EAB requests revision of the following terms of the RFP, as set forth below:

Section 3.7, Acceptance or Reject and Award of Proposal. Please strike the last sentence of this Section as not applicable. The parties will commit to the full scope of the Services set forth in the Agreement.

Section 3.10, Disclosure of Offeror's Response. Please add the following to the beginning of the second-to-last sentence, "Except as otherwise set forth in the Agreement,"

Section 6.1, Contract Term. Please strike the last sentence of this Section as EAB cannot condition renewal based on client satisfaction due to the Incentive Compensation Rules.

Section 6.6, Contractor Cooperation in Related Efforts. Please strike the second sentence in its entirety. EAB cannot agree to work with potential competitors without an opportunity to consider more fully. Please add "knowingly" before "commit or permit" in the third sentence. Lastly, please strike the fourth sentence as EAB does not typically hire subcontractors for individual clients.

——一 —— ——

Section 6.9. Kentucky's Personal Information Security and Breach Investigation Procedures and Practices Act. EAB cannot agree to unreviewed security policies. In the unlikely event of a breach, EAB would fully cooperate with University as to all investigation and response; however, notification would be more appropriately provided by University. Please revise as set forth below:

To the extent Company receives Personal Information as defined by and in accordance with Kentucky's Personal Information Security and Breach Investigation Procedures and Practices Act, KRS 61.931, 61.932 and 61.933 (the "Act"), Company shall secure and protect the Personal 17 Information by, without limitation: (i) complying with all requirements applicable to non-affiliated third parties set forth in the Act; (ii) utilizing security and breach investigation procedures that are appropriate to the nature of the Personal Information disclosed at least as stringent as University's and reasonably designed to protect the Personal Information from unauthorized access, use, modification, disclosure, manipulation, or destruction; (iii) notifying University of a security breach relating to Personal Information in the possession of Company or its agents or subcontractors within seventy-two (72) hours of discovery of an actual or suspected breach unless the exception set forth in KRS 61.932(2)(b)2 applies and Company abides by the requirements set forth in that exception; (iv) cooperating with University in complying with the response, mitigation, correction, investigation, and notification requirements of the Act, (v) paying all legally required costs of notification, investigation and mitigation in the event of the extent arising from a security breach of Personal Information suffered by Company; and (vi) at University's reasonable discretion and direction, handling all administrative functions associated with notification, investigation and mitigation.

Section 6.10, Termination for Convenience. Please strike this Section in its entirety as accounting practices prohibit EAB's ability to recognize revenue from a contract containing a termination for convenience clause.

Section 6.11, Termination for Non-Performance. Please replace this provision with the following termination provision, which is substantially similar to the termination provision in