Common use of Breach of Security Clause in Contracts

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 of this Call Off Schedule, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security to the extent necessary protect the integrity of the Customer Property and/or Customer Assets to the extent within its control against any such Breach of Security or any potential or attempted Breach of Security; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off Schedule, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 9: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch this Call Off Schedule to “Not Used” if not required.] [OPTION 1]

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 103.1 of this Call Off ScheduleContract Schedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Suppliers control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s Suppliers ability to provide the Goods and/or Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleContract Schedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF CONTRACT SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of RECOVERY DEFINITIONS In this Contract Schedule 8, the Template Call Off Terms. Switch this Call Off Schedule to “Not Used” if not required.] [OPTION 1]following definitions shall apply:

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 103.1 of this Call Off ScheduleSchedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch RECOVERY DEFINITIONS In this Call Off Schedule to “Not Used” if not required.] [OPTION 1]8, the following definitions shall apply:

Breach of Security. Either Each Party shall promptly notify the other in accordance with the agreed security incident management process as defined by the ISMS Security Plan upon becoming aware that a Breach of any breach of security or any potential Security or attempted or potential Breach of SecuritySecurity has or may have taken place. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 of this Call Off Schedule48, the Supplier Service Provider shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the CustomerPurchaser) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security to the extent necessary possible and protect the integrity of the Customer Property and/or Customer Assets Purchaser’s System and the Service Provider’s System to the extent within its control against any such Breach of Security or any attempted or potential or attempted Breach of SecuritySecurity and provide the Purchaser details of any mitigation measures recommended by the Service Provider to be taken by the Purchaser in respect of the Purchaser’s System within the control of the Purchaser; apply a tested mitigation against any such Breach of Security or attempted or potential Breach of Security and and, provided that reasonable testing has been undertaken by the SupplierService Provider, if the mitigation adversely affects the SupplierService Provider’s ability to provide deliver the Services so as to meet the relevant Service Level Performance MeasuresLevels (if applicable), the Supplier Service Provider shall be granted relief against any resultant under-performance for such period as the CustomerPurchaser, acting reasonably, may specify by written notice to the SupplierService Provider; prevent a further Breach of Security or attempted or potential Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request Purchaser within two (2) Working Days of the Purchaser’s request and without charge (where such requests are reasonably related to a possible incident or compromise); and investigate the Breach of Security or attempted or potential Breach of Security completely and promptly and as soon as reasonably practicable provide to the Customer Purchaser full details (using the reporting mechanism defined by the ISMSSecurity Plan) of the Breach of Security or attempted or potential Breach of Security, including a root cause analysis where required by the CustomerPurchaser. In the event that If any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS Security Plan with the Baseline Security Policy Standards or the requirements of this Call Off Schedule, then any required change to the ISMS Security Plan shall be at no cost to the CustomerPurchaser. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 9: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 Following any of the Template Call Off Terms. Switch this Call Off Schedule circumstances referred to “Not Used” if not requiredin paragraph 48, the Service Provider shall: where required to do so, inform any applicable regulator of the Breach of Security or attempted or potential Breach of Security; and take any action deemed necessary by the Purchaser in the circumstances, including complying with any additional security measures deemed appropriate by the Purchaser.] [OPTION 1]

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 106.1 of this Call Off Schedule, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security to the extent necessary protect the integrity of the Customer Property and/or Customer Assets to the extent within its control against any such Breach of Security or any potential or attempted Breach of Security; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Goods and/or Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off Schedule, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 9: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch this Call Off Schedule to “Not Used” if not required.] [OPTION 1]

Breach of Security. Either Each Party shall promptly notify the other in accordance with the agreed security incident management process as defined by the ISMS Security Plan upon becoming aware that a Breach of any breach of security or any potential Security or attempted or potential Breach of SecuritySecurity has or may have taken place. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 of this Call Off Schedule7.1, the Supplier Service Provider shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the CustomerPurchaser) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security to the extent necessary possible and protect the integrity of the Customer Property and/or Customer Assets Purchaser’s System and the Service Provider’s System to the extent within its control against any such Breach of Security or any attempted or potential or attempted Breach of SecuritySecurity and provide the Purchaser details of any mitigation measures recommended by the Service Provider to be taken by the Purchaser in respect of the Purchaser’s System within the control of the Purchaser; apply a tested mitigation against any such Breach of Security or attempted or potential Breach of Security and and, provided that reasonable testing has been undertaken by the SupplierService Provider, if the mitigation adversely affects the SupplierService Provider’s ability to provide deliver the Services so as to meet the relevant Service Level Performance MeasuresLevels (if applicable), the Supplier Service Provider shall be granted relief against any resultant under-performance for such period as the CustomerPurchaser, acting reasonably, may specify by written notice to the SupplierService Provider; prevent a further Breach of Security or attempted or potential Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request Purchaser within two (2) Working Days of the Purchaser’s request and without charge (where such requests are reasonably related to a possible incident or compromise); and investigate the Breach of Security or attempted or potential Breach of Security completely and promptly and as soon as reasonably practicable provide to the Customer Purchaser full details (using the reporting mechanism defined by the ISMSSecurity Plan) of the Breach of Security or attempted or potential Breach of Security, including a root cause analysis where required by the CustomerPurchaser. In the event that If any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS Security Plan with the Baseline Security Policy Standards or the requirements of this Call Off Schedule, then any required change to the ISMS Security Plan shall be at no cost to the CustomerPurchaser. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 9: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 Following any of the Template Call Off Terms. Switch this Call Off Schedule circumstances referred to “Not Used” if not requiredin paragraph 7.1, the Service Provider shall: where required to do so, inform any applicable regulator of the Breach of Security or attempted or potential Breach of Security; and take any action deemed necessary by the Purchaser in the circumstances, including complying with any additional security measures deemed appropriate by the Purchaser.] [OPTION 1]

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 103.1 of this Call Off ScheduleSchedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Goods and/or Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ [Guidance Note: The Contracting Authority’s Security Policy should be inserted here as appropriate.] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ Security Management Plan [Guidance Note: The Contracting Authority’s Security Management Plan should be inserted here as appropriate.] [CALL OFF SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch RECOVERY DEFINITIONS In this Call Off Schedule to “Not Used” if not required.] [OPTION 1]8, the following definitions shall apply:

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach breach of Securitysecurity. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 113.1 of this Call Off Schedule, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach breach of Security to the extent necessary security or any potential or attempted breach of security or protect the integrity of the Customer Property and/or Customer Assets to the extent within its control ISMS against any such Breach breach of Security security or any potential or attempted Breach breach of Securitysecurity; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach breach of Security security or any potential or attempted Breach breach of Security security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the such reporting mechanism as defined by the ISMS) of the Breach breach of Security security or the potential or attempted Breach breach of Securitysecurity, including a root cause analysis where required by the Customer. In the event that any such action is taken in response to a Breach breach of Security security or potential or attempted Breach breach of Security security that demonstrates non-compliance of the ISMS with the Security Policy or security requirements (as set out in Annex 1 (Security) to this Call Off Schedule) or the requirements of this Call Off Schedule, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN Security Management Plan [ ] CALL OFF SCHEDULE 9: SUPPLIER SOFTWARE, CUSTOMER SOFTWARE AND THIRD PARTY SOFTWARE [Guidance Note: See the definitions of the Supplier Software and Third Party Software and consider Clause 33. If necessary, insert below details of any specific software packages that the Supplier will use to provide the Services] SUPPLIER SOFTWARE [ ] THIRD PARTY SOFTWARE [ ] CUSTOMER SOFTWARE [ ] 12/08/2013 [CALL OFF SCHEDULE 910: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 14 of the Template Call Off Terms. Switch this Call Off Schedule to “Not Used” Used if not required.] [OPTION 1]

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 5.38 of this Call Off ScheduleSchedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Goods and/or Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch RECOVERY DEFINITIONS In this Call Off Schedule to “Not Used” if not required.] [OPTION 1]8, the following definitions shall apply:

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 17.1 of this Call Off ScheduleSchedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch RECOVERY DEFINITIONS In this Call Off Schedule to “Not Used” if not required.] [OPTION 1]8, the following definitions shall apply:

Breach of Security. Either Party party shall notify the other in accordance with the agreed security incident management process (as defined by detailed in the ISMS Security Management Plan if one exists) upon becoming aware of any breach Breach of security Security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 of this Call Off Schedule95.1, the Supplier shall: immediately take all reasonable steps (which steps(which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security to the extent necessary possible and protect the integrity of the Customer Property and/or Customer Assets and the provision of the Services to the extent within its control against any such Breach of Security or any potential or attempted Breach of Security; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or attempted Breach of Security an equivalent breach in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer, where the Customer so requests, full details (using the reporting mechanism defined by the ISMSSecurity Management Plan if one exists) of the Breach of Security or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS Security Management Plan with the Security Policy policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS Security Management Plan shall be at no cost to the Customer. 12/08/2013 ANNEX 1: 1 INFORMATION SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 9: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 REQUIREMENTS FOR e-DISCLOSURE EXERCISES AT ‘OFFICIAL’ CLASSIFICATION INTRODUCTION These security requirements apply in respect of all e-Disclosure exercises called- off and conducted under this Framework Agreement, such always being exercises where the Contracting Authority’s mitigating measures are influenced by the current and previous HMG protective marking schemes. This Annex 1 is in respect of information protectively marked at OFFICIAL and OFFICIAL-Sensitive and/or, in respect of the Template Call predecessor scheme, UNCLASSIFIED, PROTECT, RESTRICTED, CONFIDENTIAL, and related security controls recommended for protecting information marked under either scheme. These controls are spread across the technology, processes and people involved in delivering any specific system, service or solution. It is with this understanding that this information security requirement has been developed. The Supplier shall be required, for the duration of the Framework Agreement and any Call-Off Terms. Switch this Call Off Schedule Agreements, to “Not Used” if not required.] [OPTION 1]provide Services that comply with the following: legislation: Data Protection Act 1998 Computer Misuse Act 1990 as amended Part 2 of the Serious Crime Act 2015 Communications Act 2003 Regulatory and Investigatory Powers Act 2000 HMG security requirements (as per the relevant hyperlinks below): Security considerations for protecting OFFICIAL information on a corporate network Cloud Security Principles End User Device security; and

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 85.1 of this Call Off ScheduleSchedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Services so as to meet the relevant Service Level Performance MeasuresServices, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch RECOVERY DEFINITIONS In this Call Off Schedule to “Not Used” if not required.] [OPTION 1]8, the following definitions shall apply:

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 103.1 of this Call Off ScheduleSchedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Goods and/or Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch RECOVERY DEFINITIONS In this Call Off Schedule to “Not Used” if not required.] [OPTION 1]8, the following definitions shall apply:

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 6.38 of this Call Off ScheduleSchedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this is within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Goods and/or Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 9: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch this Call Off Schedule to “Not Used” if not required.] [OPTION 1]

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 5.38 of this Call Off ScheduleLease Agreement Schedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this is within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Goods and/or Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleLease Agreement Schedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 9: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch this Call Off Schedule to “Not Used” if not required.] [OPTION 1]

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 8.1 of this Call Off ScheduleSchedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the CustomerContracting Authority) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security to the extent necessary protect the integrity of the Customer Property and/or Customer Assets to the extent within its control against any such Breach of Security or any potential or attempted Breach of SecuritySecurity in order to protect the integrity of the Contracting Authority Property and/or Contracting Authority Assets and/or ISMS to the extent that this within the Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the CustomerContracting Authority, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer Contracting Authority (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the CustomerContracting Authority’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer Contracting Authority full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the CustomerContracting Authority. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 9: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch this Call Off Schedule to “Not Used” if not requiredContracting Authority.] [OPTION 1]

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 93.1 of this Call Off ScheduleSchedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the CustomerContracting Authority) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security to the extent necessary protect the integrity of the Customer Property and/or Customer Assets to the extent within its control against any such Breach of Security or any potential or attempted Breach of SecuritySecurity in order to protect the integrity of the Contracting Authority Property and/or Contracting Authority Assets and/or ISMS to the extent that this within the Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the CustomerContracting Authority, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer Contracting Authority (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the CustomerContracting Authority’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer Contracting Authority full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the CustomerContracting Authority. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS shall be at no cost to the CustomerContracting Authority. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch RECOVERY DEFINITIONS In this Call Off Schedule to “Not Used” if not required.] [OPTION 1]8, the following definitions shall apply:

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 96.1 of this Call Off Schedule, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security to the extent necessary protect the integrity of the Customer Property and/or Customer Assets to the extent within its control against any such Breach of Security or any potential or attempted Breach of Security; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off Schedule, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 9: BUSINESS CONTINUITY AND DISASTER RECOVERY] RECOVERY [Guidance Note: See Clause 15 13 of the Template Call Off Terms. Switch this Call Off Schedule to “Not Used” if not required.] [OPTION 1]

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 33.1 of this Call Off ScheduleSchedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch RECOVERY DEFINITIONS In this Call Off Schedule to “Not Used” if not required.] [OPTION 1]8, the following definitions shall apply:

Breach of Security. Either Each Party shall promptly notify the other in accordance with the agreed security incident management process as defined by the ISMS Security Plan upon becoming aware that a Breach of any breach of security or any potential Security or attempted or potential Breach of SecuritySecurity has or may have taken place. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 of this Call Off Schedule7, the Supplier Service Provider shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the CustomerPurchaser) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security to the extent necessary possible and protect the integrity of the Customer Property and/or Customer Assets Purchaser’s System and the Service Provider’s System to the extent within its control against any such Breach of Security or any attempted or potential or attempted Breach of SecuritySecurity and provide the Purchaser details of any mitigation measures recommended by the Service Provider to be taken by the Purchaser in respect of the Purchaser’s System within the control of the Purchaser; apply a tested mitigation against any such Breach of Security or attempted or potential Breach of Security and and, provided that reasonable testing has been undertaken by the SupplierService Provider, if the mitigation adversely affects the SupplierService Provider’s ability to provide deliver the Services so as to meet the relevant Service Level Performance MeasuresLevels (if applicable), the Supplier Service Provider shall be granted relief against any resultant under-performance for such period as the CustomerPurchaser, acting reasonably, may specify by written notice to the SupplierService Provider; prevent a further Breach of Security or attempted or potential Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request Purchaser within two (2) Working Days of the Purchaser’s request and without charge (where such requests are reasonably related to a possible incident or compromise); and investigate the Breach of Security or attempted or potential Breach of Security completely and promptly and as soon as reasonably practicable provide to the Customer Purchaser full details (using the reporting mechanism defined by the ISMSSecurity Plan) of the Breach of Security or attempted or potential Breach of Security, including a root cause analysis where required by the CustomerPurchaser. In the event that If any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS Security Plan with the Baseline Security Policy Standards or the requirements of this Call Off Schedule, then any required change to the ISMS Security Plan shall be at no cost to the CustomerPurchaser. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 9: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 Following any of the Template Call Off Terms. Switch this Call Off Schedule circumstances referred to “Not Used” if not requiredin paragraph 7, the Service Provider shall: where required to do so, inform any applicable regulator of the Breach of Security or attempted or potential Breach of Security; and take any action deemed necessary by the Purchaser in the circumstances, including complying with any additional security measures deemed appropriate by the Purchaser.] [OPTION 1]

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 108.1 of this Call Off ScheduleSchedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Products and/or Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch RECOVERY DEFINITIONS In this Call Off Schedule to “Not Used” if not required.] [OPTION 1]8, the following definitions shall apply:

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach breach of Securitysecurity. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 113.1 of this Call Off Schedule, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach breach of Security to the extent necessary security or any potential or attempted breach of security or protect the integrity of the Customer Property and/or Customer Assets to the extent within its control ISMS against any such Breach breach of Security security or any potential or attempted Breach breach of Securitysecurity; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach breach of Security security or any potential or attempted Breach breach of Security security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the such reporting mechanism as defined by the ISMS) of the Breach breach of Security security or the potential or attempted Breach breach of Securitysecurity, including a root cause analysis where required by the Customer. In the event that any such action is taken in response to a Breach breach of Security security or potential or attempted Breach breach of Security security that demonstrates non-compliance of the ISMS with the Security Policy or security requirements (as set out in Annex 1 (Security) to this Call Off Schedule ) or the requirements of this Call Off Schedule, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN Security Management Plan [ ] CALL OFF SCHEDULE 9: SUPPLIER SOFTWARE, CUSTOMER SOFTWARE AND THIRD PARTY SOFTWARE [Guidance Note: See the definitions of the Supplier Software and Third Party Software and consider Clause 33. If necessary, insert below details of any specific software packages that the Supplier will use to provide the Services] SUPPLIER SOFTWARE [ ] THIRD PARTY SOFTWARE [ ] CUSTOMER SOFTWARE [ ] 12/08/2013 [CALL OFF SCHEDULE 910: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 14 of the Template Call Off Terms. Switch this Call Off Schedule to “Not Used” Used if not required.] [OPTION 1]

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 8.1 of this Call Off ScheduleSchedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the CustomerContracting Authority) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security to the extent necessary protect the integrity of the Customer Property and/or Customer Assets to the extent within its control against any such Breach of Security or any potential or attempted Breach of SecuritySecurity in order to protect the integrity of the Contracting Authority Property and/or Contracting Authority Assets and/or ISMS to the extent that this within the Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the CustomerContracting Authority, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer Contracting Authority (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the CustomerContracting Authority’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer Contracting Authority full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the CustomerContracting Authority. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS shall be at no cost to the CustomerContracting Authority. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch RECOVERY DEFINITIONS In this Call Off Schedule to “Not Used” if not required.] [OPTION 1]8, the following definitions shall apply:

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 8.1 of this Call Off ScheduleSchedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Products and/or Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 Security Policy 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [Security Management Plan CALL OFF SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch RECOVERY Definitions In this Call Off Schedule to “Not Used” if not required.] [OPTION 1]8, the following definitions shall apply:

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 105.1 of this Call Off ScheduleSchedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Goods and/or Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch RECOVERY DEFINITIONS In this Call Off Schedule to “Not Used” if not required.] [OPTION 1]8, the following definitions shall apply:

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 103.1 of this Call Off Schedule, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Goods and Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off Schedule, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch RECOVERY DEFINITIONS In this Call Off Schedule to “Not Used” if not required.] [OPTION 1]8, the following definitions shall apply:

Breach of Security. Either Party party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS Security Management Plan upon becoming aware of any breach Breach of security Security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 of this Call Off Schedule4.1, the Supplier shall: immediately take all reasonable steps (which necessary to: remedy such breach or protect the integrity of the Customer against any such potential or attempted breach or threat; and prevent an equivalent breach in the future; and ensure that: such steps shall include any action or changes reasonably required by the Customer) necessary to: minimise . In the extent of actual or potential harm caused event that such action is taken in response to a breach that is determined by any Breach of Security; remedy such Breach of Security the Customer acting reasonably not to be covered by the extent necessary protect the integrity obligations of the Customer Property and/or Customer Assets to the extent within its control against any such Breach of Security or any potential or attempted Breach of Security; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the SupplierSupplier under this Contract, if the mitigation adversely affects the Supplier’s ability to provide the Services so as to meet the relevant Service Level Performance Measures, then the Supplier shall be granted relief against any resultant under-performance for such period as entitled to refer the Customer, acting reasonably, may specify by written notice matter to the Supplier; prevent a further Breach of Security or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise)Variation Procedure; and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off Schedule, then any required change to the ISMS shall be at no cost to the CustomerSecurity. 12/08/2013 ANNEX 1SCHEDULE 3: SECURITY POLICY [ ] 12/08/2013 ANNEX 2GUARANTEE NOT USED schedule 4: SECURITY MANAGEMENT PLAN [ ] [CALL OFF TESTING NOT USED SCHEDULE 95: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 RECOVERY PURPOSE OF THIS SCHEDULE This Schedule 5 sets out the Customer's requirements for ensuring continuity of the Template Call Off Termsbusiness processes and operations supported by the Services in circumstances of Service disruption or failure and for restoring the Services through business continuity and as necessary disaster recovery procedures. Switch It also includes the requirement on the Supplier to develop, review, test, change and maintain a BCDR Plan in respect of the Services. The BCDR Plan shall be divided into three parts: Part A which shall set out general principles applicable to the BCDR Plan ("General Principles"). Part B which shall relate to business continuity ("Business Continuity Plan"); and Part C which shall relate to disaster recovery ("Disaster Recovery Plan"); and The BCDR Plan shall detail the processes and arrangements which the Supplier shall follow to ensure continuity of the business processes and operations supported by the Services following any failure or disruption of any element of the Services and the recovery of the Services in the event of a Disaster. DEVELOPMENT OF BCDR PLAN The BCDR Plan shall unless otherwise required by the Customer in writing, be based upon and be consistent with the provisions of paragraphs 3 and 5 of this Call Off Schedule to “Not Used” if not required5. The Supplier shall ensure that its Sub-Contractors' disaster recovery and business continuity plans are integrated with the BCDR Plan.] [OPTION 1]

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 83.38 of this Call Off ScheduleSchedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Supplier’s control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Goods and/or Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch RECOVERY DEFINITIONS In this Call Off Schedule to “Not Used” if not required.] [OPTION 1]8, the following definitions shall apply:

Breach of Security. Either Each Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS immediately upon becoming aware of any breach Breach of security or any Security including, but not limited to an actual, potential or attempted Breach of Securitybreach, or threat to, the Security Plan. Without prejudice to the security incident management process, upon Upon becoming aware of any of the circumstances referred to in paragraph 102.1 of this Call Off Schedule5.1, the Supplier Consultant shall: immediately take all reasonable steps (which necessary to: remedy such breach or protect the Consultant System against any such potential or attempted breach or threat; and prevent an equivalent breach in the future. Such steps shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security to the extent necessary protect the integrity of the Customer Property and/or Customer Assets to the extent within its control against any such Breach of Security or any potential or attempted Breach of Security; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and Agency. as soon as reasonably practicable provide to the Customer Agency full details (using the such reporting mechanism defined as may be specified by the ISMSAgency from time to time) of the Breach of Security such actual, potential or attempted Breach breach and of Security, including the steps taken in respect thereof. Appendix 1 OUTLINE SECURITY PLAN STAFF VETTING PROCEDURES CHANGE PROCEDURE PRINCIPLES Where the Agency or the Consultant see the need for a root cause analysis where required Change either Party may at any time request such Change only in accordance with the Change Control Procedures set out in this Schedule 6. For the purposes of the Agreement: a "Change Request" is a request for a Change by either Party (such Party being the "Requester"); and a "CCN" is a change control notice issued by the Customer. In Party receiving a Change Request (being the event that any action is taken "Recipient") in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance Change Request. Either Party may request a Change by submitting a Change Request with the Recipient completed and detailing the proposed Change to the other Party. Subject to paragraph 1.6, each Change Request shall be in the form attached as Appendix 1 to this Schedule 6. Each Change Request shall contain the details of the ISMS request, including: whether or not the Change will require an amendment to the Agreement or the Schedules; sufficient information or deliverables which the Requester needs to give to the Recipient to enable it to make an assessment of the Change Request, or if that is not possible at that time, a statement identifying the information or deliverable the Requester is to provide and the name of the person who will provide it and when; the requested completion or delivery date (taking into account the timings set out in this Schedule 6); and priority of the Change Request against other Changes that are subject to the Change Control Procedure at that time. Each Change Request for the Change Control Procedure shall be in the form of the Change Request attached as Appendix 1 to this Schedule 6 and shall contain: the Change Request identification number issued by the Requester (if applicable); the title of the Change; the originator and date of the request or recommendation for the Change; the reason for the Change; full details of the Change including any specifications; where the Change Request originated from the Consultant, details of any dependencies, including in particular, any Agency or Consultant requirements in relation to those Changes which, if implemented, would have a material impact on the Consultancy Services, on the existing terms of this Agreement, on any Document or otherwise on the Agency, the Consultant's impact assessment in accordance with the Security Policy provisions of paragraph 2 (inclusive) ("Impact Assessment"); a timetable for implementation together with any proposals for acceptance of the Change; the date of expiry of validity of the Change Request provided that no Change Request shall be valid for less than 3 months; and provision for signature by the Agency and by the Consultant. A Change Request or CCN shall become a Change Order when the requirements of the Change Control Procedure have been satisfied and the CCN is signed by the duly authorised signatories of both Parties to signify their approval to the Change. The Parties shall conduct discussions relating to proposed Changes in good faith and neither Party shall unreasonably withhold or delay its agreement to any proposed Change submitted by the other provided that : the Agency shall not be obliged to agree to any Change increasing the price payable or requiring the Agency to incur any material expenditure, disruption or interference. If the Agency does not agree to such Change increasing the price, the Consultant shall not be obliged to implement such Change; The Consultant shall not be obliged to agree to any Change:- placing the Consultant in breach of any Law; or for which it does not have the requisite skills or expertise to implement. Any dispute arising as to whether the Consultant has the necessary skills or expertise to implement any such Change shall be dealt with under the Dispute Resolution Procedure. Until such time as a Change is made in accordance with these Change Control Procedures or any procedure set out in Schedule 2, the Consultant shall, unless otherwise agreed in writing, continue to perform its obligations under Schedule 2 of the Agreement as if the request or recommendation had not been made. Any discussions which may take place between the Agency and the Consultant in connection with a request or recommendation before the authorisation of a resultant Change to the subject matter of Schedule 2 or of the Agreement shall be without prejudice to the rights of either Party. The Consultant will maintain a hardcopy file of all Change Orders (including Change Requests) for the lifetime of the Agreement and a spreadsheet detailing which Change Orders are still active in the operation and which have expired. If the Consultant is completing a number of Changes at any one time, the Agency must inform the Consultant of its priorities for implementing those Changes. If the Consultant does not meet or is unlikely to meet the timelines relating to any Changes as a result of such prioritisation, the Consultant will keep the Agency informed of this Call Off Schedulefact and will not be liable for any such failures. If the Agency reasonably considers that it requires further information regarding the proposed Change or modifications to the Change Request, then any required change to it shall notify the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 9: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 Consultant of the Template Call Off Termsfurther information or modifications required. Switch The Consultant shall then re-submit the Change Request or provide the additional information within ten Working Days of receiving such notification. The Parties may repeat the process described in this Call Off Schedule to “Not Used” if not required.] [OPTION 1]paragraph 1.13 as necessary

Breach of Security. Either Party party shall notify the other in accordance with the agreed security incident management process (as defined by detailed in the ISMS Security Management Plan if one exists) upon becoming aware of any breach Breach of security Security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 of this Call Off Schedule77.1, the Supplier Service Provider shall: immediately take all reasonable steps (which steps(which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security to the extent necessary possible and protect the integrity of the Customer Property and/or Customer Assets and the provision of the Services to the extent within its control against any such Breach of Security or any potential or attempted Breach of Security; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s ability to provide the Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or attempted Breach of Security an equivalent breach in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer, where the Customer so requests, full details (using the reporting mechanism defined by the ISMSSecurity Management Plan if one exists) of the Breach of Security or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS Security Management Plan with the Security Policy policy or the requirements of this Call Off ScheduleSchedule 7, then any required change to the ISMS Security Management Plan shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] The Customer’s Security Policy wil be added to the Call Off Order Form 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 8: BUSINESS CONTINUITY AND DISASTER RECOVERY A BUSINESS CONTINUITY AND DISASTER RECOVERY PLAN (“BCDR PLAN”) HAS BEEN AGREED WITH THE AUTHORITY AND IS AVAILABLE FROM THE AUTHORITY, ON DEMAND. 12/08/2013 CALL OFF SCHEDULE 9: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch EXIT MANAGEMENT DEFINITIONS In this Call Off Schedule to “Not Used” if not required.] [OPTION 1]9, the following definitions shall apply:

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 8.1 of this Call Off ScheduleContract Schedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Suppliers control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s Suppliers ability to provide the Goods and/or Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleContract Schedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF SCHEDULE 9: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of the Template Call Off Terms. Switch this Call Off Schedule to “Not Used” if not required.] [OPTION 1]

Breach of Security. Either Party shall notify the other in accordance with the agreed security incident management process as defined by the ISMS upon becoming aware of any breach of security or any potential or attempted Breach of Security. Without prejudice to the security incident management process, upon becoming aware of any of the circumstances referred to in paragraph 102.1 78.38 of this Call Off ScheduleContract Schedule 7, the Supplier shall: immediately take all reasonable steps (which shall include any action or changes reasonably required by the Customer) necessary to: minimise the extent of actual or potential harm caused by any Breach of Security; remedy such Breach of Security or any potential or attempted Breach of Security in order to the extent necessary protect the integrity of the Customer Property and/or Customer Assets and/or ISMS to the extent that this within its control against any such Breach of Security or any potential or attempted Breach of Securitythe Suppliers control; apply a tested mitigation against any such Breach of Security or attempted Breach of Security and provided that reasonable testing has been undertaken by the Supplier, if the mitigation adversely affects the Supplier’s Suppliers ability to provide the Goods and/or Services so as to meet the relevant Service Level Performance Measures, the Supplier shall be granted relief against any resultant under-performance for such period as the Customer, acting reasonably, may specify by written notice to the Supplier; prevent a further Breach of Security or any potential or attempted Breach of Security in the future exploiting the same root cause failure; and supply any requested data to the Customer (or the Computer Emergency Response Team for UK Government (“GovCertUK”)) on the Customer’s request within two (2) Working Days and without charge (where such requests are reasonably related to a possible incident or compromise); and as soon as reasonably practicable provide to the Customer full details (using the reporting mechanism defined by the ISMS) of the Breach of Security or the potential or attempted Breach of Security, including a root cause analysis where required by the Customer. In the event that any action is taken in response to a Breach of Security or potential or attempted Breach of Security that demonstrates non-compliance of the ISMS with the Security Policy or the requirements of this Call Off ScheduleContract Schedule 7, then any required change to the ISMS shall be at no cost to the Customer. 12/08/2013 ANNEX 1: SECURITY POLICY [ ] 12/08/2013 ANNEX 2: SECURITY MANAGEMENT PLAN [ ] [CALL OFF CONTRACT SCHEDULE 98: BUSINESS CONTINUITY AND DISASTER RECOVERY] [Guidance Note: See Clause 15 of RECOVERY DEFINITIONS In this Contract Schedule 8, the Template Call Off Terms. Switch this Call Off Schedule to “Not Used” if not required.] [OPTION 1]following definitions shall apply: