Common use of SSAE 16 Clause in Contracts

SSAE 16. (1) Each year, Cognizant Group shall engage a third party internationally recognized auditor to conduct a SSAE 16 audit with respect to the Services and provide (a) a SOC-1 Type II report, at its cost and expense, and (b) upon NAIC Groups’ request, a SOC-2 or SOC-3 Type II report, at NAIC Groups’ cost and expense. Cognizant Group shall cooperate with NAIC Group to determine the scope and control objective requirements for the SSAE 16 SOC-1 (and SOC-2 or SOC-3, if applicable) Type II reports. As soon as reasonably practicable following Cognizant Group’s receipt of such reports, but no later than November 15 of each year covering a period commencing October 1 of the previous year through and including September 30 of the then-current year, Cognizant Group shall provide NAIC Group and its external auditors with a copy of such report to the extent related to the provision or receipt of the Services and NAIC Group may share a copy of such report with its customers, customer’s agents and regulators. In January of each year, Cognizant Group shall, at its cost and expense, cause its auditor to provide a bridge letter, with respect to the SOC-1 Type II report for such year, for the period October 1 through December 31. Cognizant shall notify NAIC as soon as possible after any weakness or deficiency is identified in connection with an audit conducted pursuant to Section 12.04(1). (2) Every 180 days, Cognizant Group shall permit, and reasonably cooperate with, NAIC Auditors to conduct an end-to-end SSAE 16 audit of Cognizant Group’s provision of the Services (including, as directed by NAIC Group, for each of Cognizant Group’s subcontractors and at each of the Service Locations). Cognizant Group shall respond to inquiries regarding the SSAE 16 reports from NAIC Group and its external auditors as necessary. (3) With respect to any audit reports issued under this Section, Cognizant Group shall promptly remediate any weakness or deficiency identified in such reports or that could reasonably be expected to result in a qualified report. Such remediation shall be provided at Cognizant Group’s cost and expense; provided, however, that if the remediation is related to an audit report provided pursuant to Section 12.04(2), then such remediation work shall be at Cognizant Group’s cost and expense only to the extent resulting from Cognizant Group’s failure to comply with the terms and conditions of this Agreement, otherwise NAIC Group shall be financially responsible for the cost and expense for such remediation and such remediation shall be implemented in accordance with the Change Procedures. (4) If Cognizant Group issues a qualified audit report provided pursuant to Section 12.04(1), Cognizant Group shall provide NAIC Group an unqualified audit report as soon as is feasible and with such timing discussed and agreed with the NAIC Senior Executive, but in no event later than 90 days after delivery of the qualified report. (5) If NAIC Group determines that a form of independently audited quality certification that replaces, or is an alternative to the audit reports set forth in this Section is sufficient to satisfy NAIC Group’s audit and reporting requirements, then Cognizant Group shall, at NAIC Group’s request, perform its obligations relating to the issuance of such new quality certification and any associated remediation work arising therefrom. The MSA Contracting Party financially responsible for the cost and expense of new quality certification and any associated remediation work shall be the MSA Contracting Party that would have been financially responsible for the cost and expense arising in connection with conducting the audit report under Section 12.04(1) or Section 12.04(2) or any associated remediation work under Section 12.04(3).

SSAE 16. (1) Each year, Cognizant Milliman Group shall engage a third party internationally recognized auditor to conduct a SSAE 16 audit attest report with respect to the Services and each Service Location (including any location hosting Voya Data) and provide (a) a SOC-1 Type II, SOC-2 Type II report, at its cost and expense, and (b) upon NAIC Groups’ request, a SOC-2 or SOC-3 Type II reportin Voya’s discretion, at NAIC Groups’ Milliman’s cost and expense. Cognizant Milliman Group shall cooperate with NAIC Voya Group to determine the scope and control objective requirements for the SSAE 16 SOC-1 (and SOC-2 or SOC-3, if applicable) Type II reportsreport. As soon as reasonably practicable following Cognizant Milliman Group’s receipt of such reports, but no later than November December 15 of each year covering a period commencing October 1 of the previous year through and including September 30 of the then-current year, Cognizant Milliman Group shall provide NAIC Voya Group and its external auditors with a copy of such report to the extent related to the provision or receipt of the Services and NAIC Voya Group may share a copy of such report with its customers, customer’s agents agents, regulators and regulatorscounterparties to any of the transaction types described in Section 3.08(1). In January of each year, Cognizant Milliman Group shall, at its cost and expense, cause its auditor to provide a bridge letter, with respect to the SOC-1 Type II SOC report for such year, for the period from October 1 through December 31. Cognizant Milliman shall notify NAIC Voya as soon as possible after any weakness or deficiency is identified in connection with an audit conducted pursuant to this Section 12.04(112.03(1). (2) Every 180 days, Cognizant Group shall permit, and reasonably cooperate with, NAIC Auditors to conduct an end-to-end SSAE 16 audit of Cognizant Group’s provision of the Services (including, as directed by NAIC Group, for each of Cognizant Group’s subcontractors and at each of the Service Locations). Cognizant Group shall respond to inquiries regarding the SSAE 16 reports from NAIC Group and its external auditors as necessary. (3) With respect to any audit reports issued under this SectionSection 12.03, Cognizant Milliman Group shall promptly remediate any weakness or deficiency identified in such reports or that could reasonably be expected to result in a qualified report. Such remediation shall be provided at Cognizant Milliman Group’s cost and expense; provided, however, that if the remediation is related to an . (3) If a qualified audit report is provided pursuant to Section 12.04(212.03(1), then such remediation work shall be at Cognizant Group’s cost and expense only to the extent resulting from Cognizant Group’s failure to comply with the terms and conditions of this Agreement, otherwise NAIC Group shall be financially responsible for the cost and expense for such remediation and such remediation shall be implemented in accordance with the Change Procedures. (4) If Cognizant Group issues a qualified audit report provided pursuant to Section 12.04(1), Cognizant Milliman Group shall provide NAIC Voya Group an unqualified audit report as soon as is feasible and with such timing discussed and agreed with the NAIC Senior ExecutiveVoya Contract Manager, but in no event later than 90 days after delivery of the qualified report. (54) If NAIC Group determines that a form of independently audited quality certification that replaces, or is an alternative to replaces the audit reports set forth in this Section is sufficient to satisfy NAIC Group’s audit and reporting requirements12.03, then Cognizant Milliman Group shall, at NAIC no later than the second audit following Voya Group’s request, perform its obligations relating to the issuance of such new quality certification and any associated remediation work arising therefrom. The MSA Contracting Party financially responsible for the cost and expense of ; provided however, that if such new quality certification is required by the applicable Governmental Authority or professional accounting body, Milliman Group shall, beginning with the audit following Voya Group’s request, perform its obligations relating to the issuance of such certificate and any associated remediation work shall be the MSA Contracting Party that would have been financially responsible for the cost and expense arising in connection with conducting the audit report under Section 12.04(1) or Section 12.04(2) or any associated remediation work under Section 12.04(3)therefrom.

SSAE 16. (1) Each year, Cognizant Group shall engage a third party internationally recognized auditor to conduct a SSAE 16 audit with respect to the Services and provide (a) a SOC-1 Type II report, at its cost and expense, and (b) upon NAIC Groups’ request, a SOC-2 or SOC-3 Type II report, at NAIC Groups’ cost and expense. Cognizant Group shall cooperate with NAIC Group to determine the scope and control objective requirements for the SSAE 16 SOC-1 (and SOC-2 or SOC-3, if applicable) Type II reports. As soon as reasonably practicable following Cognizant Group’s receipt of such reports, but no later than November 15 of each year covering a period commencing October 1 of the previous year through and including September 30 of the then-current year, Cognizant Group shall provide NAIC Group and its external auditors with a copy of such report to the extent related to the provision or receipt of the Services and NAIC Group may share a copy of such report with its customers, customer’s agents and regulators. In January of each year, Cognizant Group shall, at its cost and expense, cause its auditor to provide a bridge letter, with respect to the SOC-1 Type II report for such year, for the period October 1 through December 31. Cognizant shall notify NAIC as soon as possible after any weakness or deficiency is identified in connection with an audit conducted pursuant to Section 12.04(1). (2) Every 180 days, Cognizant Group shall permit, and reasonably cooperate with, NAIC Auditors to conduct an end-to-end SSAE 16 audit of Cognizant Group’s provision of the Services (including, as directed by NAIC Group, for each of Cognizant Group’s subcontractors and at each of the Service Locations). Cognizant Group shall respond to inquiries regarding the SSAE 16 reports from NAIC Group and its external auditors as necessary. (3) With respect to any audit reports issued under this Section, Cognizant Group shall promptly remediate any weakness or deficiency identified in such reports or that could reasonably be expected to result in a qualified report. Such remediation shall be provided at Cognizant Group’s cost and expense; provided, however, that if the remediation is related to an audit report provided pursuant to Section 12.04(2), then such remediation work shall be at Cognizant Group’s cost and expense only to the extent resulting from Cognizant Group’s failure to comply with the terms and conditions of this Agreement, otherwise NAIC Group shall be financially responsible for the cost and expense for such remediation and such remediation shall be implemented in accordance with the Change Procedures.. – NAIC Confidential – (4) If Cognizant Group issues a qualified audit report provided pursuant to Section 12.04(1), Cognizant Group shall provide NAIC Group an unqualified audit report as soon as is feasible and with such timing discussed and agreed with the NAIC Senior Executive, but in no event later than 90 days after delivery of the qualified report. (5) If NAIC Group determines that a form of independently audited quality certification that replaces, or is an alternative to the audit reports set forth in this Section is sufficient to satisfy NAIC Group’s audit and reporting requirements, then Cognizant Group shall, at NAIC Group’s request, perform its obligations relating to the issuance of such new quality certification and any associated remediation work arising therefrom. The MSA Contracting Party financially responsible for the cost and expense of new quality certification and any associated remediation work shall be the MSA Contracting Party that would have been financially responsible for the cost and expense arising in connection with conducting the audit report under Section 12.04(1) or Section 12.04(2) or any associated remediation work under Section 12.04(3).