REFORMED MASTER SERVICES AGREEMENT

Wireless Signal Forwarding (WSF) includes [***] and all enterprise management capabilities associated with AirFX as well as the Business Intelligence module.

Interactive includes all of the features of Wireless Signal Forwarding, as well as Level 2 Smash and Crash, remote arming, push notices with up to 30 sensors and geo-fences, and cellular 2-Way Voice. Interactive + Automation includes all of the features of Interactive as well as enhanced automation of thermostats, lights, and locks, and garage doors, as well as five day weather and severe weather alerts as free add-ons.

Interactive Gold includes all of the features of Interactive + Automation as well as Image Sensor photo notifications and Identity Theft Protection.

Commercial Interactive Gold includes all features of Interactive Gold as well as Arming Supervision, Arming/Disarming reports, multi-site management, and enterprise business intelligence reports.

Pro Video includes support for up to 4 cameras, with 1,000 clips of cloud storage and 1,000 clip uploads per month.

Video 24x7 provides continuous recording service and requires a Pro Video subscription and a Streaming Video Recorder.

Video Expansion Packs require a Pro Video subscription and allow support for up to an additional 4 cameras, as well as 5,000 clips of cloud storage and 5,000 clip uploads per month.

In addition to the above capabilities, the following business tools will be included at [***] to ADT: [***], [***], and [***].

Definitions:

Information Security Program. Alarm.com will implement and maintain an information security program that establishes roles and responsibilities for information security, and supports the confidentiality, integrity, and availability of Information Processing Systems operated by Alarm.com.

Security Policy. Alarm.com will maintain information security policies that define requirements for access control, application and system development, passwords, remote access, data classification, operational security, network security and physical security. The information security policies will be reviewed annually, or when significant changes to the environment occur, to ensure their continuing suitability, adequacy, and effectiveness. The information security policies will be approved by Alarm.com’s management, and communicated annually to all Alarm.com employees and relevant Providers.

Security Awareness Training. Prior to Alarm.com employees and Providers receiving access to ADT Data, they will receive up to date security awareness training appropriate to their job function. Alarm.com will also ensure that annual security awareness training is performed for Personnel and require such Personnel to acknowledge that they have read and understood Alarm.com security policies and procedures.

Required Background Checks. Employ background verification checks on all candidates for employment, contractors, and third party users, carried out in accordance with relevant laws and regulations, and proportional to the classification of the information to be accessed, as follows:

Social Security Number Verification (Includes Trace);

Criminal Search - Minimum 7 years (County Criminal; residence, school, & employment) - all counties provided or developed;

US Department of Treasury’s Office of Foreign Assets Control (OFAC) Specially Designated National or a Blocked Persons;

Employment Verification - last 3 employers or past 7 years, whichever comes first;

Education Verification (highest level obtained post high school); and

Professional License or Certificate Verification (if applicable).

Provider and Subsequent Party Access. Prior to allowing Providers access to ADT Data, including Alarm.com Information Processing Systems or media containing ADT Data, Alarm.com will:

Require Providers to agree in writing to terms substantially similar to the applicable confidentiality and security requirements of this Agreement, and make this a requirement for all subsequent parties receiving ADT Data; and

Identify and mitigate risks to ADT Data from this access.

Asset Inventory. Alarm.com will maintain an inventory of all Alarm.com Information Processing Systems and media containing ADT Data.

Acceptable Use. Alarm.com will implement rules for the acceptable use of information and assets which is no less restrictive than industry best practice and consistent with the requirements of the Agreement.

Portable Devices. ADT Data may not be stored on portable devices including, but not limited to, laptops, Personal Digital Assistants, smartphones, MP3 devices, and USB devices unless the ADT Data on the portable device is encrypted and secured from unauthorized access.

Personally-owned Equipment. ADT Data may not be stored on personally-owned equipment not controlled by Alarm.com.

Protection of Data at Rest. Alarm.com will use and employ industry best practice data protection mechanisms to protect ADT Data.

Encryption of Data. Alarm.com will encrypt the following categories of data using an encryption mechanism providing protection that is equal to or greater than 128-bit AES encryption:

Personal Sensitive Information, in all forms of storage and transmission;

Any ADT Data that is removed from Alarm.com’s facility or stored off-site; and

Any ADT Customer Data (including but not limited to Personal Sensitive Information) that is transmitted wirelessly or over an untrusted connection (e.g., the Internet); provided, however that in no event shall any Personal Sensitive Information be transmitted by email unless it is provided or sent by a Subscriber. The parties agree that Alarm.com can make certain ADT Customer Data available to ADT to provide customer support and troubleshooting, and Alarm.com will provide such data to ADT in manner mutually agreed upon by the parties.

Data in DMZ. ADT Data may not be stored within a file or database in any network demilitarized zone (“DMZ”).

Encryption Keys. All keys used for encryption must be handled in accordance with documented key management processes and procedures that include and describe, at a minimum, the following controls:

Secure key storage;

Secure key distribution;

Generation of strong keys;

Annual encryption key changes (particularly as used to handle video);

Addition of new keys;

Destruction of old keys;

Split knowledge and dual control of keys;

Replacement of known or suspected compromised keys;

Revocation of old or invalid keys;

Prevention of unauthorized substitution of keys; and

Requirements for key custodians.

Secure Areas. Alarm.com will secure all areas that house Information Processing Systems or media containing ADT Data by the use of appropriate and multiple security controls in order to ensure that only authorized Personnel are allowed access and to prevent damage and interference.

Security Perimeter. Access will be controlled and restricted by use of a defined security perimeter, appropriate security barriers, entry controls and authentication controls. A record of all accesses will be securely maintained.

Identification. All Personnel at the NOCs will be required to wear some form of visible identification to identify them as employees, contractors, visitors, and so forth.

Visitors. Visitors to secure areas will be supervised, or cleared for non-escorted accessed via an appropriate verification process. Their date and time of entry and departure will be recorded.

Physical Media Controls. Physically secure and maintain control over all paper, electronic media and devices (e.g., computers, electronic media, wireless access points/devices, paper receipts, paper reports, and faxes) that contain, transmit, or display ADT Data.

Protection Against Malicious Code. Alarm.com will implement detection, prevention, and recovery controls to protect against malicious software (“Malware”), which is no less than current industry best practice and perform appropriate employee and Provider training on the prevention and detection of malicious software.

Anti-Malware Mechanisms. Alarm.com will ensure anti-malware mechanisms are deployed on all systems commonly affected by malware (e.g., PC’s and servers) and are capable of detecting, removing, and protecting against viruses and other forms of malicious software, including spyware and adware. Alarm.com will ensure anti-malware mechanisms are current, updated daily, actively running, monitored and capable of generating audit logs.

Media Handling. Alarm.com will protect against unauthorized access or misuse of ADT Data contained on media by use of a media control management program.

Media and Information Disposal. Alarm.com will securely and safely dispose of media (including but not limited to hard copies, disks, CDs, DVDs, optical disks, USB devices, backup media, hard drives) containing ADT Data when no longer required by the establishment of documented procedures that include the following:

Disposing of media containing ADT Data so that it is rendered unreadable or undecipherable, such as by burning, shredding, pulverizing or using techniques in compliance with DoD 5220.22-M;

Maintaining a secured disposal log that provides an audit trail of ADT Data media disposal activities;

Upon request, providing certification to ADT that all ADT Data was purged. The certification will be provided to ADT within thirty (30) business days of being requested; and

When transporting media containing ADT Data off-site prior to destruction, ensuring that all media is either (i) protected from misuse or theft in transit using industry standard best practices for transport of confidential information, or (ii) securely erased in a manner compliant with the most current version of NIST 800-88.

Exchange of Information. To protect confidentiality and integrity of ADT Data in transit, Alarm.com will:

Perform an inventory, analysis and risk assessment of all data exchange channels (including but not limited to FTP, HTTP, HTTPS, SMTP, modem, and fax) to identify and mitigate risks to ADT Data from these channels;

Monitor and inspect all data exchange channels to detect unauthorized information releases;

Employ appropriate security controls to minimize information leakage; and

Ensure that appropriate security controls using approved data exchange channels are employed when exchanging ADT Data.

Monitoring. To protect against unauthorized access or misuse of ADT Data residing on Alarm.com Information Processing Systems, Alarm.com will:

Employ current industry best practice security controls and tools to monitor Information Processing Systems and log key events such as user activities (including root or administrative access), exceptions, successful and unsuccessful logins, access to audit logs, unauthorized information processing activities, suspicious activities and information security events;

Regularly back up logs to a secure central location, protected against tampering and unauthorized access;

Retain logs for at least one year;

Perform frequent reviews of logs (including but not limited to firewall, router, wireless access points and authentication server logs) and take necessary actions to protect against unauthorized access or misuse of ADT Data;

At ADT’s request, Alarm.com will review logs to assist in investigations regarding unauthorized access or misuse of ADT Data and report back to ADT the results of such review.

Comply with all relevant legal requirements applicable to monitoring and logging activities;

Ensure that the clocks of all relevant information processing systems are synchronized using an authoritative national or international time source;

Incorporate date and time stamp into log entries;

Employ, monitor and keep up to date network intrusion detection systems, host-based intrusion detection systems, or intrusion prevention systems to monitor all network traffic and alert Personnel to suspected compromises;

Monitor all alerts reported by intrusion detection systems, host-based intrusion detection systems, or intrusion prevention systems and respond immediately to all intrusion events;

Employ a wireless analyzer at least monthly to identify all unauthorized wireless devices in any environment where ADT Customer Data could be accessed; and

Prevent Personal Sensitive Information from being logged in the audit log.

Subscriber Access Management. To protect against unauthorized access or misuse of ADT Data residing on Alarm.com Information Processing Systems, Alarm.com will:

Employ a formal user registration and de-registration procedure for granting and revoking access and access rights to all Alarm.com Information Processing Systems;

Employ a formal password management process that includes a minimum of eight-character alphanumeric passwords, password changes every 90 days, disallows reuse of at least the previous six passwords, and lockout after no more than six invalid login attempts;

Ensure passwords are not displayed;

Ensure access to systems and applications storing or transmitting ADT Data is limited to only those individuals whose job requires such access based on a need-to-know;

Ensure the access rights of all users to Alarm.com Information Processing Systems or media containing ADT Data are removed rapidly, and always within 24 hours of termination of their employment, contract or agreement, or adjusted upon change of need-to-know;

Perform recurring reviews of users’ access and access rights to ensure that they are appropriate for the users’ role;

Ensure that users have a unique user ID and prohibit the use of group, shared, or generic accounts;

Ensure inactive accounts are automatically disabled after 90 days of inactivity; and

Ensure accounts used for remote maintenance, if any, by Alarm.com’s Providers are enabled only during the time needed.

Subscriber Responsibilities. To protect against unauthorized access or misuse of ADT Data residing on Alarm.com Information Processing Systems, Alarm.com will:

Ensure that Alarm.com Information Processing Systems users follow current security practices in the selection and use of strong passwords; and

Ensure that unattended equipment has appropriate protection to prohibit access and use by unauthorized individuals.

Session Timeouts. To protect against unauthorized access or misuse of ADT Data residing on Alarm.com Information Processing Systems, Alarm.com will:

Ensure that inactive user sessions are terminated or require the user to re-authenticate after a defined period of inactivity;

Ensure that desktop, laptops, and where technically possible, servers, invoke a password-protected screen saver after a predetermined period of inactivity not to exceed 15 minutes; and

Ensure handheld devices employ a “lock screen” security control, requiring the entry of a pass code to unlock, after a predetermined period of inactivity.

Network Access Control. Access to internal, external, Provider and public network services that allow access to Alarm.com Information Processing Systems shall be controlled. Alarm.com will:

Ensure that current industry best practice standard authentication mechanisms for network users and equipment are in place and updated as necessary;

Ensure publicly reachable servers are located on a network segment separated from the internal network by a firewall (e.g., a DMZ);

Ensure a stateful firewall is in place for each Internet connection and between any DMZ and the Intranet;

Ensure that firewalls are configured to deny all traffic except the traffic that is required for business reasons;

Ensure authentication methods are used to control access by remote users;

Ensure physical and logical access to diagnostic and configuration ports is controlled; and

Ensure wireless implementations are only used if required for business reasons, put into practice WPA2, 802.11i or a superseding standard and must not use WEP.

Operating System Access Control. To protect against unauthorized access or misuse of ADT Data residing on Alarm.com Information Processing Systems, Alarm.com will:

Ensure that access to operating systems is controlled by a secure log-on procedure;

Ensure encrypted communications (SSH, HTTPS, etc.) are used for administrative access to production systems and applications when not physically present at the device; and

Ensure that the use of utility programs that are capable of overriding system and application controls are highly restricted and tightly controlled.

Mobile Computing and Remote Working. To protect ADT Data residing on Alarm.com Information Processing Systems from the risks inherent in mobile computing and remote working, Alarm.com will:

Identify and mitigate risks to ADT Data from mobile computing and remote working;

Develop policy and procedures for managing mobile computing and remote working;

Protect mobile computing devices that connect to the Internet outside of Alarm.com’s corporate network by using a personal firewall; and

Ensure remote access software (e.g., remote terminal, dial in or VPN) is configured with industry best practice security features including but not limited to: two-factor authentication, unique credentials, encryption, and prevention of split-tunneling.

Data Residency. Alarm.com agrees that during the Term of the Agreement, except as ADT shall agree otherwise in writing,

All ADT Data that has not been masked per the Agreement, shall remain within the United States or Canada; and

All services involving access to ADT Data that has not been masked per the Agreement, shall take place within the United States or Canada. Alarm.com shall impose the same restrictions on its Providers and shall remain fully responsible for Providers’ compliance with such restrictions.

Configuration Standards. Develop configuration standards for all system components that address all known security vulnerabilities and are consistent with industry-accepted system hardening standards as defined, for example, by SysAdmin Audit Network Security Institute (SANS), National Institute of Standards Technology (NIST), or Center for Internet Security (CIS).

Patch Management. Alarm.com shall employ a process to review vendor-supplied patches for applicability in Alarm.com’s environment using a risk-based approach. Patches identified as critical shall be addressed through implementation or mitigating controls within 30 days.

Vulnerability Management. Alarm.com shall employ a process for vulnerability management, including:

Internal and external network vulnerability scans conducted at least quarterly;

Network and application layer penetration test conducted at least annually;

System, application and source code scanning and analysis processes;

A framework for remediation of findings; and

A process to identify newly discovered security vulnerabilities and update system and application standards to address new vulnerability issues.

Development Processes. Alarm.com will incorporate security into the development lifecycle, including:

Restricting access to source code to authorized users who have a direct need to know; and

Employing oversight quality controls and security management of software development.

Change Management. Alarm.com will utilize processes to control changes in Alarm.com’s technical environment, including:

Use of formal change control procedures to approve and implement changes; and

Ensuring file integrity in the operating environment is maintained and monitored for approved change.

Incident Reporting Process. Implement a process to ensure that Information Security Events are reported through appropriate management channels as quickly as possible.

Incident Response Plan. Implement, and provide to ADT, a formally documented security incident response plan that includes: formation of an incident response team, categorization of incidents and responsibility for receiving alerts and investigations.

Incident Training. Train all Personnel and Provider users of Information Processing Systems and services how to report any Information Security Events.

Termination of Incidents. Alarm.com shall use commercially reasonable efforts to immediately terminate any Information Security Event and not allow any Information Security Event to persist for any amount of time or for any reason except as required by Applicable Law, or as deemed reasonably necessary by Alarm.com to determine the identity of the perpetrator and to stop such Information Security Event.

Notification of Incidents. Notify ADT by email ***@*** or by phone (877-ADT-HELP) within 8 hours of all Information Security Events involving ADT Customer Data and within 36 hours of any other Information Security Events. Following any Information Security Events, Alarm.com will promptly notify ADT whether or not ADT Customer Data was compromised or released to unauthorized parties, the ADT Data affected and the details of the Information Security Event.

Occurrence Reports. As soon as commercially reasonable following Alarm.com’s discovery of the occurrence of an Information Security Event, Alarm.com shall provide ADT with written documentation of the cause, remedial steps and future plans to prevent a recurrence of the same or similar breach. In the case of Information Security Events involving ADT Customer Data, if such remediation plan is acceptable to ADT, Alarm.com shall immediately implement the proposed remediation plan or in a mutually agreed upon time frame; or if such remediation plan is unacceptable, based on ADT’s commercially reasonable judgment, Alarm.com shall promptly but in any event no later than five days enter into good faith negotiations to address the proposed remediation plan. Alarm.com shall reasonably cooperate with ADT security investigation activities and with the preparation and transmittal of any notice or any action, which ADT in its sole discretion may deem appropriate or required by Applicable Law, to be sent or done for customers or other affected third parties regarding any Information Security Event.

Initial and Recurring Security Assessments. ADT or its third party designee may, but is not obligated to, perform an on-site physical and logical security assessment of Alarm.com’s data processing and business facilities (“Security Assessment”) prior to the release of ADT Data and each year thereafter. Security Assessments may also be conducted by means of a security questionnaire.

External Security Audits. At least twice annually, Alarm.com will perform security audits against Alarm.com’s Internet-facing environment as it relates to any ADT Customer Data (and Alarm.com data generally). Alarm.com will provide ADT with the executive summary of such audits and will use commercially reasonable efforts to cure any material deficiencies reported. ADT may, at its expense, perform security audits against the ADT NOC and the ADT Failover NOC. Alarm.com will provide reasonable assistance to ADT in auditing the ADT NOC and the ADT Failover NOC.

Data Masking in Non-Production Environments. Alarm.com will implement Data Masking when ADT Data is stored in Non-Production Environments.

Data Masking Exception Process. If a business need exists to use ADT Data in a Non-Production Environment without Data Masking, Alarm.com will obtain written permission from ADT.

Data Masking Requirements. The following fields are currently identified as sensitive and require special handling including masking when stored in Non-Production Environments:

Name (includes any name field and userid or account name);

Address (includes any address field, property location, garage location, and so forth);

Email Address (includes any email address field);

Phone Number (includes any phone number field including home phone, personal phone, business phone (does not include ADT employee business phone), and so forth);

Date of Birth;

Driver License Number;

Social Security Number or Social Insurance Number;

Financial information (includes, credit card, bank account, credit score, or other sensitive financial information);

Password or security codes (e.g., application passwords, PIC, etc.); and

Central Station number.

Display Masking. Alarm.com will hide or obscure Personal Sensitive Information, as defined in the Agreement, in Production Environments including paper output (e.g., reports, printouts, and copies), when displayed to those without a need-to-know.

Supply Flexibility. Alarm.com will provide upside supply flexibility of +[***]% of the forecasted demand of Alarm.com-ready Products within [***] days; and +[***]% of the forecasted demand of Alarm.com-ready Products beyond [***] days. Alarm.com will maintain [***] ([***]) [***] of unique/long lead time Alarm.com-ready Product components to minimize lead-time.

Tooling. Buyer shall reimburse Alarm.com for any custom or specialized tooling purchased by Alarm.com, with Buyer’s prior approval, for use solely in the manufacture of ADT Custom Products (as defined in Schedule 6). All such tooling shall be owned by Buyer ADT and shall only be used by Alarm.com in the manufacture of Custom Products for Buyer. All such tooling shall be appropriately marked as the property of Buyer and shall be handled in accordance with industry standard practices for prevention of physical damage and environmental concerns. Alarm.com shall maintain property insurance for the full replacement value of such tooling. Alarm.com expressly agrees to return such tooling to Buyer upon request and acknowledges that it has no power or authority to sell, transfer, deliver, modify, transform or otherwise use such tooling, except as expressly permitted by the Agreement. Alarm.com hereby irrevocably appoints Buyer as its attorney-in-fact (which appointment is coupled with an interest) and authorizes Buyer to file a financing statement with respect to its ownership of such tooling in such jurisdictions as Buyer deems appropriate, as well as any continuation statements and amendments thereto.

All information provided by Alarm.com to Buyer with respect to the Alarm.com-ready Products is complete and accurate in all material respects;

Alarm.com and all Alarm.com-ready Products shall materially conform to Quality Assurance Requirements provided by ADT, and to the requirements applicable to suppliers pursuant to The ADT Supplier Social Responsibility Guide which are available at http://www.adt.com/about-adt/ethics. ADT shall provide Alarm.com with notice of any material change to the ADT Supplier Social Responsibility Guide.

The Alarm.com-ready Products manufactured by (or for) Alarm.com comply with all Applicable Laws or regulations applicable to manufacturers of the Alarm.com-ready Products, including the restriction on the use of certain hazardous substances in electrical and electronic equipment, including, but not limited to, RoHS, WEEE, REACH, etc., and other environmental protection laws and/or regulations.

Except as disclosed by Alarm.com to ADT in writing, no Open Source Software is incorporated (either directly by Alarm.com, or indirectly, by the incorporation of third party software that itself incorporates Open Source Software) into or required for the intended use or operation of any of the Alarm.com-ready Products.  In the event that Alarm.com develops new Alarm.com-ready Products or modifies its existing Alarm.com-ready Products to incorporate Open Source Software into, or require Open Source Software for the operation of, such Alarm.com-ready Products, Alarm.com shall provide prompt written notice of such fact to Buyer.  Alarm.com is and shall continue to be in full compliance with the terms of all licenses relating to the Open Source Software incorporated into or required for the operation of any of the Alarm.com-ready Products (“Open Source Licenses”).  None of the Open Source Licenses obligate or will obligate Buyer to make any source or object code available to third parties or to include any license agreement, copyright notice or other attribution when distributing any Alarm.com-ready Product, except for any such items that Alarm.com has included in or with such Alarm.com-ready Products.  None of the Open Source Licenses obligate or will obligate Buyer to (A) distribute or disclose any other software combined, distributed or otherwise made commercially available with such Open Source Software in source code form or (B) license or otherwise make available such Open Source Software and/or other software combined, distributed or otherwise made commercially available with such Open Source Software or any associated Intellectual Property on a royalty free basis.  As used herein, the term “Open Source Software” means any software, program, module, code, library, database, driver or similar component (or portion thereof) that is royalty free, proprietary software, the use of which requires any contractual obligations by the user such as, without limitation, that software that is subject to, distributed, transmitted, licensed or otherwise made available under any of the following licenses: GNU General Public License, GNU Library or “Lesser” Public License, Berkeley Software Design (BSD) license (including Free BSD and BSD-style licenses), MIT license, Mozilla Public License, IBM Public License, Apache Software License, Artistic license (e.g., PERL), Sun Industry Standards Source License, Sun Community Source License (SCSL), Intel Open Source License, Apple Public Source License, or any substantially similar license, or any license that has been approved by the Open Source Initiative, Free Software Foundation or similar group.