1. Security Best Practices and Compliance with Laws. Supplier shall put in place and maintain appropriate physical, technical and organizational measures, which shall include the measures listed in Schedule 1 (Technical and Organizational Measures) to this Addendum (collectively referred to herein as “Safeguards”) to prevent against the accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access to the Ralliant Assets. Similar Safeguards shall be implemented to protect any hardware, software, services, systems, devices or media to be provided or used by Supplier as part of its performance under this Agreement (such hardware, software, services, systems, devices or media referred to herein as “Supplier Assets”), in order to protect the same from inadvertent and unauthorized processing, corruption, destruction, access, use, alteration, sale, rental, modification, or disclosure. Supplier represents and warrants that the security measures it takes in performance of its obligations under this Agreement and this Addendum are, and will at all times remain, at the highest of the following: (i) Privacy & IT Security Best Practices (as defined by ISO 27001/27002, NIST Cybersecurity Framework or other security industry recognized standards or best practice); (ii) the security requirements, standards, obligations, specifications and event reporting procedures in this Agreement and this Addendum; and (iii) any security requirements, standards, obligations, specifications and event reporting procedures required by any applicable law. Supplier represents and warrants that Supplier and all Supplier Agents are capable of performing, and are, as of the date of the Agreement, in compliance with this Addendum. Without limiting any other remedies available to Ralliant, if, at any time, Supplier or Supplier Agents are not in compliance with this Addendum, Supplier shall, and shall cause Supplier Agents to, take all necessary steps to bring themselves back into compliance with this Addendum as soon as practicable. Supplier shall not engage in directly or indirectly, exporting or re-exporting the Personal Data in violation of any applicable U.S. export control laws and regulations or any other applicable international export control laws.
2. Use by Supplier. Supplier will not use, share, store, transfer, or otherwise disclose Ralliant Assets for any purpose other than to perform the Services in accordance with the Agreement. Supplier will not, directly or indirectly, disclose Ralliant Assets to anyone outside Ralliant (including subcontractors, agents, outsourcers, and auditors – each hereinafter a “Third Party”) without Ralliant’s prior written consent. To the extent Supplier discloses or makes Ralliant Assets available to a Third Party, Supplier shall remain liable to Ralliant for the actions and omissions of the Third Party concerning the treatment of Ralliant Assets and shall require via a written agreement signed by the Third Party that the Third Party complies with the terms and conditions of this Addendum as if it were Supplier. Supplier will not combine Ralliant Assets with data from any other company or source and Supplier agrees to specifically segregate Customer Data.
3. Use of Sub-contractors. The Supplier shall provide to Ralliant, at Ralliant’s request either in advance of use of the cloud technology, or at any time during the term of the Agreement, a list of: all subcontractors assisting the Supplier to provide the Services; and all jurisdictions to, or in which the Customer Data will be transferred or stored in order for the Supplier to provide the Services to Ralliant. The Supplier shall also provide advance warning to Ralliant of any changes to the cloud technology and any security measures used to process the Customer Data in order to provide the Services. This advance warning should allow Ralliant sufficient time to consider the changes and assess whether it wishes to continue with the Agreement or terminate it. At minimum, the Supplier will provide Ralliant with 30 days’ notice of any changes to the technology and security measures used to process the Customer Data.
4. Ralliant Assessment. Upon request, Supplier shall, and shall cause Supplier Agents to, grant Ralliant or a third party on Ralliant’s behalf permission to perform an assessment, audit, examination, or review of controls in Supplier’s environment in relation to Customer Data being handled and/or Services being provided to confirm compliance with the Agreement, this Addendum as well as any applicable laws, regulations, and industry standards. Additionally, Supplier shall promptly and accurately complete any information security questionnaire provided by Ralliant or a third party on Ralliant’s behalf regarding Supplier’s environment in relation to Customer Data being handled and/or Services being provided to confirm compliance with the Agreement, this Addendum, as well as any applicable laws, regulations, and industry standards. Supplier shall fully cooperate with such assessment by providing access to any knowledgeable personnel, physical premises, documentation, infrastructure, and application software that processes, stores, or transports Ralliant Data pursuant to the Agreement. Supplier agrees to allow Ralliant to perform physical facility audits upon reasonable advanced notice to Supplier. The audit costs shall be borne by Ralliant unless the audit is caused by Supplier or shows a breach of any obligation under the Agreement by Supplier. In such case, the audit costs and any further reasonable costs in connection with this breach shall be borne by Supplier.
5. Security Breaches.
   5.1. Upon execution of the Agreement, Supplier will provide Ralliant with the name and contact information for a primary security contact with Supplier who will be available to assist Ralliant as a contact in resolving obligations associated with a Security Breach. A “Security Breach” for purposes of this Addendum means: (i) the attempted or successful unauthorized or unlawful access, acquisition, use, disclosure, modification, loss, or destruction of Ralliant Assets or interference with system operations in an information system that contains Ralliant Assets; (ii) any breaches to Supplier Systems or (iii) receipt of a complaint in relation to the privacy practices of Supplier or Supplier Agent or a breach or alleged breach of this Exhibit. The inadvertent unauthorized access of Ralliant Assets by a resource performing Services under the Agreement is not a Security Breach so long as the resource ends access as soon as the access is discovered, and the inadvertent access is reported to Ralliant immediately.
   5.2. Supplier shall notify Ralliant as soon as possible, and in no case later than twenty-four (24) hours after Supplier becomes aware of evidence that would lead Supplier to reasonably conclude that a Security Breach may have occurred. In such a case, Supplier shall notify Ralliant of and investigate the Security Breach according to the process set out in Exhibit A to this Addendum. Supplier shall take immediate steps to remedy the Security Breach at Supplier’s expense in accordance with applicable privacy rights, laws, and standards according to the process set out in Schedule 1 (Technical and Organizational Measures) to this Addendum. Supplier shall indemnify Ralliant for all costs incurred in responding to and mitigating damages caused by a Security Breach.
   5.3. Except as may be strictly required by applicable law, Supplier agrees that it will not inform any third party of any Security Breach without first obtaining Ralliant’s prior written consent, other than to inform a complainant that the matter has been forwarded to Ralliant. Supplier will cooperate with Ralliant in connection with issuing any notice to individuals, regulators, law enforcement agencies, consumer reporting agencies, or others as required by law or regulation, or in Ralliant’s discretion, in connection with any Security Breach. Further, Supplier agrees that Ralliant shall have the sole right to determine: (i) whether notice of the Security Breach is to be made; (ii) the contents of such notice; (iii) whether any type of remediation may be offered to affected persons; and (iv) the nature and extent of any such remediation (including, in the case of ensure of Social Security numbers or payment card information, actual reasonable costs incurred in providing individuals affected by the Security Breach with reissued payment cards, complimentary one (1) year credit monitoring services, credit protection services, credit fraud alerts, and/or similar services which Ralliant in its sole discretion deems necessary to protect such affected individuals). Any such notice or remediation shall be at Supplier’s sole cost and expense. Supplier agrees to cooperate with Ralliant in any litigation or other formal action against third parties deemed necessary by Ralliant to protect its rights.
6. Equitable Relief and Indemnification.
   6.1. Without limiting any terms regarding remedies or liability in the Agreement, the parties acknowledge and agree that any breach of this Addendum by Supplier would cause Ralliant irreparable harm for which money damages would not be a sufficient remedy and that Ralliant is entitled to equitable relief (including, but not limited to, an injunction and specific performance) for any such breach, in addition to its remedies at law, without proof of actual damages.
   6.2. Supplier agrees to defend, indemnify, and hold harmless Ralliant from and against any and all liabilities, obligations, claims, damages, fines, penalties, assessments, costs and expenses (including court costs, reasonable costs of investigation and reasonable attorneys’ fees and expenses) incurred by Ralliant arising out of or in connection with Supplier’s performance or nonperformance under this Addendum. This Section shall not be subject to any disclaimer or limitation of liability set forth in the Agreement.
7. Return or Secure Disposal of Ralliant Assets. Except as otherwise expressly permitted under the Agreement, upon the termination or expiration of the Agreement or an applicable requirements document, Supplier will cease using Ralliant Assets and within ten (10) Business Days will return or Securely Dispose of (or ensure that such secure disposal occurs) all Customer Data in its possession or control related to such terminated or expired Services, including any and all copies and derivatives of such materials, in a manner consistent with applicable law (unless database storage or other arrangements have been agreed upon by the Parties or it is determined that returning or Securely Disposing of the Ralliant Assets is infeasible). Supplier shall extend the security protections of the Agreement to Ralliant Assets for as long as Supplier maintains Ralliant Assets. “Securely Dispose of” means following an industry standard procedure for complete destruction such as NIST Special Publication 800-88. Further, to the extent a sub-contactor is conducting the disposal, Supplier shall conduct due diligence on the subcontracting entity, which includes one of the following: (a) reviewing an independent audit of a disposal company’s operations and/or its compliance with these disposal terms; (b) obtaining information about the disposal company from several references; (c) requiring that the disposal company be certified by a recognized trade association; or (d) reviewing and evaluating the disposal company’s information security policies or procedures.
8. Privacy and Security by Design. Supplier acknowledges and agrees that privacy and data security shall be incorporated into the design and operation of the products or Services provided to Ralliant. Supplier acknowledges and agrees that its products or Services shall dynamically respond to changes in legal obligations, regulatory guidance, industry best practices, and known and foreseeable risks to Ralliant Assets. At a minimum, and without limiting any express obligations under the Agreement, Supplier shall incorporate privacy and data security protections into its products, services, and operations to protect and manage against foreseeable risks to Ralliant Assets. Throughout the design and operation of the products or Services, Supplier shall proactively present to Ralliant, and respond to Ralliant’s reasonable request for, alternative methods of design and operation that permit Ralliant to: (a) alter the level and type of physical, technical, and administrative safeguards applied to Ralliant Assets handled by or through Supplier’s products or Services; (b) modify the types and volume of Ralliant Assets handled by or through Supplier’s products or Services; (c) adjust the retention periods applied to Ralliant Assets handled by or through Supplier’s products or Services; and (d) review and modify the accuracy of Ralliant Assets handled by or through Supplier’s products or Services. In the event Ralliant elects to incorporate any such alternative methods of design and operation, Supplier shall work with Ralliant to implement the alternative methods under terms and conditions mutually agreeable to both parties.
9. Retained Ownership of Ralliant Assets. Ralliant owns all rights (including, but not limited to, intellectual property rights), title and interests in Ralliant Assets. Nothing in this Addendum grants any right, title or interest in any Ralliant Asset and Supplier shall not claim ownership of Ralliant Assets. Supplier shall act and is appointed solely as a “data processor” (or equivalent term under applicable data protection laws), such that it shall only carry out the instructions of Ralliant (“data controller”) with respect to its use, disclosure, and other processing of Customer Data, in particular the Personal Data/Personal Information.

1. Establishment of Detailed Asset Inventory
Actively inventory and manage all networking devices, hardware, operating systems, virtual machines, hypervisors, databases, cloud service platforms, services, software and other system services or functions (collectively referred to as “Assets”) utilized to access, manage, process, transport, store, report on, or support Ralliant Assets.

Only authorized Assets are given network or data access, and unauthorized and unmanaged Assets are found and prevented from gaining access to any Asset with access to Ralliant Assets.

2. Secure Configuration of Assets
Implement and actively manage (track, report on, correct) the security configuration of all Assets using a configuration management and change control process to prevent attackers from exploiting vulnerable services and settings. This includes ensuring:

1. Assets are hardened utilizing an industry standard best practice (such as Center for Internet Security Level 1 or better).
2. Assets are configured and hardened to provide only the necessary ports, protocols, and services to meet business needs, remove default or Supplier provided accounts, as well as utilize technical controls to mitigate or block (i.e., antivirus, file integrity monitoring and logging) as part of their baseline build standard or template.
3. Installation, updating and maintaining software that will provide security monitoring, alarming, and access tracking functionality for Assets.
4. Establishment of procedures to monitor and control remote data communication access to Supplier Assets and Ralliant Assets.
5. Actively manage all software on the network so that only authorized software is installed and can execute, and that unauthorized and unmanaged software is found and prevented from installation or execution.

3. Logical Access
Supplier will maintain processes and tools to request, approve, track, control, prevent, and correct secure access to Assets according to the formal determination of which persons, computers, and applications have a need and right to access Assets.

Supplier will ensure that no one other than personnel specifically appointed by Supplier to provide the Services outlined in this contract will be entitled to access Assets or Ralliant Assets, and access, in all cases, will be on a need to know / least privilege basis.

Supplier will establish procedures, forms, and approval levels for assigning, resetting, and disabling ID’s and passwords used for Ralliant Assets or Asset access by authorized personnel, and execute all related administration for user identification (IDs) and passwords in compliance with set policies.

Supplier must actively manage the life cycle of user, system and application accounts, their creation, use, and deletion to minimize opportunities for unauthorized use of Ralliant Assets.
Assets must be securely configured to prevent unauthorized users from accessing them. Such configuration must include at a minimum:

Authentication controls:

1. Strong password enablement
   a. Min 8 chars
   b. Combination of upper / lower chars, numbers, special chars
   c. Rotation at least every 90 days
   d. 24 password history – reuse prohibition
2. Multi-factor Authentication (yubi-key, hard or soft token, biometric) or single-sign on using Ralliant or other Identity Providers which provide MFA.
3. Lockout after multiple unsuccessful attempts
4. Automatic screen lockout when idle
5. Automatic session termination when idle
6. Automatic account disablement within 24 hours when not used for 180 days or when user no longer requires access to the asset (whether through reassignment or termination)

Role-based Access Controls:

1. Institution of the principle of “least privilege”.
2. Using role-based access controls to provide users with user abilities commensurate with their job responsibilities.

Using processes and tools to track, control, prevent, and correct the use, assignment, and configuration of administrative privileges on systems, networks, applications, and data.

4. Continuous Vulnerability Management
Continuously acquire, assess, and act on new information to identify vulnerabilities, remediate, and minimize the window of opportunity for attackers. This includes:

1. Regular scheduled network and infrastructure (OS, DB, host) scans.
2. Regular scheduled application-layer vulnerability scans.
3. Periodic (no less than annual) penetration tests (both black-box as well as credentialed) by a reputable third party to validate both the external defenses and web-application security. This report must be available to Ralliant upon request.
4. Threat modelling whenever significant changes occur.
5. Subscription to intelligence feeds from Suppliers and intelligence communities (such as US-CERT).

Actions on identified vulnerabilities include:

1. Institution of a patching program that patches:
   a. Critical/zero-days – all hands-on deck until patch has been applied
   b. Highs – within 30 days
   c. Mediums – within 90 days
   d. Lows – as time permits
   e. Informationals – as time permits
    
2. When vulnerabilities are unable to be patched (i.e., When a Supplier has not yet released an update):
   a. Mitigating mechanisms are put in place to reduce the exposure or exploitability of the vulnerability.

7. Malware Defenses
Control the installation, spread, and execution of malicious code at multiple points in the enterprise, while optimizing the use of automation to enable rapid updating of defense, data gathering, and corrective action.

Supplier agrees that the service or its associated Assets will not introduce any viruses or attempt to produce any backdoors or connections or access Ralliant Assets in any unauthorized way.

8. Business Continuity/Data Recovery
Maintain processes and tools to properly back up Ralliant Assets with a proven methodology to ensure the confidentiality, integrity, availability, and recoverability of that data. This includes:

1. Running the service with sufficiently high-availability environments with built-in redundancies to minimize downtime events and achieve any uptime SLA agreed between Supplier and Ralliant (including pre-planned downtime events coordinated with and agreed upon by Ralliant).
2. Employing Denial of Service/Distributed Denial of Service (DoS/DDoS) mitigations to ensure operational resilience and continuity of operations.
3. Running backups of Ralliant Assets which allows a restore of all data in accordance with Supplier’s business continuity requirements as defined in the Agreement or as otherwise agreed by the parties.
4. Supplier will store backups using a remote location when deemed necessary.
5. Supplier will test backup restoration and disaster recovery scenarios at least annually.
6. Supplier will maintain backups required to achieve the following:
   a. Recovery Time Objective: as per the Agreement, else without undue delay.
   b. Recovery Point Objective: as per the Agreement, else without undue delay.

10. Data Protection
Maintain processes and tools used to prevent data exfiltration, mitigate the effects of exfiltrated data, and ensure the confidentiality and integrity of Ralliant Assets. This includes the use of:

1. Encryption of data in transit and at rest.
   a. Strong encryption mechanisms and transfer protocols based on then current industry standards.
        i. AES (or any standard that replaces it) with a block size of at least 256 bits.
        ii. Secure transfer protocols, such as SFTP or TLS 1.2 or standards that replace them.
             1. Deprecated protocols such as TLS 1.0/1.1 may NOT be used
2. Logically segregating Ralliant Data from Supplier data and data of its other customers to prevent unauthorized data access.
3. Upon contract termination and reasonable agreed upon post-termination retention timeline, or when directed by Ralliant, purging data from Assets and backups using NIST 800-88 approved purging methods
4. Data loss prevention tools and techniques which technically enforce the unauthorized exfiltration of Ralliant Data
5. Store Ralliant Data on Assets located only in pre-determined and approved countries

12. Physical Security and Entry Control
Require that all facilities meet the highest level of data protection standards possible, and reasonable, under the circumstances relevant to the facility and the Assets or data it contains, process, or transmits.

1. All secure areas use access badges, and data center environments must use man traps and multi-factor authentication such as biometrics.
2. Sign in procedure must be in place for all third-party individuals.
3. All visitors to secure areas must be always escorted by authorized personnel.
4. All employees, contractors, etc. must always display ID badges.
5. All Secure areas and perimeter areas are monitored by 24/7x365 CCTV (with 90 days retention).
6. Clean desk, clear screen policy is in place.

13. Secure Development Lifecycles
Secure development life cycle must be established, and proper practices put in place to ensure that applications are developed, secured, and maintained. This includes, but is not limited to, the following practices:

1. Development environment being separate from production
2. Source code being stored in a secured environment
3. Developers being trained on secure development practices
4. Application being tested for proper functional design
5. Peer review over code performed to ensure sound logic and good programming practices
6. Static code analysis being run to test for vulnerabilities
7. Code signing to ensure only verified artifacts are deployed
8. Dynamic scans performed prior to deployment to production environments
9. Signoffs performed to ensure proper management awareness and that only authorized code is deployed
10. Deployment on properly configured and hardened Assets and environments
11. Deployment of a Web Application Firewall

14. Remote Access Control to the Ralliant Assets
In relation to Supplier-provided VPN, Supplier shall ensure at a minimum that:

1. All system administration from external networks is authenticated through the firewall, using a VPN.
2. All incoming VPN users are authenticated using an approved strong 2-factor authentication method.
3. Any such connections are encrypted in accordance with security industry recognized standards or best practice.
4. Any such connections are logged and monitored.
5. Any such sessions are timed out in accordance with the time out period as determined by Ralliant.

If Ralliant grants Supplier or Supplier Agents access to the Ralliant network through Ralliant’s VPN for the purpose of providing the Services, Supplier shall:

1. use the VPN access solely and exclusively for providing the Services;
2. keep confidential and not disclose to any third party the VPN access credentials provided to it by Ralliant;
3. use encryption in accordance with security industry recognized standards or best practice;
4. not permit any third party to access the Ralliant systems via the VPN access without the prior consent of Ralliant; and
5. install upon any Assets used to provide the VPN access the software required by Ralliant to protect the Ralliant systems and provide secure access to Ralliant Assets, and shall use that software at all times when using the Ralliant VPN and accessing Ralliant Assets.

In relation to site-to-site/business-to-business VPN, Supplier shall:

1. not permit any third party to access the Ralliant systems via the VPN access without the prior written consent of Ralliant;
2. use mutual authentication of end points;
3. use encryption and manage keys in accordance with security industry recognized standards or best practice;
4. log and monitor any such connections; and
5. Any such sessions shall be enabled with a configurable time out period as determined by Ralliant.

1. Implement a Comprehensive Information Security Management Program
Through the implementation of a Comprehensive Information Security Management Program (ISM), maintain various administrative safeguards to protect Ralliant Assets. These measures include:

1. maintaining the security, confidentiality, and integrity of Ralliant Assets
2. protecting against unauthorized access to or use of Ralliant Assets
3. ensuring that employees, contractors, consultants, temporaries, and other workers who have access to Ralliant Data only process such data on instructions from the Ralliant.
4. conducting and supporting IT risk assessments and security design reviews
5. effectively managing systems access control, user account management, maintenance of publicized security threats and monitoring developments in information security and implementing then-standard industry practices
6. performing periodic self-assessments to monitor overall compliance with the security measures
7. reviewing logs on a reasonable, periodic basis whether via automated or manual means
8. ensuring that all Supplier personnel or subcontractors that access Ralliant Assets are trained on security annually and that training is completed prior to access being granted
9. engaging with third parties to perform vulnerability scans; penetration tests; and tests of controls (i.e., SOC1, SOC2, ISO27001 or other industry recognized controls-based assertion/audit) of the Assets at least annually and provide resulting reports to Ralliant upon request
10. performing security audits, providing incident investigation support, and initiating corrective actions to minimize and prevent security breaches
11. responding to all security audit requests from Ralliant and its regulators
12. cooperating and assisting Ralliant with security tests as mutually coordinated and reasonably agreed
13. on an ongoing basis ensure that the ISM is designed, maintained, updated and adjusted as necessary to protect against internal and external risks.

2. Implement a Security Awareness and Training Program
For all functional roles (prioritizing those mission critical to the business, its security, and the protection of Ralliant Assets), identify the specific knowledge, skills and abilities needed to support the protection and defense of Ralliant Assets; develop and execute an integrated plan to assess, identify gaps, and remediate through policy, organizational planning, training, and awareness programs. Security awareness training must include:

1. Awareness of and acceptance of security policies
2. Tracked and recorded training of personnel during onboarding and prior to accessing Ralliant Assets; annual re-training thereafter
3. Signing of a non-disclosure agreement

4. Incident Response Management
Protect Assets and Ralliant Assets, as well as its reputation, by developing and implementing an incident response infrastructure (e.g., plans, defined roles, training, communications, management oversight, retainers, and insurance) for quickly discovering an attack and then effectively containing the damage, eradicating the attacker's presence, and restoring the integrity of the organization’s network and systems. This includes:

1. Having a 24x7 notification process to respond immediately when required by Ralliant to address breaches or suspected breaches of security in connection with the Services. Supplier’s team will coordinate with Ralliant’s Information Security Department and in the case of an emergency follow the reasonable instructions of Ralliant’s Information Security Department.
2. Supplier will promptly and without unreasonable delay, by phone, and promptly in writing (but in no event in more than twenty-four (24) hours) notify Ralliant if it becomes aware of:
   a. any material breach of Ralliant’s information security policies and / or procedures.
   b. any loss, unauthorized access, alteration, or destruction of Assets or Ralliant Assets.
3. Ralliant Security Operations Center: Email: RAL-SOC@ralliant.com; Take all necessary steps to remedy and provide Ralliant with updates on Supplier’s progress on a daily or other periodic basis reasonably specified by Ralliant.
4. Perform forensics to determine actors and causes
5. Provide a root-cause analysis
6. Remediate issues that resulted in the vulnerability which allowed for the event to occur
7. Carry appropriate levels of Cyber Insurance commensurate with the service offering and value of the data at risk, as agreed upon between the Supplier and Ralliant.

9. Personnel Screening
Supplier will perform background checks on personnel prior to providing them with access to Assets or Ralliant Assets. Background checks should include:

• Seven (7) year criminal background check
• Credit background check (for roles or positions where financials are concerned)
• Confirmation of education and employment
• Specially designated nationals (OFAC) check