ADMINISTRATIVE SERVICES AGREEMENT
for
City of Redondo Beach
Type: 401
Account #: 100507
MissionSquare Retirement Agreement 1 of 20
Plan number 100507
ADMINISTRATIVE SERVICES AGREEMENT
This Administrative Services Agreement (“Agreement”) is made effective as of, (please enter date) October 7, 2025, (herein referred to as the "Inception Date"), between the International City Management Association Retirement Corporation doing business as MissionSquare Retirement (“MissionSquare”), a nonprofit corporation organized and existing under the laws of the State of Delaware, and the City of Redondo Beach (“Employer”), a chartered city and municipal corporation organized and existing under the laws of the State of California with an office at 415 Diamond Street, Redondo Beach, California 90277.
RECITALS
Employer acts as public plan sponsor of a retirement plan (“Plan”), and in that capacity, has responsibility to obtain administrative services and investment alternatives for the Plan;
VantageTrust is a group trust established and maintained in accordance with New Hampshire Revised Statutes Annotated section 391:1 and Internal Revenue Service Revenue Ruling 81-100, 1981-1 C.B. 326, which provides for the commingled investment of retirement funds;
MissionSquare, or its wholly owned subsidiary, acts as investment adviser to VantageTrust Company, LLC, the Trustee of VantageTrust; MissionSquare has designed, and VantageTrust Company offers, a series of separate funds (the “Funds”) for the investment of plan assets as referenced in the Funds’ principal disclosure documents, the Disclosure Memorandum and the Fact Sheets (together, “MissionSquare Disclosures”); and
MissionSquare provides a range of services to public employers for the operation of employee retirement plans including, but not limited to, communications concerning investment alternatives, account maintenance, account recordkeeping, investment and tax reporting, transaction processing, and benefit disbursement.
Plan number 100507
2 AGREEMENTS
1. Appointment of MissionSquare
Employer hereby appoints MissionSquare as administrator of the Plan to perform all nondiscretionary functions necessary for the administration of the Plan. The functions to be performed by MissionSquare shall be those set forth in Exhibit A to this Agreement.
2. Adoption of VantageTrust
Employer has adopted the Declaration of Trust of VantageTrust Company and agrees to the commingled investment of assets of the Plan within VantageTrust. Employer agrees that the investment, management, and distribution of amounts deposited in VantageTrust shall be subject to the Declaration of Trust, as it may be amended from time to time and shall also be subject to terms and conditions set forth in disclosure documents (such as the MissionSquare Disclosures or Employer Bulletins) as those terms and conditions may be adjusted from time to time.
3. Exclusivity Agreement
Employer agrees that for the initial or succeeding term of this Agreement specified in Section 10, so long as MissionSquare continues to perform in all material respects the services to be performed by it under this Agreement, Employer shall not obtain plan administration from anyone other than MissionSquare. If MissionSquare fails to meet the any performance obligation set forth herein, Employer may, upon providing written notice to MissionSquare and allowing a cure period of thirty (30) days, engage other providers for the specific services or terminate this Agreement in accordance with Section 10.
Employer acknowledges that MissionSquare has agreed to the compensation to be paid to MissionSquare under this Agreement in the expectation that MissionSquare will be able to offset costs allocable to performing this Agreement with revenues arising from Employer's exclusive use of MissionSquare at the rates provided herein throughout the initial or succeeding term.
4. Employer Duty to Furnish Information
Employer agrees to furnish to MissionSquare on a timely basis such information as is necessary for MissionSquare to carry out its responsibilities as Administrator of the Plan, including information needed to allocate individual participant accounts to Funds in the Plan, and information as to the employmentstatus of participants, and participant ages, addresses, and other identifying information (including tax identification numbers).
Employer also agrees that it will notify MissionSquare in a timely manner Plan number 100507
3 regarding changes in staff as it relates to various roles. Such notification is to be completed through the plan sponsor website. MissionSquare shall be entitled to rely upon the accuracy of any information that is furnished to it by a responsible official of the Employer or any information relating to an individual participant or beneficiary that is furnished by such participant or beneficiary, and MissionSquare shall not be responsible for any error arising from its reliance on such information. MissionSquare will provide reports and account information to the Employer through the plan sponsor website.
Employer is required to send in contributions through the plan sponsor website.
Alternative electronic methods may be allowed but must be approved by MissionSquare for use. Contributions may not be sent through paper submittal documents.
To the extent Employer selects third-party investment options that do not have profile information provided to MissionSquare through MissionSquare’s electronic data feeds from external sources (such as Morningstar) or the third-party investment option providers, the Employer is responsible for providing to MissionSquare timely investment option updates for disclosure to Plan participants. Such updates may be provided to MissionSquare through the Employer’s investment consultant or other designated representative.
5. MissionSquare Representations and Warranties
MissionSquare represents and warrants to Employer that:
(a) MissionSquare is a non-profit corporation with full power and authority to enter into this Agreement and to perform its obligations under this Agreement. The ability of MissionSquare, or its wholly owned subsidiary, to serve as investment adviser to VantageTrust Company is dependent upon the continued willingness of VantageTrust Company for MissionSquare, or its wholly owned subsidiary, to serve in that capacity. (b) MissionSquare is an investment adviser registered as such with the U.S.
Securities and Exchange Commission under the Investment Advisers Act of 1940, as amended.
(c) MissionSquare shall maintain and administer the Plan in accordance with the requirements for plans which satisfy the qualification requirements of Section 401 of the Internal Revenue Code and other applicable federal law; provided, however, MissionSquare shall not be responsible for the qualified status of the Plan in the event that the Employer directs MissionSquare to administer the Plan or disburse assets in a manner inconsistent with the requirements of Section 401 or otherwise causesthe Plan number 100507
4 Plan not to be carried out in accordance with its terms; provided, further, that if the plan document used by the Employer contains terms that differ from the terms of MissionSquare's model plan document, MissionSquare shall not be responsible for the qualified status of the Plan to the extent affected by the differing terms in the Employer's plan document.
MissionSquare shall not be responsible for monitoring state or local law applicable to retirement plans or for administering the Plan in compliance with local or state requirements regarding plan administration unless Employer notifies MissionSquare of any such local or state requirements.
6. Employer Representations and Warranties
Employer represents and warrants to MissionSquare that:
(a) Employer is organized in the form and manner recited in the opening paragraph of this Agreement with full power and authority to enter into and perform its obligations under this Agreement and to act for the Plan and participants in the manner contemplated in this Agreement.
Execution, delivery, and performance of this Agreement will not conflict with any law, rule, regulation or contract by which the Employer is bound or to which it is a party.
(b) Employer understands and agrees that MissionSquare’s sole function under this Agreement is to act as recordkeeper and to provide administrative, investment or other services at the direction of Plan participants, the Employer, its agents or designees in accordance with the terms of this Agreement. Under the terms of this Agreement, MissionSquare does not render investment advice, is neither the “Plan Administrator” nor “Plan Sponsor” as those terms are defined under applicable federal, state, or local law, and does not provide legal, tax or accounting advice with respect to the creation, adoption or operation of the Plan and its related trust. MissionSquare does not perform any service under this Agreement that might cause MissionSquare to be treated as a “fiduciary” of the Plan under applicable law, except, and only, to the extent that MissionSquare provides investment advisory services to individual participants enrolled in Guided Pathways Advisory Services. (c) Employer acknowledges and agrees that MissionSquare does not assume any responsibility with respect to the selection or retention of the Plan’s investment options. Employer shall have exclusive responsibility for the Plan’s investment options, including the selection of the applicable share class.
Plan number 100507
5 (d) Employer acknowledges that certain such services to be performed by MissionSquare under this Agreement may be performed by an affiliate or agent of MissionSquare pursuant to one or more other contractual arrangements or relationships, and that MissionSquare reserves the right to change vendors with which it has contracted to provide services in connection with this Agreement without prior notice to Employer. (e) Employer approves the use of its Plan in MissionSquare external media, publications and materials. Examples include press releases announcements and inclusion of the general plan information in request for proposal responses.
7. Participation in Certain Proceedings
The Employer hereby authorizes MissionSquare to act as agent, to appear on its behalf, and to join the Employer as a necessary party in all legal proceedings involving the garnishment of benefits or the transfer of benefits pursuant to the divorce or separation of participants in the Plan. Unless Employer notifies MissionSquare otherwise, Employer consents to the disbursement by MissionSquare of benefits that have been garnished or transferred to a former spouse, current spouse, or child pursuant to a domestic relations order or child support order.
8. Compensation and Payment
(a) MissionSquare’s compensation under this Agreement shall be as set forth in subsection (b) below.
(b) Compensation for Management Services to VantageTrust Company, Compensation for Advisory and other Services to the MissionSquare Funds Class M and Payments from Third-Party Investment Options.
Employer acknowledges that MissionSquare, or its wholly owned subsidiary, receives fees from VantageTrust Company for investment advisory services and plan and participant services furnished to VantageTrust Company. Employer further acknowledges that MissionSquare, including certain of its wholly owned subsidiaries, receives compensation for advisory and other services furnished to the MissionSquare Funds Class M, which serve as the underlying portfolios of a number of Funds offered through VantageTrust. For a MissionSquare Fund Class R that invests substantially all of its assets in a third-party mutual fund not affiliated with MissionSquare, MissionSquare or its wholly owned subsidiary receives payments from the third-party mutual fund families or their service providers in the form of 12b-1 fees, service fees, compensation for sub-accounting and other services provided based on assets in the underlying third-party mutual fund. These fees are Plan number 100507
6 described in the MissionSquare Disclosures and MissionSquare’s fee disclosure statement. In addition, to the extent that third party options are included in the investment line-up for the Plan, MissionSquare receives administrative fees from its third-party settlement and clearing agent for providing administrative and other services based on assets invested in third-party investment options; such administrative fees come from payments made by third-party investment options to the settlement and clearing agent.
(c) Redemption Fees. Redemption fees imposed by outside investment options in which Plan assets are invested are collected and paid to the investment option by MissionSquare. MissionSquare remits 100% of redemption fees back to the specific investment option to which redemption fees apply. These redemption fees and the individual investment option’s policy with respect to redemption fees are specified in the prospectus or other disclosure document for the individual mutual fund and referenced in the MissionSquare Disclosures.
(d) Payment Procedures. All payments to MissionSquare pursuant to this Section 8 shall be made from Plan assets held by VantageTrust or received from third-party investment options or their service providers in connection with Plan assets invested in such third-party investment options, to the extent not paid by the Employer. The amount of Plan assets administered by MissionSquare shall be adjusted as required to reflect any such payments as are made from the Plan. In the event that the Employer agrees to pay amounts owed pursuant to this Section 8 directly, any amounts unpaid and outstanding after 30 days of Employer’s receipt of the invoice shall be withdrawn from Plan assets.
The compensation and payment set forth in this Section 8 are contingent upon the Employer’s using MissionSquare’s plan sponsor website for contribution processing and submitting contribution funds by ACH or wire transfer on a consistent basis over the term of this Agreement. The compensation in this Section 8 is also based on the assets of the Plan being invested in R5 shares of MissionSquare PLUS Fund and the Employer offering the MissionSquare PLUS Fund as the sole stable value option.
Employer further acknowledges and agrees that compensation and payment under this Agreement shall be subject to re-negotiation in the event that the Employer (a) chooses to implement additional mutual funds that do not trade via NSCC or (b) chooses to implement investment options that are not mutual funds.
Plan number 100507
7 9. Indemnification
(a) Employer shall indemnify MissionSquare against, and hold MissionSquare harmless from, any and all loss, damage, penalty, liability, cost, and expense, including without limitation, reasonable attorney’s fees, that may be incurred by, imposed upon, or asserted against MissionSquare by reason of any claim, regulatory proceeding, or litigation arising from any act done or omitted to be done by any individual or person with respect to the Plan or its related trust, excepting only any and all loss, damage, penalty, liability, cost or expense resulting from Employer’s negligence, or willful misconduct, or failure to maintain the cybersecurity measures outlined in Exhibit B resulting in a breach of Plan data, including but not limited to unauthorized access, use, disclosure, or loss of sensitive participant information, or from MissionSquare’s negligence, gross negligence, or willful misconduct (including that of its employees, agents, subcontractors, or affiliates).
(b) MissionSquare shall indemnify Employer against, and hold Employer harmless from, any and all loss, damage, penalty, liability, cost, and expense, including without limitation, reasonable attorney’s fees, that may be incurred by, imposed upon, or asserted against Employer by reason of any claim, regulatory proceeding, or litigation arising from any act done or omitted to be done by any individual or person with respect to the Plan or its related trust, excepting only any and all loss, damage, penalty, liability, cost or expense resulting from Employer’s negligence, or willful misconduct.
(c) MissionSquare shall not be responsible for any acts or omissions of any person with respect to the Plan or its related trust, other than MissionSquare, its employees, agents, subcontractors, or affiliates, in connection with the administration or operation of the Plan.
(d) Notwithstanding the foregoing, in the event of shared or comparative fault involving Employer’s negligence, Mission Square shall indemnify Employer to the extent of MissionSquare’s proportional responsibility, including that of its employees, agents, subcontractors, or affiliates. Proportional fault shall be determined by mutual agreement, arbitration, settlement, or judicial finding, but a judicial determination is not required for MissionSquare’s obligations to attach, including for settlements or reimbursement of reasonable defense costs.
However, if MissionSquare’s (or its employees, agents, subcontractors, or affiliates) gross negligence or willful misconduct contributes to the loss, MissionSquare shall provide full indemnity regardless of Employer’s shared fault, unless Employer’s fault results from willful misconduct. MissionSquare shall advance or reimburse Employer’s defense cost, including attorneys’ fees, as incurred, subject to proportionate adjustment upon final resolution.
Plan number 100507
8 (e) This indemnity obligation shall not be capped or otherwise limited in amount, and shall survive the termination or expiration of this Agreement. Each party shall provide prompt notice of any court-filed or regulatory claim and cooperate reasonably in the defense thereof.
10. Term
(a) This Agreement shall be in effect and commence on the date all parties have signed and executed this Agreement (“Inception Date”). This Agreement will be renewed automatically for each succeeding year unless written notice of termination is provided by either party to the other no less than 60 days before the end of such Agreement year.
(b) Notwithstanding the foregoing, Employer may terminate this Agreement for cause upon written notice to MissionSquare if MissionSquare materially breaches this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice of such breach. For purposes of this Agreement, a material breach is MissionSquare’s failure to perform any obligation set forth in this Agreement.
(c) The Employer understands and acknowledges that, in the event the Employer terminates this Agreement (or replaces the MissionSquare PLUS Fund of VantageTrust as an investment option in its investment line-up), MissionSquare retains full discretion to release Plan assets invested in the MissionSquare PLUS Fund in an orderly manner over a period of up to twelve (12) months from the date MissionSquare receives written notification from the Employer that it has made a final and binding selection of a replacement for MissionSquare as administrator of the Plan (or a replacement investment option for the MissionSquare PLUS Fund). This provision shall survive the termination or expiration of this Agreement.
11. Amendments and Adjustments
(a) This Agreement may be amended by written instrument signed by authorized representatives of both parties.
(b) The parties agree that enhancements may be made to administrative services under this Agreement. The Employer will be notified of enhancements or reduction in fees through electronic messages or special mailings.
12. Notices
Unless otherwise provided in this Agreement, all notices required to be delivered under this Agreement shall be in writing and shall be delivered, mailed, e-mailed or Plan number 100507
9 faxed to the location of the relevant party set forth below or to such other address or to the attention of such other persons as such party may hereafter specify by notice to the other party.
MissionSquare: Legal Department, MissionSquare, 777 North Capitol Street, N.E., Suite 600, Washington, D.C., 20002-4240
Facsimile; (202) 962-4601
Employer: at the office set forth in the first paragraph hereof, or to any other address, facsimile number or e-mail address designated by the Employer to receive the same by written notice similarly given.
Each such notice, request or other communication shall be effective: (i) if given by facsimile, when transmitted to the applicable facsimile number and there is appropriate confirmation of receipt; (ii) if given by mail or e-mail, upon transmission to the designated address with no indication that such address is invalid or incorrect; or (iii) if given by any other means, when actually delivered at the aforesaid address.
13. Complete Agreement
This Agreement shall constitute the complete and full understanding and sole agreement between MissionSquare and Employer relating to the object of this Agreement and correctly sets forth the complete rights, duties and obligations of each party to the other as of its date. This Agreement supersedes all written and oral agreements, communications or negotiations among the parties. Any prior agreements, promises, negotiations or representations, verbal or otherwise, not expressly set forth in this Agreement are of no force and effect.
14. Titles
The headings of Sections of this Agreement and the headings for each of the attached Exhibits are for convenience only and do not define or limit the contents thereof.
15. Incorporation of Exhibits
All Exhibits (and any subsequent amendments thereto), attached hereto, and referenced herein, are hereby incorporated within this Agreement as if set forth fully herein.
16. Governing Law
This Agreement shall be governed by and construed in accordance with the laws of the State of California, applicable to contracts made in that jurisdiction without reference to its conflicts of laws provisions.
Plan number 100507
10 17. Cybersecurity Requirements
MissionSquare shall comply with the cybersecurity provisions set forth in Exhibit B attached hereto and made a part hereof.
18. Compliance with Laws
MissionSquare shall comply with all applicable federal, state, and local laws, including but not limited to, CCPA, and CPRA.
19. Insurance
MissionSquare shall comply with the insurance requirements described in Exhibit C.
20. Survival
Upon termination or expiration of this Agreement, the following provisions shall survive and remain in full force and effect: Section 9 (Indemnification), Section 10 (Term), Section 12 (Notices), Section 16 (Governing Law), and Exhibit B (Cybersecurity Requirements).
[SIGNATURES FOLLOW ON NEXT PAGE]
Plan number 100507
11 In Witness Whereof, the parties hereto certify that they have read and understand this Agreement and all Exhibits attached hereto and have caused this Agreement to be executed by their duly authorized officers as of the Inception Date first above written.
CITY OF REDONDO BEACH
By
James A. Light, Mayor
ATTEST:
By
Eleanor Manzano, City Clerk
APPROVED:
By
Diane Strickfaden Risk Manager
APPROVED AS TO FORM:
By
Joy A. Ford, City Attorney
THE INTERNATIONAL CITY MANAGEMENT
ASSOCIATION RETIREMENT CORPORATION doing
business as MISSIONSQUARE RETIREMENT
By
Erica McFarquhar
Assistant Secretary
Plan number 100507
12 Exhibit A
Administrative Services
The administrative services to be performed by MissionSquare under this Agreement shall be as follows:
(a) Participant enrollment services are provided online. Employees will enroll online through a secure site or the Employer will enroll employees through the plan sponsor website.
(b) Establishment of participant accountsfor each employee participating in the Plan for whom MissionSquare receives appropriate enrollment instructions.
MissionSquare is not responsible for determining if such Plan participants are eligible under the terms of the Plan.
(c) Allocation in accordance with participant directions received in good order of individual participant accounts to investment options offered under the Plan. (d) Maintenance of individual accounts for participants reflecting amounts deferred, income, gain or loss credited, and amounts distributed as benefits. (e) Maintenance ofrecordsfor all participantsfor whom participant accounts have been established. These filesshall include enrollment instructions(provided to MissionSquare through the participant website or the plan sponsor website), beneficiary designation instructions and all other documents concerning each participant's account.
(f) Provision of periodic reports to the Employer through the plan sponsor website. Participants will have access to account information through Participant Services, Voice Response System, the participant website, and text access, and through quarterly statements that can be delivered electronically through the participant website or by postal service.
(g) Communication to participants of information regarding their rights and elections under the Plan.
(h) Making available Participant Services Representatives through a toll-free telephone number from 8:30 a.m. to 9:00 p.m. Eastern Time, Monday through Friday (excluding holidays and days on which the securities markets or MissionSquare are closed for business (including emergency closings)), to assist participants.
(i) Making available access to MissionSquare’s website, to allow participants to access certain account information and initiate certain plan transactions at any time. The participant website is normally available 24 hours a day, seven days a week except during scheduled maintenance periods designed to ensure highquality performance.
Plan number 100507
13 (j) Maintaining the security and confidentiality of client information through a system of controls including but not limited to, as appropriate: restricting plan and participant information only to those who need it to provide services, software and hardware security, access controls, data back-up and storage procedures, non-disclosure agreements, security incident response procedures, and audit reviews.
(k) Making available access to MissionSquare’s plan sponsor web site to allow plan sponsors to access certain plan information and initiate plan transactions such as enrolling participants and managing contributions at any time. The plan sponsor web site is normally available 24 hours a day, seven days a week except during scheduled maintenance periods designed to ensure highquality performance. (l) Distribution of benefits as agent for the Employer in accordance with terms of the Plan. Participants who have separated from service can request distributions through the participant website or via form. (m)MissionSquare is authorized by the Employer to (a) determine whether a domestic relations order is an acceptable qualified domestic relations order under the terms of the Plan and (b) establish a separate account record for the alternate payee and provide for the investment and distribution of assets held thereunder.
(n) Loans may be made available on the terms specified in the Loan Guidelines, if loans are adopted by the Employer. Participants can request loansthrough the participant website.
(o) Guided Pathways Advisory Services – MissionSquare’s participant advice service, “Fund Advice”, may be made available through a third-party vendor on the terms specified on MissionSquare’s website.
(p) MissionSquare is authorized by the Employer to establish an unallocated plan level expense accountto function asthe Administrative Allowance account, to be invested as Employer directs.
(q) MissionSquare will determine appropriate delivery method (electronic and/or print) for plan sponsor/participant communications and education based on a number of factors (audience, effectiveness, etc.)
Plan number 100507
14 Exhibit B
Cybersecurity Requirements
A. DEFINITION OF "EMPLOYER CONFIDENTIAL INFORMATION"
For the purposes of this Agreement, "Employer Confidential Information" shall include, but not be limited to, all non-public information of the Employer, including but not limited to:
1. Personally Identifiable Information (“PII”) as defined under applicable state and federal law;
2. Protected Health Information (“PHI”) as defined under the Health Insurance Portability and Accountability Act (“HIPAA”);
3. Payment Card Information as defined under the Payment Card Industry Data Security Standard (“PCI-DSS”);
4. Law enforcement-sensitive information including but not limited to data collected or generated by the Employer Police Department;
5. Trade secrets and proprietary information, including but not limited to intellectual property, designs, processes, or strategies;
6. Financial data such as budgets, tax records, or other fiscal documents;
7. Any other information that, due to its nature or the circumstances of its disclosure, a reasonable person would understand to be confidential or proprietary.
Employer Confidential Information shall not include information that: a) is or becomes publicly available through no breach of this Agreement; b) is obtained from a third party lawfully in possession of such information and not under any duty to the Employer to maintain its confidentiality; c) is independently developed by MissionSquare without reference to Employer Confidential Information.
B. COMPLIANCE WITH DATA PROTECTION LAWS
MissionSquare shall comply with all applicable federal, state, and local Laws and regulations relating to data privacy and cybersecurity, including but not limited to the California Consumer Privacy Act (“CCPA”), the California Privacy Rights Act (“CPRA”), HIPAA, SB 1386, and the PCI-DSS where credit cards are involved, and any other applicable privacy or security laws.
Plan number 100507
15 C. DATA SECURITY MEASURES
MissionSquare shall implement and maintain appropriate technical and organizational security measures to protect any Employer Confidential Information from unauthorized access, disclosure, alteration, destruction, or loss. At a minimum, these measures shall include:
1. Encryption. All Employer Confidential Information, including Employer Confidential Information, must be encrypted in transit and at rest using industry-standard encryption protocols, such as TLS 1.3, AES-256, or better.
2. Access Controls. MissionSquare shall implement strict access control measures, including multi-factor authentication (“MFA”), role-based access controls (“RBAC”), and the principle of least privilege, ensuring that only authorized personnel have access to Employer Confidential Information.
3. Secure Data Storage. MissionSquare shall ensure that Employer Confidential Information is stored in secure data centers that comply with industry-recognized security standards, such as SOC 2, ISO 27001, or equivalent.
4. Network Security. MissionSquare shall maintain up-to-date firewalls, intrusion detection and prevention systems (“IDPS”), anti-virus software, and other security tools to safeguard Employer Confidential Information from external and internal cyber threats.
5. Personnel Security. MissionSquare shall implement personnel security measures, including conducting background checks for employees with access to Employer Confidential Information. In addition, the MissionSquare shall ensure all employees handling Employer Confidential Information are trained regularly on best practices in cybersecurity and data protection. Training shall cover topics such as data privacy practices, phishing prevention, secure data handling, and incident reporting procedures.
D. INCIDENT RESPONSE AND DATA BREACH NOTIFICATION
MissionSquare shall maintain a comprehensive incident response plan to address potential cybersecurity incidents, including but not limited to data breaches, malware infections, and unauthorized access to Employer data. In the event of any security breach or unauthorized access involving Employer data, MissionSquare agrees to:
Plan number 100507
16 1. Immediate Notification. Notify the Employer in writing within 48 hours of discovering any actual or suspected security breach involving Employer data.
2. Investigation and Remediation. Investigate the breach, take all necessary steps to contain and mitigate its impact, and provide a full written report to the Employer detailing the breach's nature, the data involved, and the corrective actions taken.
3. Cooperation. Fully cooperate with the Employer and any regulatory authorities in any investigation or legal actions relating to the breach, including providing access to any relevant security logs, audit trails, or other information.
E. DATA BACKUP AND DISASTER RECOVERY
MissionSquare shall implement a robust data backup and disaster recovery plan. MissionSquare shall ensure that all Employer Confidential Information is backed up regularly to secure offsite locations with sufficient geographic redundancy. MissionSquare shall ensure that in the event of a disaster or significant system failure, all Employer Confidential Information can be restored to its original state within a reasonable timeframe agreed upon with the Employer.
F. DATA RETENTION AND SECURE DISPOSAL
MissionSquare shall retain Employer Confidential Information for the duration of this Agreement. However, upon termination or expiration of the Agreement, or upon the Employer’s request, MissionSquare shall:
1. Return or Destroy Data. Promptly return all Employer Confidential Information in a format specified by the Employer or securely destroy the data and provide a written certification of destruction within thirty (30) days of the Employer’s request, except to the extent MissionSquare is required to maintain copies of Employer Confidential Information to comply with regulatory obligations.
2. Secure Disposal. Ensure that any media, devices, or documents containing Employer Confidential Information are disposed of in a manner that ensures the data is rendered irrecoverable, using methods such as secure shredding or certified electronic data destruction.
G. SUBCONTRACTORS AND THIRD-PARTY PROVIDERS
If MissionSquare specifically retains any subcontractors or third-party providers to provide services to Employer on behalf of MissionSquare under this Agreement (“Custom Subcontractors”), MissionSquare shall ensure that Custom Subcontractors comply with the same cybersecurity requirements outlined in this Agreement. This includes, but is not limited to:
Plan number 100507
17 1. Compliance with Cybersecurity Measures. Custom Subcontractor must implement and maintain the same security measures as set forth in Section C of this Exhibit B, including without limitation, encryption, access controls, secure data storage, and network security.
2. Personnel Security Training.
MissionSquare shall ensure that all Custom Subcontractors and any other personnel involved in handling Employer Confidential Information are trained regularly on best practices in cybersecurity and data protection. Training shall cover the topics outlined in Section C of this Exhibit B.
MissionSquare shall be fully responsible for any acts, omissions, or security breaches caused by its subcontractors or third-party providers, including, but not limited to, Custom Subcontractors failure to comply with the cybersecurity requirements or training obligations set forth in this Exhibit B.
H. NOTIFICATION OF CHANGES IN SECURITY CERTIFICATIONS
MissionSquare shall immediately notify the Employer of any changes, lapses, or expirations in cybersecurity certifications (e.g., FEDRAMP, SOC 2 Type 2, etc.) that were in effect at the time of the Agreement execution.
Plan number 100507
18 Exhibit C
Insurance Requirements
MissionSquare shall, at its sole expense, maintain during the term of this Agreement the insurance coverages described below, with insurers authorized to transact business in California and rated at least A- by A.M. Best or equivalent. Certificates of Insurance or copies of policies shall be furnished to the Employer upon request, within thirty (30) days, and must name the Employer as an Additional Insured for General Liability, Automobile Liability, and Cyber Liability policies.
All General Liability, Automobile Liability and Workers’ Compensation policies affected by this Agreement will be primary and noncontributory to any other insurance or selfinsurance maintained by the Employer and will be written on ISO forms approved for coverage in California. Policy limits may be met via a combination of primary and excess or umbrella policies, provided that all such policies are written on an occurrence basis unless otherwise specifically agreed.
All policies will include provisions that require MissionSquare and/or its insurer(s) to provide the Employer with at least thirty (30) days written notice of cancellation or material change in coverage, except that ten (10) days’ written notice may be provided for cancellation for non-payment of premium. If MissionSquare fails to maintain the required insurance as set forth in this Agreement, the Employer reserves the right, but not the obligation, to procure such insurance coverage at MissionSquare’s expense. (a) Commercial General Liability Insurance (“CGL”) with a limit of not less than $1,000,000 each occurrence, $2,000,000 general aggregate. CGL will cover liability arising from premises, operations, products-completed operations, contractual liability, personal/advertising injury, and independent contractors.
(b) Workers’ Compensation Insurance providing coverage as required by applicable federal and, or states statutes, and Employer’s Liability Insurance. The limits of such policies will be at least $1,000,000 per accident/disease, and policy limit of $1,000,000.
(c) Automobile/Motor Vehicle Liability Insurance with a limit of not less than $2,000,000 combined single limit; or, Bodily Injury $1,000,000 each person, $2,000,000 accident, and Property Damage $200,000 each accident. Such insurance must cover liability arising from any motor vehicle as defined by Commonwealth of Virginia laws and must include coverage for owned, non-owned, leased, hired and rented vehicles, and include uninsured and underinsured motorists.
Plan number 100507
19 (d) Professional/Error & Omissions Liability Insurance that will protect MissionSquare against legal liability from alleged negligence or errors and omissions, including personal injury, which may arise from the performance of MissionSquare’s duties and obligations under this contract. Coverage must apply to acts, errors, or omissions by MissionSquare, its employees, and subcontractors, and must remain in effect for two (2) years following termination or expiration of this Agreement. The minimum acceptable limits of liability to be provided by such Professional/Error & Omissions Liability Insurance are $5,000,000 each claim, $5,000,000 aggregate.
(e) Cyber/Privacy Liability Insurance with minimum limits of $2,000,000 and where personal data is stored or accessible to MissionSquare limits of not less than $5,000,000, and provides for, at least (i) liability incurred from alleged or actual data theft or misuse, dissemination, and/or use of personal or confidential information and any related forensic costs, notification, crisis management costs; (ii) network security liability arising from the unauthorized access to, use of, or tampering with computer systems, including hacker attacks or inability of an authorized third party to gain access to services, including denial of service, unless caused by a mechanical or electrical failure; (iii) liability arising from the introduction of a malicious code or computer virus into, or otherwise causing damage to, a customer’s or third person’s computer, computer system, network, or similar computer-related property and the data, software, and programs thereon; (iv) any government or regulatory investigations and penalties resulting from the alleged or actual disclosure of personal or confidential information or network security liability event; and (v) nonphysical business interruption due to cyber events. (f) Crime and Fidelity Insurance. MissionSquare agrees to obtain and maintain a comprehensive crime policy to include, at least the following coverages: (i) Employee Dishonesty and theft, (ii) Money and Securities, (iii) Fraud, including Computer Fraud and funds transfer fraud, including Social Engineering Fraud, and (iv) Depositor’s Forgery, with limits of not less than $5,000,000.
(g) Umbrella or Excess Liability Insurance. A follow form Umbrella or Excess Liability policy shall be purchased with a limit of not less than $10,000,000 providing excess coverage over all limits and coverage under this Agreement. The limits can be obtained by a combination of Primary and Excess Umbrella or Excess liability policies, provided that all layers follow form with the underlying policies indicated herein and are written on an “occurrence” form. Said policies shall name the Employer as Additional Insured.