product” refers to a deliverable or outcome that must be produced to complete a project and achieve its objectives (See definition at BusinessDictionary.com)

License.  If the Work Product contains Supplier’s IP or other elements Supplier or others on its behalf previously or independently developed, then Supplier grants to AT&T, or agrees to obtain for AT&T, a non-exclusive, unrestricted, perpetual, worldwide, royalty-free license to use, copy, modify, distribute, publicly display, publicly perform, import, manufacture, have made, sell, offer to sell (whether directly or through channels of distribution), exploit and sublicense such elements (and have others do any of the foregoing acts on AT&T’s behalf) to the extent necessary for AT&T to exercise its rights in the Work Product.  Any such license shall include AT&T’s right to grant an unrestricted, royalty-free sublicense to its Affiliates for the purposes stated herein.

Miscellaneous.  Supplier shall place a copyright or other proprietary notice on the Work Product at AT&T’s request.  All non-public aspects of the Work Product shall constitute AT&T’s Information under this Agreement.

Reservation of Rights and Residuals.  Except as otherwise expressly provided in this Section entitled “Ownership of Work Product,” Supplier retains all right, title, and interest in and to all Supplier’s IP and Supplier’s Information. The Parties agree that either Party may use, without an obligation to the other Party,  any general knowledge and expertise, skills, techniques, concepts or know-how incidentally (and not intentionally) retained in the unaided memory of the Party’s employees to develop or provide similar services for other customers, provided that such use is without reference to the other Party’s Information.  No license is granted under this Section by either Party to the other Party for any patent, trademark, Work Product, trade secret or copyright.

3)              The following Section 4.19, “Payment Card Industry (PCI) Data Security Standards and Credit Card Information”, is hereby added to the Agreement and is fully incorporated therein by this reference:

Section 4.19, “Payment Card Industry (PCI) Data Security Standards and Credit Card Information

The Payment Card Industry (PCI) data security standards are network security and business practice guidelines developed for Visa, MasterCard, American Express and Discover Card. They were developed to establish a minimum security standard with regards to the protection of cardholder’s account and transaction information. The PCI Security Standards Council, LLC (a non-AT&T entity) owns, develops, maintains and distributes the PCI Data Security Standard (DSS). If Supplier (including its subcontractor, agent or any third party, acting through, or on behalf of Supplier) collects, processes, handles, and/or maintains credit card data and/or related transaction status or identity information through, for, or on behalf of

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting Parties.

3

AT&T (including, without limitation, for itself, or in connection with AT&T’s joint or co-branded relationships and/or its, or their customers, as the case may be), Supplier represents and warrants that it is, and shall remain PCI DSS compliant, including, but not limited to being, DSS certified, current and in good standing, if applicable, at no cost to AT&T, for the longer of the term of this Agreement or any of Supplier’s applicable obligation periods under this Agreement, in accordance with the requirements of the PCI DSS. Notwithstanding anything to the contrary contained within the clause entitled Information or any other provision within this Agreement, Supplier acknowledges that credit card information shall be deemed,  and shall be treated as Information under this Agreement irrespective of whether or not such Information is conspicuously marked as confidential or proprietary and Supplier’s obligation to treat credit card related Information as confidential shall survive the Termination, Cancellation or expiration of this Agreement. Supplier shall indemnify and hold AT&T harmless from and against any proved or alleged claims, demands or suits, or any losses, damages, liabilities, fines, penalties and expenses (including reasonable attorney’s fees) that arise out of, relate to or result from Supplier’s (and/or its subcontractor, agent or any third party, if any, acting through or on behalf of Supplier) failure to comply with its obligations under this clause. Except as may be provided elsewhere in this Agreement, nothing contained within this clause shall be construed to mean, or means that Supplier is authorized to delegate, assign or subcontract any portion of its obligations under this clause to any third party.

4)              The following Section 4.20, “Worker’s Exit Process from AT&T’s Program(s)”, is hereby added to the Agreement and is fully incorporated therein by this reference:

“4.20 Worker’s Exit Process from AT&T’s Program(s)

“Workers” Exit Process from AT&T’s Program(s).  If the Work is transitioning to another AT&T program, some of these provisions may not apply.

a.               Upon Worker’s completion of Services, including attrition of Worker, dismissal of Worker, and program expiration or termination, Supplier shall:

·                  Immediately notify AT&T’s Hiring/Program Manager and identify the Worker(s) so the applicable attuid can be deleted.

·                  Ensure that Worker’s critical knowledge as to the performance of Services is transferred via training of other Worker(s) and/or documented.

·                  Ensure that any roles assigned to the Worker are appropriately reassigned, such as:

·                  Project team/committee member

·                  Functional representative for internal/external interfaces

·                  Advise the AT&T Hiring/Program Manager if a security clearance exists.

·                  Advise the AT&T Contract Manager, as applicable, if there is reason to believe the Worker should not be engaged for future assignments.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting Parties.

4

·                  Remind the Workers of their obligation to maintain confidentiality of AT&T proprietary information.

·                  Perform an inventory of AT&T records (paper and electronic) in Worker’s office or telework/virtual office and arrange for appropriate retention or destruction pursuant to an Order or as directed by AT&T’s Hiring/Program Manager.

·                  Have Worker establish “Out of Office” Voice Mail message and have the Supplier’s Team Manager, or its delegate, review for appropriateness.

·                  If a reservation or reservationless conference bridge is assigned to the Worker for AT&T’s Program, Supplier’s Team Manager, or its delegate, shall ensure that such reservation and reservationless conference bridges are cancelled.

·                  When transition of Worker’s job responsibilities under an AT&T Program is complete, Supplier Team Manager, or its delegate, requests cancellation of other system / job specific UserIDs, access codes, and access privileges that the Worker may have to support AT&T’s Programs, such as:

·                  Shared drives (transfer ownership, if applicable)

·                  Financial systems

·                  Data warehouses

·                  Internet and database services

·                  Digital Certificates

·                  Other systems

·                  If reasonably possible to do so, collect and return SecurID Card/Token to AT&T, if applicable.

NOTE:              At the same time, AT&T shall promptly disable access to AT&T assets by means of such SecurID Card/Token so that access cannot be achieved even if the SecurID Card/Token cannot be collected.

·                  If TACACS/Config service, applies, notify the AT&T Hiring/Program Manger to delete TACACS/config server ID, if applicable.

·                  Recover and secure AT&T assets, which may include AT&T assets, in Worker’s possession (including those kept at the individual’s home):

·                  Personal computers

·                  Software

·                  Monitors

·                  Modems

·                  Printers

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting Parties.

5

·                  Fax machines

·                  Speakers

·                  PDAs

·                  Pagers

·                  Cell phones

·                  If Workers used a non-Supplier PC or Supplier’s PC (collectively “PC”), Supplier shall ensure that AT&T Proprietary information is cleaned off the PC by having them re-imaged.

·                  Have Supplier Team Manager, or its delegate, ensure that the office space of exiting Worker is cleaned and ready for next occupant.

·                  If Services are performed at remote locations, Supplier Team Manager, or its delegate, ensures the following installed services are disconnected at Worker’s location (home and/or other work location):

·                  Phone lines

·                  DSL lines

·                  Cable modem connections

·                  If Services are performed at Supplier Locations, Supplier Team Manager, or its delegate, ensures the following services are disconnected:

·                  Office Telephone

·                  Voice Mail

·                  LAN Port

·                  Have Supplier Team Manager, or its delegate, collect all property used for AT&T’s Program(s). This includes but is not limited to:

·                  Worker’s identification badges, portal passes, parking decals and passes, building access cards, security ID cards, smart cards, key cards, toll pass cards

·                  Keys to desks, file cabinets, storage cabinets, offices, conference rooms, and other work areas

·                  Keys to buildings, gates and vehicles used for AT&T’s Program(s)

·                  Other equipment or property used for AT&T’s Program(s) not mentioned in previous tasks, including any items that the Worker has at home or other remote location, such as:

·                  Microphones, video recorders, cameras and answering machines

·                  Manuals, library materials, software, documentation for software and hardware

·                  Office furniture (and keys to same) and artwork

·                  Special devices (e.g., scanners, 2-way radios)

·                  Tools and Uniforms

·                  Prepare AT&T files for storage:

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting Parties.

6

·                  Supplier Team Manager, or its delegate, reviews office records for compliance with AT&T’s retention schedule pursuant to an Order and as required by law, and transfer active records with retention obligations to appropriate person or group inheriting work function. For inactive records with retention obligations, follow procedures for sending to off-site vendor storage.

·                  Material for which there is no retention obligation or as may be required by law, can be destroyed in accordance with the Order or as directed by AT&T’s Hiring/Program Manager.

b.                                 Obtain Worker’s certification that Worker has returned or destroyed all physical and electronic copies of AT&T proprietary information.

a.               Upon Worker’s completion of Services, including the attrition of Worker, dismissal of Worker, and program expiration or termination, Supplier shall use reasonable commercial efforts to cause such Worker to complete and sign the “Written Certification of Return or Destruction of AT&T Information or Data”, Appendix L.

b.              Supplier shall deliver either an executed copy of Appendix L to the AT&T Hiring/Program Manager or a statement explaining why such copy cannot be provided, within five (5) business days of completion of Services, and retain the original, if any, to be placed in the Worker’s personal file as a permanent record, If such executed copy of Appendix L cannot be obtained, Supplier shall nevertheless use reasonable commercial efforts to obtain .the return of any AT&T Proprietary Information from the Worker and either return the same to AT&T or destroy it.

5.)           The following Section 4.21 AT&T Supplier Information Security Requirements (SISR)”, is hereby added to the Agreement and is fully incorporated therein by this reference:

“Supplier shall comply with the requirements of Appendix “O” entitled “AT&T Supplier Information Security Requirements (SISR).”

6.)           The attached Appendix L — “Written Certification of Return or Destruction of AT&T Information or Data” is hereby added to the Agreement and fully incorporated therein by this reference.

7.)          The attached Appendix O, “Supplier Information Security Requirements (SISR)”, is hereby added to the Agreement and fully incorporated therein by this reference.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting Parties.

7

The terms and conditions of Agreement No. 20070105.006.C in all other respects remain unmodified and in full force and effect.

The Parties hereto acknowledge that they have read this Amendment, understand it, and agree to be bound by its terms and conditions.  They further agree that Agreement No. 20070105.006.C together with Amendment No. 20070105.006.A.001 and this Amendment No. 20070105.006.A.001 constitute the entire agreement between the Parties hereto with respect to the subject matter hereof.

IN WITNESS WHEREOF, the Parties have caused this Amendment to Agreement No. 20070105.006.C to be executed, which may be in duplicate counterparts, each of which will be deemed to be an original but all of which together will constitute only one instrument, as of the date the last Party signs.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting Parties.

8

Appendix L

Written Certification of Return or Destruction of AT&T Information or Data

Pursuant to the terms of the Worker Agreement dated                        , 20XX between me and [NAME OF AT&T COMPANY] (“AT&T”), I hereby certify that I have returned to AT&T or have destroyed all physical and electronic copies of all Information, as that term is defined in the Worker Agreement.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting Parties.

1

Appendix O

Information Security Policy

AT&T Supplier Information Security Requirements

The following AT&T Supplier Information Security Requirements apply to the employees and/or temporary workers of Supplier and its suppliers, contractors, vendors and/or agents, that perform services for, on behalf of, and/or through AT&T, which require access to AT&T’s infrastructure, systems or applications or handle, process, or store, AT&T, AT&T Branded and/or AT&T Co-branded Information (for the purpose of this Section, each or all “Supplier”). Supplier represents and warrants that during the term of this Agreement and thereafter (as applicable with respect to Supplier’s obligations under the Survival of Obligations and Compliance with Laws clauses) Supplier is, and shall continue to be in compliance with its obligations as set forth herein.” AT&T’s failure to audit and/or exercise any of its rights under this Section shall not be construed or deemed to be a waiver of any rights under this Agreement, equity or law. In addition to all other remedies specified in the Agreement, Supplier agrees that AT&T shall be entitled to seek an injunction and be reimbursed the costs (including reasonable attorney’s fees) by Supplier to cease any breach of any obligation that survives termination or expiration of this Agreement. The following provisions shall not be deemed to, and shall not limit any more stringent security or other obligations contained within this Agreement.

Definitions:

Unless otherwise set forth or expanded herein, defined terms shall have the same meaning as set forth in the main body of the Agreement.

“AT&T Branded Information” means Information owned, labeled, marked, or collected, which contains any of AT&T’s or its affiliates identifying markings or trademarks.

“AT&T Co-branded Information” means AT&T Branded Information that is jointly marketed or shared under a co-branding arrangement with a Supplier, irrespective of dominance or emphasis of the co-branding relationship.

As used herein, the term “Information” is limited to:

(a)          The “Confidential Information” to which the obligations in Section 3.16 of the Agreement apply, and

(b)         The “Customer Information” to which the obligations in Section 4.9 of the Agreement apply.

“Information Resources” means any systems, applications, and network elements, and the information stored, transmitted, or processed with these resources in conjunction with supporting AT&T and/or utilized by Supplier in fulfillment of its obligations under this Agreement.

“Personally Identifiable Information” or (“PII”) means any information that could be used to uniquely identify, locate, or contact a single person (or potentially be exploited to steal the identity of an individual, commit fraud or perpetuate other crimes). Examples of PII include personal telephone

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting Parties.

1

numbers, social security numbers, national, state or province, issued identification number, drivers license number, date of birth, bank account numbers, credit card numbers and expiration dates, and other credit related information, PINs, passwords, passcodes, password hint answers, Protected Health Information as defined by the Health Insurance Portability and Accountability Act (HIPAA), biometric data, digitized signatures, and  background check details.

In accordance with the foregoing, Supplier shall:

System Security

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting Parties.

2

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting Parties.

3

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting Parties.

4

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting Parties.

5

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting Parties.

6

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting Parties.

7

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting Parties.

8