyd’s Complaints Department at:

Lloyd’s Complaints Department
c/o Lloyd’s America Inc.
280 Park Avenue,
East Tower, 25th Floor
New York, NY 10017
USA

Phone: 1-844-849-7828
Email: [email protected]

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 142
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Consumer Hotline
1-800-927-4357 (HELP)

TDD Number
1-800-482-4833 (TTY)

California Department of Insurance
Consumer Services Division
300 South Spring Street, South Tower
Los Angeles, CA 90013

LMA9136A
18 August 2020

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 143
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services SLC-3 (USA) NMA2868 (amended) (24/08/2000)
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 4 of 76

Lloyd’s Certificate

This Insurance is effected with certain Underwriters at Lloyd's, London.

The Assured is requested to read this Certificate, and if it is not correct, return it immediately to the Correspondent for appropriate alteration.

All inquiries regarding this Certificate should be addressed to the following Correspondent:

TechRUG
596 Enterprise Drive, Lewis Center, Delaware County, Ohio 43035, United States

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 144
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 5 of 76

CERTIFICATE PROVISIONS

1. Signature Required. This Certificate shall not be valid unless signed by the Intermediary on the attached Declaration Page.

As used in this Certificate "Underwriters" shall be deemed to include incorporated as well as unincorporated persons or entities that are Underwriters at Lloyd's, London.

3. Cancellation. If this Certificate provides for cancellati on and this Certificate is cancelled after the inception date, earned premium must be paid for the time the insurance has been in force.

5. Assignment. This Certificate shall not be assigned either in whole or in part without the written consent of the Correspondent endorsed hereon.

7. Claims. All claims and other enquiries shall be addressed to the Correspondent.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 145
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 6 of 76

Short Rate Cancellation Table For Term of One Year.

Rules applicable to insurance with terms less than or more than one year:

A. If insurance has been in force for one year or less, apply the short rate table for annual insurance to the full annual premium determined as for insurance written for a term of one year.

B. If insurance has been in force for more than one year:

1. Determine full annual premium as for insurance written for a term of one year.

3. Add premium produced in accordance with items (1) and (2) to obtain earned premium during full period insurance has been in force.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 146
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 7 of 76

9. Complaints: All complaints must be referred in the first instance to the Correspondent.

Decus Insurance Brokers Ltd
The Scalpel, 18th Floor,
52 Lime Street,
London,
EC3M 7AF,

In the event that you remain dissatisfied with the way your complaint has been handled, you may refer the matter to the Complaints team at Lloyd’s. Their address is:

Complaints,
Lloyd’s
One Lime Street,
London, EC3M 7HA
Tel No: +44 (0)20 7327 5693
Fax No: +44 (0)20 7327 5225
Email: [email protected]
Website: https://www.lloyds.com

At any time if you are dissatisfied with the way your complaint has been handled, you may refer the matter to your State Department of Insurance

10. Lloyd’s is Authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority.

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 147

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 8 of 76 D231573

This Declaration Page is attached to and forms part of Certificate provisions.

SCHEDULE

Type: Technology Professional Liability and Cyber Insurance as more fully defined in the policy wording

Form: TechR.U.G. Technology, Cyber and Media Policy Wording – 2022

Name of Insured: CU Technology d.b.a. Acorn Technology Services

Type of Insured: Corporation

Insured Email: [email protected]

Mailing Address of
Insured:
1960 Chicago Avenue, Suite E9, Riverside, CA 92507

Period of Insurance: Effective from Thu Jun 01 2023 to Sat Jun 01 2024 Both days at 12.01a.m. Local Standard Time

Premium (annual) Premium USD 9,479.25
Policy Fee USD 100.00
Provider Policy Fee USD 100.00
Surplus Lines Tax USD 293.25
Stamping Fee USD 17.60
TRIA Premium USD 95.75
TOTAL USD 10,085.85

Limit of Liability: Per Claim and in the Policy Aggregate. USD 2,000,000

Insuring Agreement Aggregate Limit

2. A. Media Tech, Data & Network Liability USD 2,000,000

2. B. Breach Response USD 2,000,000

2. C. Regulatory Defense & Penalties USD 2,000,000

2. D. Payment Card Liabilities & Costs USD 2,000,000

2. E. First Party Data & Network Loss – Dependent Business Loss USD 100,000

2. E. First Party Data & Network Loss – All Other Coverage Under 2. E. USD 2,000,000

2. F. eCrime USD 250,000

2. G. Criminal Reward USD 50,000

Coverage: Worldwide

Conditions: Includes the following terms and conditions:

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 148
Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 9 of 76 D231573

Exclusions: Includes the following exclusions:

Website: https://www.acorntechservices.com

Industry: Technology - B2B

Gross Annual
Revenue:

USD 5,000,000

Historic Coverage Full Prior Acts

Continuity Date: Thu Jun 01 2023

US Classification: Surplus Lines
naming:

Peachtree Special Risk Brokers
3525 Piedmont Rd NE Bldg 5 Suite 700 Atlanta GA 30305
California License #: 0E28855

US Surplus lines broker is responsible for collecting and paying all surplus lines taxes and fees.

Claim Notification: BatesCarey LLP
191 North Wacker, Suite 2400, Chicago, IL 60606
Email: [email protected]
Tel: 001-312-762-3256

Service of Suit: Lloyd's America Inc.,
Attention: Legal Department,
280 Park Avenue, East Tower, 25th Floor,
New York, NY 10017

Insurer: Lloyd’s of London, AM Best Rating A XV (Non-admitted)

Commission: As per contract
DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 149
Insured: CU Technology d.b.a. Acorn Technology Services

Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 10 of 76 D231573

Order Hereon: 100% of 100%

Security: Authority Ref. D231573 – Order: 100%

75.0000% 4000 HAM

100.0000%

25.0000% 2121 ARG

100.0000%

Losses: No Known Losses in the past 5 years

ENGLAND

In witness whereof this certificate has been signed on 5th day of June, 2023 By

Authorized Signatory
Tracey Titley - Decus

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 150
Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 1 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 11 of 76

TechR.U.G.

Technology, Cyber and Media
Policy Wording

Underwritten on behalf of:

Certain Underwriters at Lloyd’s of London

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 151

Certificate Number: B1180D231573/009 (100%)
Name Insured: CU Technology d.b.a. Acorn Technology Services

Hamilton – Technology, Cyber and Media Page 2 of 31
Tue Jun 06 2023 @ 8:09:42 | 277157 | Page 12 of 76

Table of Contents:

1. Introductory Clause

3. Defense and Settlement of Claims

4. Definitions

5. Exclusions

6. General Conditions

DocuSign Envelope ID: 500000B0-34F6-4E2B-8C75-6F6D6001996F 152