Common use of Buyer’s Responsibilities Clause in Contracts

Buyer’s Responsibilities. The Buyer is responsible for The Buyer is responsible for providing access to the systems (e.g. POISE devices if required) to allow testing as defined within Section 4 Prerequisites for Testing of the proposal QINETIQ/SHC/246/022/PR/1.0 dated 30/01/25 and access to other systems as may be required for this Call-Off. Clause 3 CUSTOMER OBLIGATIONS of the QinetiQ TERMS & CONDITIONS FOR PENETRATION TESTING SERVICES SHC/CSG5152/SALES/PENTESTING_V1.13 shall apply as per Service ID 430041730948625. In addition, the Buyer will be responsible for the assumptions and dependencies outlined in schedule 1 of this Call-Off Contract. Buyer’s equipment All work to be done on Supplier’s equipment. Buyer may provide POISE devices as required. Supplier's information One subcontractor: CODA Security Limited Call-Off Contract charges and payment The Call-Off Contract charges and payment details are in the table below. See Schedule 2 for a full breakdown. The payment method for this Call-Off Contract is BACS. Payment to be made once the deliverable has been submitted by the Supplier and has been accepted by the [SRO] or nominated deputy in accordance with the acceptance criteria and process contained in schedule 1. The Supplier will issue electronic invoices upon completion of the Services. The Buyer will pay the Supplier within 30 days of receipt of a valid undisputed invoice. Invoices will be sent to 9 Invoice information required All invoices must include: PO Reference Number A short description of the service per line item The applicable amount with a breakdown of the Charges The call off contract reference. Invoice frequency As set out above. Call-Off Contract value The total value of this Call-Off Contract is Call-Off Contract charges The breakdown of the Charges is outlined in Schedule 2 of this Call- Off Contract. Additional Buyer terms Performance of the Service As outlined in Schedule 1 of this Call-Off Contract, and as per proposal QINETIQ/SHC/246/022/PR/1.0 Guarantee N/A Warranties, representations N/A Supplemental requirements in addition to the Call-Off terms N/A Alternative clauses These Alternative Clauses, which have been selected from Schedule 4, will apply: N/A Buyer specific amendments to/refinements of the Call-Off Contract terms If the parties agree to make a variation under the Call-Off Contract (Clause 32), the details of that variation shall be specified and confirmed in writing by the parties. The Supplier shall not be obliged to implement any variation until it has been so confirmed and any revision to the Price and any timetable of work has been agreed in writing. If the parties do not agree to make a variation to the Call-Off Contract, the Supplier shall continue to provide the Call-Off Contract as previously agreed. The Supplier acknowledges that, in entering this Call-Off contract, no volume guarantee has been granted by the buyer for services from the Supplier. Personal Data and Data Subjects Schedule 7 is not being used. The Parties do not intend QinetiQ to act as Data Processor on behalf of the Customer in relation to the Captured Data except to the extent required to comply with its obligations under this Call-Off; QinetiQ TERMS & CONDITIONS FOR PENETRATION TESTING SERVICES SHC/CSG5152/SALES/PENTESTING_V1.13 shall apply, as per G- cloud 14 Service ID 430041730948625 ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇▇▇▇▇.▇▇▇.▇▇/g- cloud/services/430041730948625 Intellectual Property All outputs/deliverables produced and accepted under the Terms and Conditions of this Call-Off Contract shall vest and be retained by the Buyer, except for any pre-existing Intellectual Property Rights of the Supplier and any enhancements and/or modifications of the same made during the Call-Off Contract Term, which shall vest in and be retained by the Supplier. The remainder of the provisions under Clause 11 of Part B: Terms and conditions shall apply. Social Value The Supplier will support Home Office to deliver against the Social Value Model Theme of Economic Inequality through delivering initiatives to drive the development of scalable and future-proofed new methods to modernise delivery and increase productivity. The Supplier will achieve this by: • Utilising industry best practice methodologies proven on government programmes • Implementing continuous improvement processes across all services • Promoting organisational learning to our workforce and the Home Office workforce • Incorporating our supply chain into the innovation, continuous improvement, and organisational learning activities. Performance Indicators Data supplied by the Supplier in relation to Performance Indicators is deemed the Intellectual Property of the Buyer and may be published by the Buyer. [Note required Performance Indicators needed from the Supplier for future publication or otherwise] The test objectives are met, as defined in QINETIQ/SHC/246/022/PR/1.0 Section 2.1, and the test report is issued before the contract ends on 28th March 2025. ISO 9001 QinetiQ quality report, marked “OFFICIAL-SENSITIVE” and to be delivered within 10 working days via encrypted email as per ▇▇▇▇▇▇▇ proposal QINETIQ/SHC/246/022/PR/1.0 Section 6.1 Analysis and Deliverable Preparation.

Buyer’s Responsibilities. The Buyer is responsible for The Buyer is responsible for providing ensuring the supplier has access to the systems (e.g. POISE devices if required) MODNet to allow testing as defined within Section 4 Prerequisites for Testing of enable the proposal QINETIQ/SHC/246/022/PR/1.0 dated 30/01/25 and access supplier to other systems as may undertake its duties. Buyer’s equipment The Buyer’s equipment to be required for this Call-Off. Clause 3 CUSTOMER OBLIGATIONS of the QinetiQ TERMS & CONDITIONS FOR PENETRATION TESTING SERVICES SHC/CSG5152/SALES/PENTESTING_V1.13 shall apply as per Service ID 430041730948625. In addition, the Buyer will be responsible for the assumptions and dependencies outlined in schedule 1 of used with this Call-Off ContractContract includes: ● Provision of access to MODNet including any relevant UAD. Buyer’s equipment All work to be done on Reason: To deliver the scope of requirement Supplier’s equipmentinformation Subcontractors or partners The following is a list of the Supplier’s Subcontractors or Partners. Buyer may provide POISE devices as required. Supplier's information One subcontractor: CODA Security Limited Not applicable Call-Off Contract charges and payment The Call-Off Contract charges and payment details are in the table below. See Schedule 2 for a full breakdown. Payment method The payment method for this Call-off Contract is CP&F [Buyer] and Exostar [Supplier]. Payment profile The payment profile for this Call-Off Contract is BACSmonthly in arrears based on the total effort expended to achieve delivery of the expected outcomes. Payment to be made once the deliverable has been submitted by the Supplier and has been accepted by the [SRO] or nominated deputy in accordance with the acceptance criteria and process contained in schedule 1. Invoice details The Supplier will issue electronic invoices upon completion of the Servicesmonthly in arrears. The Buyer will pay the Supplier within 30 days of receipt of a valid undisputed invoice. Who and where to send invoices to Invoices will be sent electronically via CP&F alongside a copy of the invoice to 9 the Project Manager ( Invoice information required All invoices must include: PO Reference Number A short description of the service per line item The applicable amount with a breakdown of the Charges The call off contract referenceinclude Purchase order, project reference and specific milestones being claimed. Invoice frequency As set out aboveInvoice will be sent to the Buyer Monthly. Call-Off Contract value The total value of this This Call-Off Contract is contract has a total contract value of £295,700.00 ex VAT Call-Off Contract charges The breakdown of the Charges is outlined as shown in Schedule 2 of this Call- Off Contract2. Additional Buyer terms Performance of the Service As outlined in Schedule 1 of this and Deliverables This Call-Off ContractContract will include the following Implementation Plan, exit and offboarding plans and milestones: The Supplier shall agree a hand over /off boarding plan with the MOD for each service requirement. These are likely to be staggered as per proposal QINETIQ/SHC/246/022/PR/1.0 the requirement for some Service provisions may end before the contract term. Guarantee N/A Not Applicable Warranties, representations N/A Not applicable Supplemental requirements in addition to the Call-Off terms NT&S limits All T&S must be approved by the Authority’s Project Manager or nominated DD representative prior to bookings being made/A or costs incurred. Failure to secure prior acceptance will result in the rejection of associated T&S costs and invoices. The Fixed Price includes the cost of T&S associated with being based in Main Building London. Travel: Allowance Type Rate Public Transport Economy only Motor Mileage Allowance - Up to 10000 miles 30p per mile - Over 10000 miles 25p per mile Motorcycle Allowance 24p per mile Subsistence: You can claim Receipted expenditure, within the detailed limits below. These are not flat-rate payments but ceilings for actual expenditure incurred. The ceilings therefore are not cumulative and apply only to the specific element of the claim. Supplier must obtain and retain itemised receipts for all claims. Allowance Type Rate Over 5 hours £5.00 Over 10 hours £10.00 Over 12 Hours £15.00 Evening Meal (overnight stay) £22.50 Breakfast (where not included) £10.00 Alcohol: Cannot be claimed for. The Total Limit for T&S shall £500 + VAT for this contract Term Alternative clauses These Alternative Clauses, which have been selected from Schedule 4, will apply: N/A Not applicable Buyer specific amendments to/refinements of the Call-Off Contract terms If These additional clauses will apply: • DEFCON 76 12/06 -Contractors Personnel At Government Establishments • DEFCON 129J 18/11/16 –The use of the parties agree to make a variation under the Call-Off Contract (Clause 32), the details of that variation shall be specified and confirmed in writing by the parties. The Supplier shall not be obliged to implement any variation until it has been so confirmed and any revision electronic business delivery form • DEFCON 503 07/21 –Formal Amendments to the Price contract • DEFCON 520 05/18 -Corrupt Gifts And Payments Of Commission • DEFCON 532A04/20 –Protection of Personal Data (Where Data is not being processed on behalf on the Authority) • DEFCON 531 -11/14 Disclosure Of Information • DEFCON 602B 12/06 -Quality Assurance (Without Deliverable Quality Plan) • DEFCON 627 11/21 Quality Assurance –Requirement for a Certificate of Conformity • DEFCON 632 11/21 –Third Party Intellectual Property –Rights and any timetable of work has been agreed in writing. If Restrictions • DEFCON 658 –Cyber ( • DEFCON 659A –Security Measure • DEFCON 703 06/21 Intellectual Property Rights – Vesting In the parties do not agree to make a variation to the Call-Off Contract, the Supplier shall continue to provide the Call-Off Contract as previously agreed. The Supplier acknowledges that, in entering this Call-Off contract, no volume guarantee has been granted by the buyer for services from the Supplier. Authority Public Services Network (PSN) Not applicable Personal Data and Data Subjects As stated in Annex 1 of Schedule 7 is not being used. The Parties do not intend QinetiQ to act as Data Processor on behalf of the Customer in relation to the Captured Data except to the extent required to comply with its obligations under this Call-Off; QinetiQ TERMS & CONDITIONS FOR PENETRATION TESTING SERVICES SHC/CSG5152/SALES/PENTESTING_V1.13 shall apply, as per G- cloud 14 Service ID 430041730948625 ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇▇▇▇▇.▇▇▇.▇▇/g- cloud/services/430041730948625 Intellectual Property All outputs/deliverables produced and accepted under the Terms and Conditions of this Call-Off Contract shall vest and be retained by the Buyer, except for any pre-existing Intellectual Property Rights of the Supplier and any enhancements and/or modifications of the same made during the Call-Off Contract Term, which shall vest in and be retained by the Supplier. The remainder of the provisions under Clause 11 of Part B: Terms and conditions shall apply. Social Value The Supplier will support Home Office to deliver against the Social Value Model Theme of Economic Inequality through delivering initiatives to drive the development of scalable and future-proofed new methods to modernise delivery and increase productivity. The Supplier will achieve this by: • Utilising industry best practice methodologies proven on government programmes • Implementing continuous improvement processes across all services • Promoting organisational learning to our workforce and the Home Office workforce • Incorporating our supply chain into the innovation, continuous improvement, and organisational learning activities. Performance Indicators Data supplied by the Supplier in relation to Performance Indicators is deemed the Intellectual Property of the Buyer and may be published by the Buyer. [Note required Performance Indicators needed from the Supplier for future publication or otherwise] The test objectives are met, as defined in QINETIQ/SHC/246/022/PR/1.0 Section 2.1, and the test report is issued before the contract ends on 28th March 2025. ISO 9001 QinetiQ quality report, marked “OFFICIAL-SENSITIVE” and to be delivered within 10 working days via encrypted email as per ▇▇▇▇▇▇▇ proposal QINETIQ/SHC/246/022/PR/1.0 Section 6.1 Analysis and Deliverable Preparationoff Contract.

Buyer’s Responsibilities. The Buyer is responsible for The Buyer is responsible to provide reasonable and appropriate assistance to the Supplier as necessary for providing them to deliver their obligations under this contract. for example, access to the systems (e.g. POISE devices if required) to allow testing as defined within Section 4 Prerequisites for Testing of the proposal QINETIQ/SHC/246/022/PR/1.0 dated 30/01/25 and access to other systems as may be any MoJ site required for this Call-Off. Clause 3 CUSTOMER OBLIGATIONS the supplier to fulfil delivery of the QinetiQ TERMS & CONDITIONS FOR PENETRATION TESTING SERVICES SHC/CSG5152/SALES/PENTESTING_V1.13 shall apply as per Service ID 430041730948625. In additiontheir services, the Buyer will be responsible for the assumptions and dependencies outlined in schedule 1 of this Call-Off Contractproviding reference material or contact details. Buyer’s equipment All work to be done on Provision of MoJ Laptops and IT equipment. Supplier’s equipment. Buyer may provide POISE devices as required. Supplier's information One subcontractor: CODA Security Limited Subcontractors or partners N/A. Call-Off Contract charges and payment The Call-Off Contract charges and payment details are in the table below. See Schedule 2 for a full breakdown. Payment method The payment method for this Call-Off Contract is BACS. Payment to be made once profile The payment profile for this Call-Off Contract is based on the deliverable has been submitted by the Supplier completion of agreed milestones and has been accepted by the [SRO] or nominated deputy paid in accordance with the acceptance criteria and process contained in schedule 1arrears. Invoice details The Supplier will issue electronic invoices upon following the completion of the Servicesa signed off milestone achievement certificate and will be submitted in arrears. The Buyer will pay the Supplier within 30 calendar days of receipt of a valid undisputed invoice. Who and where to send invoices to ALL Invoices will be sent to 9 to: ▇▇▇▇▇▇▇▇▇▇-▇▇▇-▇@▇▇▇▇.▇▇▇.▇▇▇.▇▇ Shared Services Celtic Springs Business Park, PO Box 767 Newport. NP10 8FZ Invoice information required All invoices must include: include Call-Off Contract and PO Reference Number A short description of the service per line item The applicable amount with a breakdown of the Charges The call off contract referencereferences. Invoice frequency As set out aboveInvoice(s) will be sent to the Buyer in arrears and following the completion of the agreed milestones. Call-Off Contract value The total value of this Call-Off Contract is £3,000,000 exc VAT. Call-Off Contract charges The breakdown of the Charges is outlined detailed in Schedule 2 of this Call- Off Contract. Additional Buyer terms Performance of the Service As outlined in Schedule 1 of this and Deliverables This Call-Off Contract, Contract will include the milestones with associated Deliverables as attached at Schedule 1 and as per proposal QINETIQ/SHC/246/022/PR/1.0 payments will be made against those Deliverables. Guarantee N/A Warranties, representations N/A Supplemental requirements in addition to the Call-Off terms N/A Within the scope of the Call-Off Contract, the Supplier will sign an ethical walls agreement. Alternative clauses These Alternative Clauses, which have been selected from Schedule 4, will apply: N/A Buyer specific amendments to/refinements of the Call-Off Contract terms If the parties agree to make a variation under the Call-Off Contract N/A Public Services Network (Clause 32), the details of that variation shall be specified and confirmed in writing by the parties. The Supplier shall not be obliged to implement any variation until it has been so confirmed and any revision to the Price and any timetable of work has been agreed in writing. If the parties do not agree to make a variation to the Call-Off Contract, the Supplier shall continue to provide the Call-Off Contract as previously agreed. The Supplier acknowledges that, in entering this Call-Off contract, no volume guarantee has been granted by the buyer for services from the Supplier. PSN) N/A Personal Data and Data Subjects Schedule 7 is not being used. The Parties do not intend QinetiQ to act as Data Processor on behalf of the Customer in relation to the Captured Data except to the extent required to comply with its obligations under this Call-Off; QinetiQ TERMS & CONDITIONS FOR PENETRATION TESTING SERVICES SHC/CSG5152/SALES/PENTESTING_V1.13 shall apply, as per G- cloud 14 Service ID 430041730948625 ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇▇▇▇▇.▇▇▇.▇▇/g- cloud/services/430041730948625 Intellectual Property All outputs/deliverables produced and accepted under the Terms and Conditions of this Call-Off Contract shall vest and be retained by the Buyer, except for any pre-existing Intellectual Property Rights of the Supplier and any enhancements and/or modifications of the same made during the Call-Off Contract Term, which shall vest in and be retained by the Supplier. The remainder of the provisions under Clause 11 of Part B: Terms and conditions shall apply. Social Value The Supplier will support Home Office to deliver against the Social Value Model Theme of Economic Inequality through delivering initiatives to drive the development of scalable and future-proofed new methods to modernise delivery and increase productivity. The Supplier will achieve this by: • Utilising industry best practice methodologies proven on government programmes • Implementing continuous improvement processes across all services • Promoting organisational learning to our workforce and the Home Office workforce • Incorporating our supply chain into the innovation, continuous improvement, and organisational learning activities. Performance Indicators Data supplied by the Supplier in relation to Performance Indicators is deemed the Intellectual Property of the Buyer and may be published by the Buyer. [Note required Performance Indicators needed from the Supplier for future publication or otherwise] The test objectives are met, as defined in QINETIQ/SHC/246/022/PR/1.0 Section 2.1, and the test report is issued before the contract ends on 28th March 2025. ISO 9001 QinetiQ quality report, marked “OFFICIAL-SENSITIVE” and to be delivered within 10 working days via encrypted email as per ▇▇▇▇▇▇▇ proposal QINETIQ/SHC/246/022/PR/1.0 Section 6.1 Analysis and Deliverable Preparation.See Annex 1

Buyer’s Responsibilities. The Buyer Buyer’s responsibilities shall be set out in each service definition and in each individual Statement of Work. Buyer’s equipment Where the Supplier is responsible required to use Buyer’s equipment for The Buyer is responsible for providing access to the systems (e.g. POISE devices if required) to allow testing as defined within Section 4 Prerequisites for Testing of the proposal QINETIQ/SHC/246/022/PR/1.0 dated 30/01/25 and access to other systems as may be required for this Call-Off. Clause 3 CUSTOMER OBLIGATIONS of the QinetiQ TERMS & CONDITIONS FOR PENETRATION TESTING SERVICES SHC/CSG5152/SALES/PENTESTING_V1.13 shall apply as per Service ID 430041730948625. In additioninformation governance and/or security reasons, the Buyer will Buyer’s equipment to be responsible for the assumptions and dependencies outlined in schedule 1 of used within this Call-Off Contract. Buyer’s equipment All work Contract includes Buyer supplied laptop devices, smartcard/dongles and access to be done on Buyer files and emails, including MS ▇▇▇▇▇; MS Office suite including Teams; Project related access and tooling; Mural; Confluence & Jira; Sharepoint Supplier’s equipment. Buyer may provide POISE devices as required. Supplier's information One subcontractor: CODA Security Limited Subcontractors or partners Not Applicable Call-Off Contract charges and payment The Call-Off Contract charges and payment details are in the table below. See Schedule 2 for a full breakdown. Payment method By electronic transfer to Suppliers nominated account by BACS. Payment profile The payment method profile for this Call-Off Contract is BACSas per each Statement of Work which is set out in Schedule 2. Payment to be made once the deliverable has been submitted by the Supplier and has been accepted by the [SRO] or nominated deputy in accordance with the acceptance criteria and process contained in schedule 1. Invoice details The Supplier will issue electronic invoices upon on completion of the Servicesmilestones as set out in Schedule 2. The Buyer will pay the Supplier within 30 days of receipt of a valid undisputed invoice. Invoices will Who and where to send invoices to Where electronic invoices are emailed, they shall be sent emailed to 9 the following SSCL shared inbox: REDACTED TEXT under FOIA Section 40 A copy with supporting MI should also be emailed to REDACTED TEXT under FOIA Section 40 Invoice information required All invoices must includeas a minimum include the following: • DWP Purchase Order Number (invoices without PO number will be rejected) • DWP Contract Reference Number A short description - ecm_11844 • Supplier remittance address • Details of service carried out • Charges • VAT element of cost • Remittance date • Due Date The invoice format will follow the standard Supplier invoice format mirroring the necessary information as described in Part B, clause 7.5 of the service per line item Call-Off Contract. The applicable amount Buyer will pay the Supplier within thirty (30) calendar days of receipt of a valid invoice, submitted in accordance with a breakdown this paragraph, the payment profile set out and the provisions of the Charges The call off contract referencethis Call-Off Contract. Invoice frequency As set out aboveInvoice will be sent to the Buyer following Acceptance by the Buyer of each Milestone. Call-Off Contract value The total value of this Call-Off Contract is £2,000,000.00 exc VAT - with optional extension of £1,000,000.00 exc VAT VAT will be charged at the rate prevailing on the date of invoice. Call-Off Contract charges The detailed breakdown of the Charges is outlined in Schedule 2 of this Call- Off Contract. Additional Buyer terms Performance for the provision of the Service As outlined Services during the Term shall be as set out in Schedule 1 each individual Statement of this Call-Off Contract, Work. Where Supplier expenses are applicable and as per proposal QINETIQ/SHC/246/022/PR/1.0 Guarantee N/A Warranties, representations N/A Supplemental requirements agreed in addition to the Call-Off terms N/A Alternative clauses These Alternative Clauses, which have been selected from Schedule 4, will apply: N/A Buyer specific amendments to/refinements advance of the Call-Off Contract terms If Statement of Work, such expenses are capped at the parties agree to make a variation under the Call-Off Contract (Clause 32), the details value stated in such Statement of that variation shall be specified and confirmed in writing by the parties. The Supplier shall Work; may not be obliged transferred or carried forward into other Statements of Work; and are to implement any variation until it has been so confirmed and any revision to the Price and any timetable of work has been agreed be charged in writing. If the parties do not agree to make a variation to the Call-Off Contract, the Supplier shall continue to provide the Call-Off Contract as previously agreed. The Supplier acknowledges that, in entering this Call-Off contract, no volume guarantee has been granted by the buyer for services from the Supplier. Personal Data and Data Subjects Schedule 7 is not being used. The Parties do not intend QinetiQ to act as Data Processor on behalf of the Customer in relation to the Captured Data except to the extent required to comply accordance with its obligations under this Call-Off; QinetiQ TERMS & CONDITIONS FOR PENETRATION TESTING SERVICES SHC/CSG5152/SALES/PENTESTING_V1.13 shall apply, as per G- cloud 14 Service ID 430041730948625 ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇▇▇▇▇.▇▇▇.▇▇/g- cloud/services/430041730948625 Intellectual Property All outputs/deliverables produced and accepted under the Terms and Conditions of this Call-Off Contract shall vest and be retained by the Buyer, except for any pre-existing Intellectual Property Rights of the Supplier and any enhancements and/or modifications of the same made during the Call-Off Contract Term, which shall vest in and be retained by the Supplier. The remainder of the provisions under Clause 11 of Part B: Terms and conditions shall apply. Social Value The Supplier will support Home Office to deliver against the Social Value Model Theme of Economic Inequality through delivering initiatives to drive the development of scalable and future-proofed new methods to modernise delivery and increase productivity. The Supplier will achieve this by: • Utilising industry best practice methodologies proven on government programmes • Implementing continuous improvement processes across all services • Promoting organisational learning to our workforce and the Home Office workforce • Incorporating our supply chain into the innovation, continuous improvement, and organisational learning activities. Performance Indicators Data supplied by the Supplier in relation to Performance Indicators is deemed the Intellectual Property of the Buyer and may be published by the Buyer. [Note required Performance Indicators needed from the Supplier for future publication or otherwise] The test objectives are met, as defined in QINETIQ/SHC/246/022/PR/1.0 Section 2.1, and the test report is issued before the contract ends on 28th March 2025. ISO 9001 QinetiQ quality report, marked “OFFICIAL-SENSITIVE” and to be delivered within 10 working days via encrypted email as per ▇▇▇▇▇▇▇ proposal QINETIQ/SHC/246/022/PR/1.0 Section 6.1 Analysis and Deliverable Preparation.’s expenses policy

Buyer’s Responsibilities. The Buyer is responsible for The Buyer is responsible for providing ensuring the supplier has access to the systems (e.g. POISE devices if required) MODNet to allow testing as defined within Section 4 Prerequisites for Testing of enable the proposal QINETIQ/SHC/246/022/PR/1.0 dated 30/01/25 and access supplier to other systems as may undertake its duties. Buyer’s equipment The Buyer’s equipment to be required for this Call-Off. Clause 3 CUSTOMER OBLIGATIONS of the QinetiQ TERMS & CONDITIONS FOR PENETRATION TESTING SERVICES SHC/CSG5152/SALES/PENTESTING_V1.13 shall apply as per Service ID 430041730948625. In addition, the Buyer will be responsible for the assumptions and dependencies outlined in schedule 1 of used with this Call-Off ContractContract includes: • Provision of access to MODNet including any relevant UAD. Buyer’s equipment All work to be done on Reason: To deliver the scope of requirement Supplier’s equipmentinformation Subcontractors or partners The following is a list of the Supplier’s Subcontractors or Partners. Buyer may provide POISE devices as required. Supplier's information One subcontractor: CODA Security Limited Not applicable Call-Off Contract charges and payment The Call-Off Contract charges and payment details are in the table below. See Schedule 2 for a full breakdown. Payment method The payment method for this Call-Off Contract is BACSby electronic transfer and prior to submitting any claims for payment the Contractor will be required to register their details (Supplier onboarding) on the Contracting, Purchasing and Finance (CP&F) electronic procurement tool Payment profile The payment profile for this Call-Off Contract is monthly in arrears based on the total effort expended to achieve delivery of the expected outcomes. Payment to be made once the deliverable has been submitted by the Supplier and has been accepted by the [SRO] or nominated deputy in accordance with the acceptance criteria and process contained in schedule 1. Invoice details The Supplier will issue electronic invoices upon completion of the Servicesmonthly in arrears. The Buyer will pay the Supplier within 30 days of receipt of a valid undisputed invoice. Who and where to send invoices to Invoices will be sent to 9 , Defence Digital, MOD ▇▇▇▇▇▇▇, ▇▇▇▇▇▇▇▇▇ ▇▇▇▇, ▇▇▇▇▇▇▇, ▇▇▇▇▇▇▇▇▇, ▇▇▇▇ ▇▇▇; Email: Invoice information required All invoices must include: include the contract reference number (RM1557/PS087) and PO Reference Number A short description of the service per line item The applicable amount with number. Invoices must provide a full breakdown of the Charges The call off contract referencecosts incurred for the Authority’s review and approval. Invoice frequency As set out aboveInvoice will be sent to the Buyer Monthly. Call-Off Contract value The total value of this This Call-Off Contract is contract has a total contract value of £623,734.90 Excluding VAT, including £65,000.00 ex vat T&S LOL. Call-Off Contract charges The breakdown of the Charges is outlined as shown in Schedule 2 of this Call- Off Contract2. Additional Buyer terms Performance of the Service As outlined in Schedule 1 of this and Deliverables This Call-Off ContractContract will include the following Implementation Plan, exit and offboarding plans and milestones: The Supplier shall agree a hand over /off boarding plan with the MOD for each service requirement. These are likely to be staggered as per proposal QINETIQ/SHC/246/022/PR/1.0 the requirement for some Service provisions may end before the contract term. Guarantee N/A Not Applicable Warranties, representations N/A Not applicable Supplemental requirements in addition to the Call-Off terms NT&S limits All T&S must be approved by the Authority’s Project Manager or nominated DD representative prior to bookings being made/A or costs incurred. Failure to secure prior acceptance will result in the rejection of associated T&S costs and invoices. Travel: Allowance Type Rate Public Transport Economy only Motor Mileage Allowance - Up to 10000 miles per mile - Over 10000 miles per mile Motorcycle Allowance per mile Subsistence: You can claim Receipted expenditure, within the detailed limits below. These are not flat-rate payments but ceilings for actual expenditure incurred. The ceilings therefore are not cumulative and apply only to the specific element of the claim. Supplier must obtain and retain itemised receipts for all claims. Allowance Type Rate Over 5 hours Over 10 hours Over 12 Hours Evening Meal (overnight stay) Breakfast (where not included) Alcohol: Cannot be claimed for. The Total Limit for T & S shall be £65,000.00 + VAT for this contract Term. Defence Cyber Protection Partnership (DCPP): Risk reference: RAR- 114878148, risk level is Low. Supplier to complete and return Supplier Assurance Questionnaire (SAQ). If supplier does not meet the standard, an improvement plan to be submitted to Commercial. Supplier to supply a valid Cyber Essentials Plus Certificate to Commercial. DEFCON 658 and as ▇▇▇ ▇▇▇▇ 05-138 applies. Security Aspects Letter applies, dated 01/04/2022, entitled PS087, Chief Data Officer Flexible Delivery Partner. Supplier acknowledges and complies with SAL by signing contract. Defcon 94 applies. Suppler to sign and return. IR35: This is considered a Managed Service, therefore the Authority is not the engaging party and not responsible for the IR35 determination. Alternative clauses These Alternative Clauses, which have been selected from Schedule 4, will apply: N/A Not applicable Buyer specific amendments to/refinements of the Call-Off Contract terms If Not applicable Public Services Network (PSN) Not applicable Personal Data and Data Subjects Not applicable 1. Formation of contract 1.1 By signing and returning this Order Form (Part A), the parties Supplier agrees to enter into a CallOff Contract with the Buyer. 1.2 The Parties agree that they have read the Order Form (Part A) and the Call-Off Contract terms and by signing below agree to make a variation under be bound by this Call-Off Contract. 1.3 This Call-Off Contract will be formed when the Buyer acknowledges receipt of the signed copy of the Order Form from the Supplier. 1.4 In cases of any ambiguity or conflict, the terms and conditions of the Call-Off Contract (Clause 32), the details Part B) and Order Form (Part A) will supersede those of that variation shall be specified and confirmed in writing by the parties. The Supplier shall not be obliged to implement any variation until it has been so confirmed and any revision to the Price and any timetable of work has been agreed in writing. If the parties do not agree to make a variation to the Call-Off Contract, the Supplier shall continue to provide the Call-Off Contract as previously agreed. The Supplier acknowledges that, in entering this Call-Off contract, no volume guarantee has been granted by the buyer for services from the Supplier. Personal Data and Data Subjects Schedule 7 is not being used. The Parties do not intend QinetiQ to act as Data Processor on behalf of the Customer in relation to the Captured Data except to the extent required to comply with its obligations under this Call-Off; QinetiQ TERMS & CONDITIONS FOR PENETRATION TESTING SERVICES SHC/CSG5152/SALES/PENTESTING_V1.13 shall apply, as per G- cloud 14 Service ID 430041730948625 ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇▇▇▇▇.▇▇▇.▇▇/g- cloud/services/430041730948625 Intellectual Property All outputs/deliverables produced and accepted under the Terms and Conditions as per the order of this Call-Off Contract shall vest and be retained by the Buyer, except for any pre-existing Intellectual Property Rights precedence set out in clause 8.3 of the Supplier and any enhancements and/or modifications of the same made during the Call-Off Contract Term, which shall vest in and be retained by the Supplier. The remainder of the provisions under Clause 11 of Part B: Terms and conditions shall apply. Social Value The Supplier will support Home Office to deliver against the Social Value Model Theme of Economic Inequality through delivering initiatives to drive the development of scalable and future-proofed new methods to modernise delivery and increase productivity. The Supplier will achieve this by: • Utilising industry best practice methodologies proven on government programmes • Implementing continuous improvement processes across all services • Promoting organisational learning to our workforce and the Home Office workforce • Incorporating our supply chain into the innovation, continuous improvement, and organisational learning activities. Performance Indicators Data supplied by the Supplier in relation to Performance Indicators is deemed the Intellectual Property of the Buyer and may be published by the Buyer. [Note required Performance Indicators needed from the Supplier for future publication or otherwise] The test objectives are met, as defined in QINETIQ/SHC/246/022/PR/1.0 Section 2.1, and the test report is issued before the contract ends on 28th March 2025. ISO 9001 QinetiQ quality report, marked “OFFICIAL-SENSITIVE” and to be delivered within 10 working days via encrypted email as per ▇▇▇▇▇▇▇ proposal QINETIQ/SHC/246/022/PR/1.0 Section 6.1 Analysis and Deliverable PreparationFramework Agreement.

Buyer’s Responsibilities. The Buyer is responsible for The Buyer is responsible for providing access to the systems (e.g. POISE devices if required) to allow testing as defined within Section 4 Prerequisites for Testing of the proposal QINETIQ/SHC/246/022/PR/1.0 dated 30/01/25 and access to other systems as may be required for this Call-Off. Clause 3 CUSTOMER OBLIGATIONS of the QinetiQ TERMS & CONDITIONS FOR PENETRATION TESTING SERVICES SHC/CSG5152/SALES/PENTESTING_V1.13 shall apply as per Service ID 430041730948625. In addition, the Buyer will be responsible for the assumptions and dependencies outlined in schedule 1 of this Call-Off Contract. ensuring: Mapping capability Buyer’s equipment All work to be done on Not applicable as it is all cloud/virtual Supplier’s equipment. Buyer may provide POISE devices as required. Supplier's information One subcontractor: CODA Security Limited Subcontractors or partners Not Applicable Call-Off Contract charges and payment The Call-Off Contract charges and payment details are in the table below. See Schedule 2 for a full breakdown. Payment method The payment method for this Call-Off Contract is BACS. Payment to be made once the deliverable has been submitted by the Supplier and has been accepted by the [SRO] or nominated deputy profile The payment profile for this Call-Off Contract is monthly in accordance with the acceptance criteria and process contained in schedule 1arrears. Invoice details The Supplier will issue electronic invoices upon completion of the Servicesmonthly in arrears. The Buyer will pay the Supplier within 30 days of receipt of a valid undisputed invoice. Who and where to send invoices to Invoices will be sent to 9 REDACTED. Invoice information required All invoices must includeinclude : PO Reference Number A short description Compliant purchase Order, project reference CCSO20A85 Payment can only be made following satisfactory delivery of pre-agreed certified products and deliverables. Before payment can be considered, each invoice must include a detailed elemental breakdown of work completed and the associated costs. Invoices should be submitted to: REDACTED Invoice frequency Invoice will be sent to the Buyer every 5th working day of the service per line item The applicable amount with a breakdown of the Charges The call off contract reference. Invoice frequency As set out abovemonth. Call-Off Contract value The total value of this Call-Off Contract is £1,800,000.00. Call-Off Contract charges The breakdown of the Charges is outlined in Schedule 2 [enter information here]. [Supplier day rates should only be used to calculate the Charges for performance of this Call- Off Contractthe service and Deliverables. All invoiced Charges will be for delivery of the service and Deliverables.] Additional Buyer terms Performance of the Service As outlined in Schedule 1 of this and Deliverables This Call-Off ContractContract will include the following Implementation Plan, exit and off boarding plans to be drafted within 1 month of the Contract Award. The deliverables are defined on the next page Milestone/Delivera ble Description Timeframe or Delivery Date 1 To correct existing bugs and undertake Within immediate development work as per proposal QINETIQeffect on day agreed and directed by the one of the ResilienceDirect team. Contract to clear the bug and backlog list. 2 To work in conjunction with other ResilienceDirect suppliers to ensure Single Sign On works seamlessly with the ResilienceDirect mapping Within immediate effect on Contract Award date capability; and throughout contract. 3 To ensure system interoperability with other core ResilienceDirect capabilities, for example to develop the products based on Within immediate effect on Contract Award date emerging technologies and to and support the user community. throughout contract. 4 To ensure flexibility in service provision must be available, in particular the ability to increase or Within the first 4 weeks of Contract Award date decrease the service and provision as required to throughout provide scalability contract. 5 To review the outcome/SHC/246/022outputs from all meetings with the CCS/PR/1.0 RD team. Within the first 4 weeks of Contract Award date and throughout contract. Guarantee N/A Not Applicable Warranties, representations N/A Not Applicable Supplemental requirements in addition to the Call-Off terms N/A Not Applicable Alternative clauses These Alternative Clauses, which have been selected from Schedule 4, will apply: N/A Not Applicable Buyer specific amendments to/refinements of the Call-Off Contract terms If the parties agree to make a variation under the Call-Off Contract Not Applicable Public Services Network (Clause 32), the details of that variation shall be specified and confirmed in writing by the parties. The Supplier shall not be obliged to implement any variation until it has been so confirmed and any revision to the Price and any timetable of work has been agreed in writing. If the parties do not agree to make a variation to the Call-Off Contract, the Supplier shall continue to provide the Call-Off Contract as previously agreed. The Supplier acknowledges that, in entering this Call-Off contract, no volume guarantee has been granted by the buyer for services from the Supplier. PSN) Not Applicable Personal Data and Data Subjects Confirm whether Annex 1 (and Annex 2, if applicable) of Schedule 7 is not being used. The Parties do not intend QinetiQ to act : [Delete as Data Processor on behalf of the Customer in relation to the Captured Data except to the extent required to comply with its obligations under this Call-Off; QinetiQ TERMS & CONDITIONS FOR PENETRATION TESTING SERVICES SHC/CSG5152/SALES/PENTESTING_V1.13 shall applyappropriate] Annex 1, as per G- cloud 14 Service ID 430041730948625 ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇▇▇▇▇.▇▇▇.▇▇/g- cloud/services/430041730948625 Intellectual Property All outputs/deliverables produced and accepted under the Terms and Conditions of this Call-Off Contract shall vest and be retained by the Buyer, except for any pre-existing Intellectual Property Rights of the Supplier and any enhancements and/or modifications of the same made during the Call-Off Contract Term, which shall vest in and be retained by the Supplier. The remainder of the provisions under Clause 11 of Part B: Terms and conditions shall apply. Social Value The Supplier will support Home Office to deliver against the Social Value Model Theme of Economic Inequality through delivering initiatives to drive the development of scalable and future-proofed new methods to modernise delivery and increase productivity. The Supplier will achieve this by: • Utilising industry best practice methodologies proven on government programmes • Implementing continuous improvement processes across all services • Promoting organisational learning to our workforce and the Home Office workforce • Incorporating our supply chain into the innovation, continuous improvement, and organisational learning activities. Performance Indicators Data supplied by the Supplier in relation to Performance Indicators is deemed the Intellectual Property of the Buyer and may be published by the Buyer. [Note required Performance Indicators needed from the Supplier for future publication or otherwise] The test objectives are met, as defined in QINETIQ/SHC/246/022/PR/1.0 Section 2.1, and the test report is issued before the contract ends on 28th March 2025. ISO 9001 QinetiQ quality report, marked “OFFICIAL-SENSITIVE” and to be delivered within 10 working days via encrypted email as per ▇▇▇▇▇▇▇ proposal QINETIQ/SHC/246/022/PR/1.0 Section 6.1 Analysis and Deliverable Preparation.Annex 2

Buyer’s Responsibilities. The Buyer Buyer’s responsibilities shall be set out in each service definition and in each individual Statement of Work. Buyer’s equipment Where the Supplier is responsible required to use Buyer’s equipment for The Buyer is responsible for providing access to the systems (e.g. POISE devices if required) to allow testing as defined within Section 4 Prerequisites for Testing of the proposal QINETIQ/SHC/246/022/PR/1.0 dated 30/01/25 and access to other systems as may be required for this Call-Off. Clause 3 CUSTOMER OBLIGATIONS of the QinetiQ TERMS & CONDITIONS FOR PENETRATION TESTING SERVICES SHC/CSG5152/SALES/PENTESTING_V1.13 shall apply as per Service ID 430041730948625. In additioninformation governance and/or security reasons, the Buyer will Buyer’s equipment to be responsible for the assumptions and dependencies outlined in schedule 1 of used within this Call-Off ContractContract includes Buyer supplied laptop devices, smartcard/dongles and access to Buyer files and emails, including MS ▇▇▇▇▇; MS Office suite including Teams; Project related access and tooling; Mural; Confluence & Jira; Sharepoint. Buyer’s equipment All work to be done on Supplier’s equipment. Buyer may provide POISE devices as required. Supplier's information One subcontractor: CODA Security Limited Subcontractors or partners Not Applicable Call-Off Contract charges and payment The Call-Off Contract charges and payment details are in the table below. See Schedule 2 for a full breakdown. Payment method By electronic transfer to Suppliers nominated account by BACS. Payment profile The payment method profile for this Call-Off Contract is BACSas per each Statement of Work which is set out in Schedule 2. Payment to be made once the deliverable has been submitted by the Supplier and has been accepted by the [SRO] or nominated deputy in accordance with the acceptance criteria and process contained in schedule 1. Invoice details The Supplier will issue electronic invoices upon on completion of the Servicesmilestones as set out in Schedule 2. The Buyer will pay the Supplier within 30 days of receipt of a valid undisputed invoice. Invoices will Who and where to send invoices to Where electronic invoices are emailed, they shall be sent emailed to 9 the following SSCL shared inbox: REDACTED TEXT under FOIA Section 40 A copy with supporting MI should also be emailed to REDACTED TEXT under FOIA Section 40 Invoice information required All invoices must includeas a minimum include the following: • DWP Purchase Order Number (invoices without PO number will be rejected) • DWP Contract Reference Number A short description - ecm_12111 • Supplier remittance address • Details of service carried out • Charges • VAT element of cost • Remittance date • Due Date The invoice format will follow the standard Supplier invoice format mirroring the necessary information as described in Part B, clause 7.5 of the service per line item Call-Off Contract. The applicable amount Buyer will pay the Supplier within thirty (30) calendar days of receipt of a valid invoice, submitted in accordance with a breakdown this paragraph, the payment profile set out and the provisions of the Charges The call off contract referencethis Call-Off Contract. Invoice frequency As set out aboveInvoice will be sent to the Buyer following Acceptance by the Buyer of each Milestone. Call-Off Contract value The total value of this Call-Off Contract is £901,000.00 exc VAT - with optional extension of £665,000.00 exc VAT VAT will be charged at the rate prevailing on the date of invoice Call-Off Contract charges The detailed breakdown of the Charges is outlined in Schedule 2 of this Call- Off Contract. Additional Buyer terms Performance for the provision of the Service As outlined Services during the Term shall be as set out in Schedule 1 each individual Statement of this Call-Off Contract, Work. Where Supplier expenses are applicable and as per proposal QINETIQ/SHC/246/022/PR/1.0 Guarantee N/A Warranties, representations N/A Supplemental requirements agreed in addition to the Call-Off terms N/A Alternative clauses These Alternative Clauses, which have been selected from Schedule 4, will apply: N/A Buyer specific amendments to/refinements advance of the Call-Off Contract terms If Statement of Work, such expenses are capped at the parties agree to make a variation under the Call-Off Contract (Clause 32), the details value stated in such Statement of that variation shall be specified and confirmed in writing by the parties. The Supplier shall Work; may not be obliged transferred or carried forward into other Statements of Work; and are to implement any variation until it has been so confirmed and any revision to the Price and any timetable of work has been agreed be charged in writing. If the parties do not agree to make a variation to the Call-Off Contract, the Supplier shall continue to provide the Call-Off Contract as previously agreed. The Supplier acknowledges that, in entering this Call-Off contract, no volume guarantee has been granted by the buyer for services from the Supplier. Personal Data and Data Subjects Schedule 7 is not being used. The Parties do not intend QinetiQ to act as Data Processor on behalf of the Customer in relation to the Captured Data except to the extent required to comply accordance with its obligations under this Call-Off; QinetiQ TERMS & CONDITIONS FOR PENETRATION TESTING SERVICES SHC/CSG5152/SALES/PENTESTING_V1.13 shall apply, as per G- cloud 14 Service ID 430041730948625 ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇▇▇▇▇.▇▇▇.▇▇/g- cloud/services/430041730948625 Intellectual Property All outputs/deliverables produced and accepted under the Terms and Conditions of this Call-Off Contract shall vest and be retained by the Buyer, except for any pre-existing Intellectual Property Rights of the Supplier and any enhancements and/or modifications of the same made during the Call-Off Contract Term, which shall vest in and be retained by the Supplier. The remainder of the provisions under Clause 11 of Part B: Terms and conditions shall apply. Social Value The Supplier will support Home Office to deliver against the Social Value Model Theme of Economic Inequality through delivering initiatives to drive the development of scalable and future-proofed new methods to modernise delivery and increase productivity. The Supplier will achieve this by: • Utilising industry best practice methodologies proven on government programmes • Implementing continuous improvement processes across all services • Promoting organisational learning to our workforce and the Home Office workforce • Incorporating our supply chain into the innovation, continuous improvement, and organisational learning activities. Performance Indicators Data supplied by the Supplier in relation to Performance Indicators is deemed the Intellectual Property of the Buyer and may be published by the Buyer. [Note required Performance Indicators needed from the Supplier for future publication or otherwise] The test objectives are met, as defined in QINETIQ/SHC/246/022/PR/1.0 Section 2.1, and the test report is issued before the contract ends on 28th March 2025. ISO 9001 QinetiQ quality report, marked “OFFICIAL-SENSITIVE” and to be delivered within 10 working days via encrypted email as per ▇▇▇▇▇▇▇ proposal QINETIQ/SHC/246/022/PR/1.0 Section 6.1 Analysis and Deliverable Preparation’s expenses policy.