Common use of Reporting and Incident Management Clause in Contracts

Reporting and Incident Management. a. Flexera has implemented procedures for Information Security Incidents to be reported through appropriate management channels as quickly as reasonably possible. All employees and representatives of Flexera or their sub-contractors will be made aware of their responsibility to report Information Security Incidents as quickly as reasonably possible. b. Flexera has and will maintain procedures to ensure a quick, effective, and orderly response to Information Security Incidents. c. Flexera has and will maintain an incident classification scale in place to decide whether a security event should be classified as an Information Security Incident. The classification scale will be based on the impact and extent of an incident. d. Flexera will without undue delay (not less than 48 hours from confirmation) notify Customer of any Information Security Incidents. Notifications to Customer will be sent to an address to be provided by Customer. e. If an Information Security Incident reveals any deficiencies, weaknesses, or areas of non-compliance, Flexera will promptly take such steps as may be required, in Flexera’s reasonable discretion, to address material deficiencies, weaknesses, and areas of non- compliance as soon as may be practicable given the circumstances. f. Upon request, Flexera will keep Customer informed of the status of any remedial action that is required to be carried out, including the estimated timetable for completing the same, and will certify to Customer as soon as may be practicable given the circumstances that all necessary remedial actions have been completed. g. For the purposes of this Section, “Information Security Incidents” will mean any unmitigated security incident, of which Flexera has actual knowledge and which (i) compromises or is likely to compromise the security or integrity of Customer data or systems, or (ii) otherwise materially affects Flexera’s ability to comply with the obligations in this Schedule.

Reporting and Incident Management. a. Flexera Revenera has implemented procedures for Information Security Incidents to be reported through appropriate management channels as quickly as reasonably possible. All employees and representatives of Flexera Revenera or their sub-contractors will be made aware of their responsibility to report Information Security Incidents as quickly as reasonably possible. b. Flexera Revenera has and will maintain procedures to ensure a quick, effective, and orderly response to Information Security Incidents. c. Flexera Revenera has and will maintain an incident classification scale in place to decide whether a security event should be classified as an Information Security Incident. The classification scale will be based on the impact and extent of an incident. d. Flexera Revenera will without undue delay (not less than 48 hours from confirmation) notify Customer of any Information Security Incidents. Notifications to Customer will be sent to an address to be provided by Customer. e. If an Information Security Incident reveals any deficiencies, weaknesses, or areas of non-compliance, Flexera Revenera will promptly take such steps as may be required, in FlexeraRevenera’s reasonable discretion, to address material deficiencies, weaknesses, and areas of non- compliance as soon as may be practicable given the circumstances. f. Upon request, Flexera Revenera will keep Customer informed of the status of any remedial action that is required to be carried out, including the estimated timetable for completing the same, and will certify to Customer as soon as may be practicable given the circumstances that all necessary remedial actions have been completed. g. For the purposes of this Section, “Information Security Incidents” will mean any unmitigated security incident, of which Flexera Revenera has actual knowledge and which (i) compromises or is likely to compromise the security or integrity of Customer data or systems, or (ii) otherwise materially affects FlexeraRevenera’s ability to comply with the obligations in this Schedule.

Reporting and Incident Management. a. Flexera has implemented procedures for Information Security Incidents to be reported through appropriate management channels as quickly as reasonably possible. All employees and representatives of Flexera or their sub-contractors will be made aware of their responsibility to report Information Security Incidents as quickly as reasonably possible. b. Flexera has and will maintain procedures to ensure a quick, effective, and orderly response to Information Security Incidents. c. Flexera has and will maintain an incident classification scale in place to decide whether a security event should be classified as an Information Security Incident. The classification scale will be based on the impact and extent of an incident. d. Flexera will without undue delay (not less than 48 hours from confirmation) notify Customer of any Information Security Incidents. Notifications to Customer will be sent to an address to be provided by Customer. e. If an Information Security Incident reveals any deficiencies, weaknesses, or areas of non-compliance, Flexera will promptly take such steps as may be required, in Flexera’s reasonable discretion, to address material deficiencies, weaknesses, and areas of non- compliance as soon as may be practicable given the circumstances. f. Upon request, Flexera will keep Customer informed of the status of any remedial action that is required to be carried out, including the estimated timetable for completing the same, and will certify to Customer as soon as may be practicable given the circumstances that all necessary remedial actions have been completed. g. For the purposes of this Section, “Information Security Incidents” will mean any unmitigated security incident, of which Flexera has actual knowledge and which (i) compromises or is likely to compromise the security or integrity of Customer data or systems, or (ii) otherwise materially affects Flexera’s ability to comply with the obligations in this Schedule.

Reporting and Incident Management. a. Flexera has implemented procedures for Information Security Incidents to be reported through appropriate management channels as quickly as reasonably possible. All employees and representatives of Flexera or their sub-contractors will be made aware of their responsibility to report Information Security Incidents as quickly as reasonably possible. b. Flexera has and will maintain procedures to ensure a quick, effective, and orderly response to Information Security Incidents. c. Flexera has and will maintain an incident classification scale in place to decide whether a security event should be classified as an Information Security Incident. The classification scale will be based on the impact and extent of an incident. d. Flexera will without undue delay (not less than within 48 hours from confirmation) notify Customer of any Information Security Incidents. Notifications to Customer will be sent to an the email address to be provided by Customeron file. e. If an Information Security Incident reveals any deficiencies, weaknesses, or areas of non-compliance, Flexera will promptly take such steps as may be required, in Flexera’s reasonable discretion, to address material deficiencies, weaknesses, and areas of non- compliance as soon as may be practicable given the circumstances. f. Upon request, Flexera will keep Customer informed of the status of any remedial action that is required to be carried out, including the estimated timetable for completing the same, and will certify to Customer as soon as may be practicable given the circumstances that all necessary remedial actions have been completed. g. For the purposes of this Section, “Information Security Incidents” will mean any unmitigated security incident, of which Flexera has actual knowledge and which (i) compromises or is likely to compromise the security or integrity of Customer data or systems, or (ii) otherwise materially affects Flexera’s ability to comply with the obligations in this Schedule.

Reporting and Incident Management. a. Flexera has implemented procedures for Information Security Incidents to be reported through appropriate management channels as quickly as reasonably possible. All employees and representatives of Flexera or their sub-contractors will be made aware of their responsibility to report Information Security Incidents as quickly as reasonably possible. b. Flexera has and will maintain procedures to ensure a quick, effective, and orderly response to Information Security Incidents. c. Flexera has and will maintain an incident classification scale in place to decide whether a security event should be classified as an Information Security Incident. The classification scale will be based on the impact and extent of an incident. d. Flexera will without undue delay (not less than within 48 hours from confirmation) notify Customer of any Information Security Incidents. Notifications to Customer will be sent to an the email address to be provided by Customeron file. e. If an Information Security Incident reveals any deficiencies, weaknesses, or areas of non-compliance, Flexera will promptly take such steps as may be required, in Flexera’s reasonable discretion, to address material deficiencies, weaknesses, and areas of non- ofnon- compliance as soon as may be practicable given the circumstances. f. Upon request, Flexera will keep Customer informed of the status of any remedial action that is required to be carried out, including the estimated timetable for completing the same, and will certify to Customer as soon as may be practicable given the circumstances that all necessary remedial actions have been completed. g. For the purposes of this Section, “Information Security Incidents” will Incidents”will mean any unmitigated security incident, of which Flexera has actual knowledge and which (i) compromises or is likely to compromise the security or integrity of Customer data or systems, or (ii) otherwise materially affects Flexera’s ability to comply with the obligations in this inthis Schedule.

Reporting and Incident Management. a. Flexera has implemented procedures for Information Security Incidents to be reported through appropriate management channels as quickly as reasonably possible. All employees and representatives of Flexera or their sub-contractors will be made aware of their responsibility to report Information Security Incidents as quickly as reasonably possible. b. Flexera has and will maintain procedures to ensure a quick, effective, and orderly response to Information Security Incidents. c. Flexera has and will maintain an incident classification scale in place to decide whether a security event should be classified as an Information Security Incident. The classification scale will be based on the impact and extent of an incident. d. Flexera will without undue delay (not less than 48 hours from confirmation) notify Customer of any Information Security Incidents. Notifications to Customer will be sent to an address to be provided by Customer.to: [ ] e. If an Information Security Incident reveals any deficiencies, weaknesses, or areas of non-compliance, Flexera will promptly take such steps as may be required, in Flexera’s reasonable discretion, to address material deficiencies, weaknesses, and areas of non- compliance as soon as may be practicable given the circumstances. f. Upon request, Flexera will keep Customer informed of the status of any remedial action that is required to be carried out, including the estimated timetable for completing the same, and will certify to Customer as soon as may be practicable given the circumstances that all necessary remedial actions have been completed. g. For the purposes of this Section, “Information Security Incidents” will mean any unmitigated security incident, of which Flexera has actual knowledge and which (i) compromises or is likely to compromise the security or integrity of Customer data or systems, or (ii) otherwise materially affects Flexera’s ability to comply with the obligations in this Schedule.

Reporting and Incident Management. a. Flexera has implemented procedures for Information Security Incidents to be reported through appropriate management channels as quickly as reasonably possible. All employees and representatives of Flexera or their sub-contractors will be made aware of their responsibility to report Information Security Incidents as quickly as reasonably possible. b. Flexera has and will maintain procedures to ensure a quick, effective, and orderly response to Information Security Incidents. c. Flexera has and will maintain an incident classification scale in place to decide whether a security event should be classified as an Information Security Incident. The classification scale will be based on the impact and extent of an incident. d. Flexera will without undue delay (not less than within 48 hours from confirmation) notify Customer of any Information Security Incidents. Notifications to Customer will be sent to an address to be provided by Customer. e. If an Information Security Incident reveals any deficiencies, weaknesses, or areas of non-compliance, Flexera will promptly take such steps as may be required, in Flexera’s reasonable discretion, to address material deficiencies, weaknesses, and areas of non- compliance as soon as may be practicable given the circumstances. f. Upon request, Flexera will keep Customer informed of the status of any remedial action that is required to be carried out, including the estimated timetable for completing the same, and will certify to Customer as soon as may be practicable given the circumstances that all necessary remedial actions have been completed. g. For the purposes of this Section, “Information Security Incidents” will mean any unmitigated security incident, of which Flexera has actual knowledge and which (i) compromises or is likely to compromise the security or integrity of Customer data or systems, or (ii) otherwise materially affects Flexera’s ability to comply with the obligations in this Schedule.

Reporting and Incident Management. a. Flexera Revenera has implemented procedures for Information Security Incidents to be reported through appropriate management channels as quickly as reasonably possible. All employees and representatives of Flexera Revenera or their sub-contractors will be made aware of their responsibility to report Information Security Incidents as quickly as reasonably possible. b. Flexera Revenera has and will maintain procedures to ensure a quick, effective, and orderly response to Information Security Incidents. c. Flexera Revenera has and will maintain an incident classification scale in place to decide whether a security event should be classified as an Information Security Incident. The classification scale will be based on the impact and extent of an incident. d. Flexera Revenera will without undue delay (not less than 48 hours from confirmation) notify Customer of any Information Security Incidents. Notifications to Customer will be sent to an address to be provided by Customer.to: [ ] e. If an Information Security Incident reveals any deficiencies, weaknesses, or areas of non-compliance, Flexera Revenera will promptly take such steps as may be required, in FlexeraRevenera’s reasonable discretion, to address material deficiencies, weaknesses, and areas of non- compliance as soon as may be practicable given the circumstances. f. Upon request, Flexera Revenera will keep Customer informed of the status of any remedial action that is required to be carried out, including the estimated timetable for completing the same, and will certify to Customer as soon as may be practicable given the circumstances that all necessary remedial actions have been completed. g. For the purposes of this Section, “Information Security Incidents” will mean any unmitigated security incident, of which Flexera Revenera has actual knowledge and which (i) compromises or is likely to compromise the security or integrity of Customer data or systems, or (ii) otherwise materially affects FlexeraRevenera’s ability to comply with the obligations in this Schedule.