UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

Form 10-Q/A

(Amendment No. 1)

(Mark One)

x      QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the quarterly period ended September 30, 2013

or

o         TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the transition period from             to             

Commission File Number: 000-52049

SYNCHRONOSS TECHNOLOGIES, INC.

(Exact name of registrant as specified in its charter)

(866) 620-3940

(Registrant’s telephone number, including area code)

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.  Yes x  No o

Indicate by check mark whether the registrant has submitted electronically and posted on its corporate Web site, if any, every Interactive Data File required to be submitted and posted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files).  Yes x  No o

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, or a smaller reporting company. See the definitions of “large accelerated filer,” “accelerated filer” and “smaller reporting company” in Rule 12b-2 of the Exchange Act.

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act).  Yes o  No x

Shares outstanding of the Registrant’s common stock:

Explanatory Note

Synchronoss Technologies, Inc. (the “Company”) is filing this Amendment No. 1 on Form 10-Q/A (this “Amendment”) to amend its Quarterly Report on Form 10-Q for the fiscal period ended September 30, 2013 (the “Form 10-Q”), which the Company originally filed with the Securities and Exchange Commission (the “Commission”) on November 5, 2013. The sole purpose of this Amendment is to re-file Exhibit 10.9.1 that was originally filed with the Form 10-Q to address comments the Company received from the Staff of the Commission in response to a confidential treatment request filed by the Company with respect to certain portions of Exhibit 10.9.1.

This Amendment contains only the Cover Page to Form 10-Q, this Explanatory Note, Item 6 (Exhibits), the signature page to Form 10-Q, Exhibit 10.9.1, as amended, and Exhibits 31.1 and 31.2. No other changes have been made to the Form 10-Q. This Amendment speaks as of the original filing date of the Form 10-Q, does not reflect events occurring after the original filing date or modify or update those disclosures that may be affected by subsequent events, and no other changes are being made to any other disclosure contained in the Form 10-Q or any exhibits thereto.

As required by Rule 12b-15 under the Securities Exchange Act of 1934, as amended (the “Exchange Act”), new certifications by the Company’s principal executive officer and principal financial officer are being filed herewith as exhibits to this Amendment pursuant to Rule 13a-14(a) of the Exchange Act. However, the Company is not including certifications pursuant to Section 1350 of Chapter 63 of Title 18 of the United States Code (18 U.S.C. 1350) as no financial statements are being filed with this Amendment.

1

ITEM 6.  EXHIBITS

*                                         Previously filed as an exhibit to the Quarterly Report on Form 10-Q for the fiscal quarter ended September 30, 2013, filed with the Securities and Exchange Commission on November 5, 2013.

**                                  Previously furnished with the Quarterly Report on Form 10-Q for the fiscal quarter ended September 30, 2013, filed with the Securities and Exchange Commission on November 5, 2013.

‡                                         Confidential treatment has been requested for portions of this document. The omitted portions of this document have been filed with the Securities and Exchange Commission.

2

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.

3

Exhibit 10.9.1

CONFIDENTIAL TREATMENT REQUESTED

Subordinate Material and Services Agreement

No. SG021306.S.025

Between

Synchronoss Technologies, Inc.

And

AT&T Services, Inc.

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

TABLE OF CONTENTS

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

2

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

TABLE OF CONTENTS

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

3

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

1.0 Preamble

1.1 Overview

This Agreement No. SG021306.S.025 (the “Agreement”) is pursuant to and hereby incorporates by reference the terms and conditions of that certain Master Services Agreement No. SG021306 dated September 1, 2005 as amended by the Parties (collectively the “Master Agreement”), except to the extent modified or supplemented below.  Any such modifications or supplements are for the purpose of this Agreement only and shall not affect the Master Agreement or any other agreement.  In the event of a conflict between this Agreement and the Master Agreement, the terms and conditions of this Agreement will govern for the purpose of this Agreement only.

1.2 Preamble

This Agreement is between Synchronoss Technologies, Inc., a Delaware corporation (hereinafter referred to as “Supplier”), and AT&T Services, Inc., a Delaware corporation (hereinafter referred to as “AT&T”), each of which may be referred to in the singular as a “Party” or in the plural as the “Parties.”

1.3 Scope of Agreement

a.                                                  Supplier shall provide to AT&T the Material and Services described in Appendix A, subject to the terms and conditions of this Agreement and pursuant to and in conformance with Orders submitted by AT&T.  The applicable price for the Material and Services is specified in Appendix B and any Order(s) placed pursuant hereto.

b.                                                  This Agreement outlines Supplier operation of the Order Management Center (“OMC”) and ASP Solution for all participating AT&T business units as well as the provision of professional services to AT&T.  Supplier shall, among other things, carry out sales transaction processing, inbound call handling and Customer contacts for AT&T eCommerce Channels.  As such, Orders for Supplier Material and Services shall not be submitted by way of pre-printed purchasing forms or electronic Purchase Orders, but Orders will instead be documented by way of mutually-executed contracts supplemental to this Agreement.  As of the date of this Agreement, and without limiting future Orders that may later be mutually agreed, the Parties have five such Orders prepared or in process at this time:

1.                          SG021306.S.025.S.001 — ****

2.                          SG021306.S.025.S.002 — ****

3.                          SG021306.S.025.S.003 — ****

4.                          SG021306.S.025.S.004 — ****

1.4 Term of Agreement

a.              After all Parties have signed, this Agreement shall be effective on August 1, 2013 (the “Effective Date”), and shall continue until July 31, 2016 unless earlier terminated as set forth herein (the “Initial Term”).  AT&T, solely at its discretion, may renew this Agreement for one (1) additional year term from August 1, 2016 to July 31, 2017 (the “Renewal Term”) by providing at least ninety (90) days written notice prior to the end of the Initial Term.

b.              As of the Effective Date, this Agreement shall supersede and replace Contract No. SG021306.S.007 dated January 1, 2009.

c.               The termination or expiration of this Agreement shall not affect the obligations of either Party to the other Party pursuant to any Order previously executed hereunder, and the terms and conditions of this Agreement shall continue to apply to such Order as if this Agreement were still in effect.  Likewise, termination or expiration of the Master Agreement shall not affect the obligations of either Party to the other Party pursuant to this Agreement or any Order thereunder, and the terms and conditions

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

4

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

of the Master Agreement shall continue to apply to this Agreement or any Order thereunder as if the Master Agreement were still in effect.

2.0 Definitions

2.1 Agent

“Agent” shall mean any Supplier provided personnel providing Customer Care Support or support for Manual Transaction Processing.

2.2 Automated Order

“Automated Order” means any Customer Order that is able to be Completed for an AT&T Customer without human intervention.

2.3 AT&T eCommerce

“AT&T eCommerce” means the specific AT&T eCommerce business or other organizations or divisions authorized to receive Services under this Agreement or an applicable Order as of the Effective Date including but not limited to: ****.  In the event any of these business organizations are renamed or reorganized, AT&T shall promptly provide the new name and organization to Supplier.

2.4 Channel

“Channel” means a unique point of sale, segment or division that requires an incremental dedicated infrastructure or environment (i.e., is separate from other points of sales) for support of the ASP Solution (typically such dedicated infrastructure is required as a result of unique services, processes, requirements and/or Transactions).  Each of the following shall be a “Channel” as of the Effective Date: ****.  In the event any of these business organizations are renamed or reorganized, AT&T shall promptly provide the new name and organization to Supplier.  The need for such incremental dedicated infrastructure (including center or staffing) or environment must be approved by AT&T such approval not to be unreasonably withheld or delayed.  For example, the addition of a new Customer Order or Transaction type, which may require software development, within an existing Channel does not constitute a new channel.

2.5 Contact

“Contact” shall mean a single in-coming request or inquiry from a Customer via telephone, email, online chat or, a single out-going (that is within the scope of the Services to be provided under an Order) telephone, email, online chat (i.e., a call back).

2.6 Click to Chat

“Click to Chat” or “Chat” means any interactive session using an online chat interface between a Customer and an Agent or the ASP Solution pertaining to such Customer requesting information or support for a Customer Order.

2.7 Completed

“Completed” means that a given Customer Order has reached the final status in the work or task flows applicable to and configured for such Customer Order in the ASP Solution.  For the avoidance of doubt, and by way of example, such end status may result from a cancellation, rejection or completed provisioning of an AT&T service.

2.8 Customer

“Customer” shall mean any current or prospective customer of AT&T (or its Affiliates) that is the end user of the products or services of AT&T.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

5

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

2.9 Customer Care Support

“Customer Care Support” means the support provided by Agents in assisting AT&T Customers or their representatives with Customer Orders or requests for information or support through AT&T Customer contact by Agents including, but not limited to (a) supporting Contacts and (b) Manual Transaction Processing.

2.10 Customer Information

“Customer Information” includes, but is not limited to, customer name, address, phone number, any customer or employee personal information, credit card and credit related information, health or financial information, authentication credentials, information concerning a customer’s calling patterns, unlisted customer numbers, any other information associated with a customer or with persons in the household of a customer, and any information available to AT&T and/or its suppliers by virtue of AT&T’s relationship with its customers as a provider of telecommunications, Internet, information or other services, including the quantity, technical configuration, location, type, destination, and amount of use of telecommunications or other services subscribed to, and information contained on the telephone bills of AT&T’s customers pertaining to telephone exchange service, telephone toll service or other services received by a customer of AT&T to the extent any of such is provided by AT&T or a Customer to Supplier.

2.11 Customer Order

“Customer Order” means a unique request related to provisioning, adding, modifying or terminating AT&T services for a given Customer that is received through the ASP Solution and is associated to a discreet workflow configured in the ASP Solution.  Customer Orders may vary in complexity in the number of Transactions or tasks to be completed for a given Customer Order or the number and type of AT&T services under the Customer Order.  By way of explanation, a Customer Order may be a request to provision a single service or multiple services for a given Customer.

2.12 Defect

“Defect” means a condition in ASP Solution that causes the solution not to perform in accordance with the applicable specifications set forth in this Order.

2.13 Inbound Call

“Inbound Call” means any inbound call to the Order Management Center (OMC) from an AT&T Customer requesting information or support or pertaining to a Customer Order or request for information or support.

2.14                                                Outbound Call

“Outbound Call” means any outbound call attempt made by an Agent or the ASP Solution to a Customer in performance of a particular purpose or task defined by the AT&T outbound call program(s).

2.15 Manual Transaction Processing

“Manual Transaction Processing” means the manual processing of one or more Transactions under a Customer Order by Supplier Agent, For the avoidance of doubt, manual Transaction Processing includes the manual tasks or process performed, excluding Contacts, required to manage and pursue to resolution issues or tasks related to Transactions which have fallen out of the automation processes or cannot reach Completion without investigation or support by an Agent.  Manual Transaction Processing includes, but is not limited to data entry, “swivel chair” data entry Exception Handling, First Touch, Second Touch, etc., and tasks to manage and pursue to resolution, issues related to Transactions/Customer Orders.

2.16 Material

“Material” means a unit of equipment, apparatus, components, tools, supplies, material, Documentation, Hardware, or firmware thereto, or Managed Service(s) purchased or licensed hereunder by AT&T from Supplier or otherwise delivered by or on behalf of Supplier, including third party Material provided or furnished by Supplier.  “Material” shall be deemed to include any replacement parts.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

6

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

2.17 Order Management Center

“Order Management Center” or “OMC” means the center and facilities from which Agents support Contacts, Customer Care Support or Manual Transaction Processing

2.18 Special Terms and Conditions

“Special Terms and Conditions” means written terms and conditions that are (i) different from or additional to the terms and conditions set forth in this Agreement or the Master Agreement, (ii) specially negotiated by the Parties in reference to an Order, (iii) expressed in an Order or incorporated by reference to a document attached to an Order, such as a Scope of Work or Statement of Work, and (iv) executed by both Parties.

2.19 Subcontractor

“Subcontractor” or “subcontractor” means any person or entity (including an agent other than Supplier) supplying labor or materials to perform any or all of Supplier’s obligations under this Agreement, including any person or entity at any tier of subcontractors, and shall not be limited to those persons or entities with a direct relationship with Supplier.

2.20 Transaction

“Transaction” means a unique work step or set of related tasks that make up one of the required elements in the workflow of processing a Customer Order.  Transactions may vary in type, complexity and number of work steps or tasks to be completed which are identified in the workflow or processes pertaining to such Customer Order.  By way of explanation, a Transaction may be a unique request to obtain a credit check for a given Customer Order.

2.21 Transaction Type

“Transaction Type” shall mean a class or type of like or similar Transactions, tasks or Contacts for a given AT&T program that the Parties mutually agree to aggregate together for forecasting, billing, pricing, and Service Level reporting purposes with the makeup of such Transaction Type determined (and refined from time to time) by mutual agreement of the Parties in accordance with the terms of the applicable Order.  For the avoidance of doubt, a “Transaction Type” may be a group of call types, chat types or manual task types.

2.22 Time Study

“Time Study” means a direct and continuous observation of a given task component using a timekeeping device to record the time taken to accomplish a task or series of related tasks (or component of a Transaction) using a Statistically Valid Sample Size.  Under this Agreement, a Time Study is used only when the time measurements and averages on a given Transaction type or task are not able to be accurately reported from ASP Solution reporting tools (such inbound call tracking software or workflow software).

For a Time Study, the Parties shall mutually agree upon the design of the Time Study to be performed.  Factors to be defined for a Time Study include: ****

2.23 Statistically Valid Sample Size

“Statistically Valid Sample Size” means a sample size and makeup of measurements (Transactions or tasks) that are the focus of a Time Study or quality study that are sufficient to determine, within an expected error factor of ****, the value of the anticipated data or analysis result (such as average time) for a given Time Study.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

7

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

3.0 General Terms

3.1 Anticorruption Laws

Supplier hereby represents and warrants that the employees, temporary workers, agents, consultants, partners, officers, directors, members or representatives of Supplier and its Subcontractors, if any, performing Services or other activities under this Agreement (each and any of the foregoing individuals, for the purpose of this Section, a “Supplier Representative”) shall comply with the US Foreign Corrupt Practices Act and all applicable anticorruption laws (including commercial bribery laws).  Supplier Representatives shall not directly or indirectly pay, offer, give, promise to pay or authorize the payment of any portion of the compensation received in connection with this Agreement or any other monies or other things of value in connection with its performance to a Government Official, as such term is defined below, to obtain or retain business or secure any improper advantage nor shall it permit such actions by a third party acting on behalf of Supplier in connection with this Agreement.  For purposes of this Section, “Government Official” means: (i) an officer or employee of any government or any department, agency, or instrumentality thereof, including government-owned or government-controlled commercial entities; (ii) an officer or employee of a public international organization; (iii) any person acting in an official capacity for or on behalf of any government or department, agency, or instrumentality or public international organization; (iv) any political party or official thereof; (v) any candidate for political office; or (vi) any other person, individual or entity at the suggestion, request or direction or for the benefit of any of the above-described persons or entities.

3.2 Entire Agreement - Subordinate Agreement

The terms contained in this Agreement, and any Orders placed pursuant hereto, including all exhibits, appendices and subordinate documents attached to or referenced in this Agreement or any Orders placed pursuant hereto, together with Master Agreement No. SG021306, will constitute the entire integrated Agreement between Supplier and AT&T with regard to the subject matter.  This Agreement supersedes all prior oral and written communications, agreements and understandings of the Parties, if any, with respect to the services being provided herein, except for Master Agreement No. SG021306 and any Orders placed pursuant thereto except that this Agreement shall supersede the AT&T Order Management Center Contract (SG021306.S.007) dated as of January 1, 2009 between the Parties with respect to the services similar to those being provided herein.  Acceptance of Material or Services, payment or any inaction by AT&T shall not constitute AT&T’s, or any inaction by Supplier shall not constitute Supplier’s, consent to or Acceptance of any additional or different terms from those stated in this Agreement, except for terms in an Order placed by AT&T subject to this Agreement and signed by both Parties.  Except as otherwise set forth in the Order, estimates furnished by AT&T are for planning purposes only and shall not constitute commitments.

3.3 Government Contract Provisions

a.             To the extent that Supplier’s performance is subject to certain executive orders (including E.O. 11246 and E.O. 13201) and statutes (including Section 503 of the Rehabilitation Act of 1973, as amended; the Vietnam Era Veteran’s Readjustment Assistance Act of 1974; Section 8116 of the Defense Appropriations Act for Fiscal Year 2010 (Pub. L. 111-118); and the Jobs for Veterans Act) pertaining to government contractors, Supplier shall:

1.                          comply with such executive orders and statutes, and their implementing regulations, as amended from time to time; and

2.                          fulfill the obligations of a contractor under the clauses incorporated by this Section.

b.              This Section incorporates the following statutes and rules:

1.                          “Affirmative Action For Workers With Disabilities” (at 48 CFR §52.222-36);

2.                          “Employment Reports On Special Disabled Veterans, Veterans Of The Vietnam Era, and Other Eligible Veterans” (at 48 CFR §52.222-37);

3.                          “Equal Employment Opportunity” (at 48 CFR §52.222-26);

4.                          “Equal Employment Opportunity Clause” (at 41 CFR §60-1.4(a));

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

8

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

5.                          “Equal Opportunity For Special Disabled Veterans And Veterans of the Vietnam Era” (at 41 CFR §60-250.5);

6.                          “Equal Opportunity for Disabled Veterans, Recently Separated Veterans, Other Protected Veterans, and Armed Forces Service Medal Veterans” (at 41 CFR §60-300.5);

7.                          “Equal Opportunity For Workers With Disabilities” (at 41 CFR §60-741.5);

8.                          “Prohibition of Segregated Facilities” (at 48 CFR §52.222-21);

9.                          “Small Business Subcontracting Plan” (at 48 CFR §52.219-9);

10.                   “Utilization Of Small Business Concerns” (at 48 CFR §52.219-8);

11.                   “Whistleblower Protections Under the American Recovery and Reinvestment Act of 2009” (FAR 52.203-15);

12.                   “American Recovery and Reinvestment Act - Reporting Requirements” (FAR 52.204-11);

13.                   “GAO/IG Access” (FAR 52.212-5(d) (Alt. II), FAR 52.214-26(c) (Alt. I), FAR 52.215-2(d) (Alt. I));

14.                   “Davis-Bacon Act” (FAR 52.222-6);

15.                   “Buy American Act” (FAR 52.225-21, FAR 52.225-22, FAR 52.225-23, & FAR 52.225-24);

16.                   “Whistleblower Protections” (Pub. L. No. 111-5, Section 1553);

17.                   “Award term—Reporting and registration requirements under section 1512 of the Recovery Act” (2 CFR §176.50);

18.                   “GAO/IG Access” (Pub. L. No. 111-5, Section 902, 1514 and 1515);

19.                   “Award term—Wage Rate Requirements under Section 1606 of the Recovery Act” (2 CFR §176.190); and

20.                   “Buy American Requirements” (2 CFR §176.140, 2 CFR §176.150, 2 CFR §176.160, & 2 CFR §176.170).

c.               If an Order includes a statement that performance is intended for a government contract and incorporates additional government contracting provisions, Supplier shall also fulfill the obligations of a contractor or offeror under those additional provisions.

3.4 Information

a.              In connection with this Agreement, including Supplier’s performance of its obligations hereunder and AT&T’s receipt of Work, either Party may find it beneficial to disclose to the other Party (which may include permitting or enabling the other Party’s access to) certain of its Information.  For the purpose of this clause, each Party’s disclosure of Information to the other Party includes any Information that a Party receives, observes, collects, handles, stores, or accesses, in any way, in connection with this Agreement.  Information of a disclosing Party shall be deemed to be confidential or proprietary when it is clearly marked or otherwise identified by the disclosing Party as being confidential or proprietary, provided that if it is orally or visually disclosed (including Information conveyed to an answering machine, voice mail box or similar medium), the disclosing Party shall designate it as confidential or proprietary at the time of such disclosure.    A disclosing Party shall use commercially-reasonable efforts to mark or identify information subject to this confidentiality requirement, but the failure to mark or designate information as being confidential or proprietary will not waive the confidentiality where it is reasonably obvious, under the circumstances surrounding disclosure, that the Information is confidential or proprietary.  Neither Party shall be expected to mark or identify AT&T Customer Information, since any and all such AT&T Customer Information (such as name, address, telephone number, and other personal identifiers) shall automatically be deemed to be confidential and proprietary.  For greater certainty, Information provided by either Party to the other Party prior to the Effective Date of this Agreement in connection with the subject matter hereof, including any such Information provided under a separate non-disclosure agreement (howsoever denominated) is also subject to the terms of this Agreement.  Neither Party shall disclose Information under this Agreement that includes, in any form, any of the following: customer or employee personal information, credit card and credit related information, health or financial information, and/or authentication credentials.

b.              With respect to the Information of the disclosing Party, the receiving Party shall:

1.              hold all such Information in confidence with the same degree of care with which it protects its own confidential or proprietary Information, but with no less than reasonably prudent care;

2.              restrict disclosure of such Information solely to its employees, contractors, and agents (and also to its Affiliates’ employees, contractors, and agents) with a need to know such Information, advise such persons of their confidentiality obligations with respect thereto, and ensure that such persons are bound by obligations of confidentiality reasonably comparable to those imposed in this Agreement;

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

9

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

3.              use such Information only as needed to perform its obligations (and, if AT&T is the receiving Party, to receive the benefits of the Work provided) under this Agreement;

4.              except as necessary under the immediately preceding clause (3), not copy, distribute, or otherwise use any such Information or allow anyone else to copy, distribute, or otherwise use such Information; and ensure that any and all copies bear the same notices or legends, if any, as the originals; and

5.              upon the disclosing Party’s request, promptly return, or destroy all or any requested portion of the Information, including tangible and electronic copies, notes, summaries, extracts, mail or other communications, and provide written certification within **** to the disclosing Party that such Information has been returned or destroyed, provided that with respect to archival or back-up copies of Information that reside on the receiving Party’s systems, the receiving Party shall be deemed to have complied with its obligations under this clause (5) if it makes reasonable efforts to expunge from such systems, or to permanently render irretrievable, such copies.

c.               Except for Customer Information, neither Party shall have any obligation to the other Party with respect to Information which:

1.              at the time of disclosure was already known to the receiving Party free of any obligation to keep it confidential (as evidenced by the receiving Party’s written records prepared prior to such disclosure);

2.              is or becomes publicly known through no wrongful act of the receiving Party (such obligations ceasing at the time such Information becomes publicly known);

3.              is lawfully received from a third party, free of any obligation to keep it confidential;

4.              is independently developed by the receiving Party or a third party, as evidenced by the receiving Party’s written records, and where such development occurred without any direct or indirect use of or access to the Information received from the disclosing Party, or

5.              the disclosing Party consents in writing to be free of restriction.

d.              If a receiving Party is required to provide Information of a disclosing Party to any court or government agency pursuant to a written court order, subpoena, regulatory demand, request under the National Labor Relations Act (an “NLRA Request”), or process of law, the receiving Party must, unless prohibited by applicable law, first provide the disclosing Party with prompt written notice of such requirement and reasonable cooperation to the disclosing Party should it seek protective arrangements for the production of such Information.  The receiving Party will (i) take reasonable steps to limit any such provision of Information to the specific Information required by such court or agency, and (ii) continue to otherwise protect all Information disclosed in response to such order, subpoena, regulation, NLRA Request, or process of law.

e.               A receiving Party’s obligations with respect to any particular Information of a disclosing Party shall remain in effect, including after the expiration or termination of this Agreement, until such time as it qualifies under one of the exceptions set forth in clause (c) above.  Notwithstanding anything to the contrary herein, Customer Information shall remain confidential indefinitely and shall never be disclosed or used without the prior written approval of an authorized representative of AT&T.

3.5 Invoicing and Payment

a.              Pursuant to the Section of the Master Agreement entitled “Delivery, Performance and Acceptance”, Supplier shall render an invoice, in arrears on a monthly basis promptly after performance of all Work required by the Order (unless the Order or an attached Appendix specifies that Supplier may submit invoices for progress payments prior to Acceptance, as provided below).  The invoice must specify in detail, if applicable, (i) quantities of each ordered item, (ii) unit prices of each ordered item, (iii) whether the item is taxable and the amount of tax per item, (iv) item and commodity codes, (v) total amounts for each item, (vi) total amount of applicable sales or use taxes, (vii) discounts, (viii) shipping charges, if any, (ix) total amount due,  (x) remit to address, (xi) Order number and line item sequence, (xii) description of Service, and (xiii) special service charges, if any. Except as provided in the provision for progress payments, AT&T shall pay Supplier within sixty (60) days after receipt of the invoice in accordance with

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

10

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

the prices set forth in this Agreement or in the applicable Order.  If AT&T disputes any invoice rendered or amount paid, AT&T shall so notify Supplier in writing.  The Parties shall work in good faith to resolve invoicing and payment disputes expeditiously, and AT&T shall only pay the undisputed amount of any disputed invoice and shall not be obligated to make any payment with respect to the amount in dispute until the dispute is resolved or the error corrected.  In the event that the dispute is not resolved or the error not corrected within thirty (30) days of the date of AT&T’s notice to Supplier, the Parties shall escalate the matter to their respective Vice Presidents responsible for the business areas involved in the dispute for resolution.  The Vice Presidents of the Parties shall meet within 5 business days to resolve the matter.  Invoices received by AT&T more than one (1) year after the Delivery of Work are untimely and AT&T has no obligation to pay such invoices.

b.              Invoices for or including freight charges must be accompanied by legible copies of prepaid freight bills, express receipts or bills of lading supporting the invoice amounts.  Such invoices must include (i) the carrier’s name, (ii) date of shipment, (iii) number of pieces, (iv) weight and (v) freight classification.

c.               AT&T may deduct any setoff or recoupment claims that it or its Affiliates may have against Supplier from amounts due or to become due to Supplier, whether under this Agreement or otherwise.  Supplier shall pay any undisputed amount due to AT&T or its Affiliates that is not applied against the invoiced amounts within thirty (30) days after written demand by AT&T.

d.              If an Order or an Appendix specifies that Supplier may submit invoices for progress payments prior to Acceptance, Supplier is permitted to submit invoices at the end of each month and AT&T shall make progress payments to Supplier sixty (60) days after receipt of such invoices.

3.6 IP Ownership Additional Representations & Warranties — Offshore

a.              Representations & Warranties.  Supplier represents and warrants that all development Work done for AT&T under this Contract shall be performed in a manner that will not materially conflict with provisions of the MSA to the extent that they grant to AT&T ownership of or licenses to Intellectual Property in the developed Work.  For avoidance of doubt, the foregoing includes Supplier’s representation and warranty that no Work will be done in any country having laws that interfere with, limit, diminish, or encumber rights of ownership or licenses granted by Supplier to AT&T under the terms of the MSA unless the Work is carried out in a way which does not materially interfere with or diminish such ownership rights or licenses of AT&T.  Country laws that prevent the complete assignment of all rights in intellectual property or valid waiver of, or agreement not to enforce, Moral Rights, or which require additional compensation be paid to individuals so that developments they create may be used by a business that employs or hires them, will be deemed to interfere with, limit, diminish and/or encumber rights of ownership or licenses granted to AT&T unless the Supplier puts in place lawful and effective arrangements to ensure that the ownership rights or licenses of AT&T are not materially interfered with, limited, diminished or encumbered or to the extent that such laws do not result in a material diminishing or encumbering with respect to the ownership rights or licenses of AT&T. Supplier represents and warrants that contractual agreements either are or will be in place between all of the following Parties, as applicable:

i.                  Supplier and other entities doing Work in furtherance of the Contract (such as between Supplier and Supplier’s Subcontractor(s));

ii.               Entities doing Work in furtherance of the Contract (such as between Supplier’s Subcontractor and its subcontractor(s)); and

iii.            Supplier or other entities doing Work in furtherance of the Contract, on the one hand, and their respective employees, on the other hand,

each of which agreements is or will be sufficient under applicable law (as in effect at the time of such agreement) to ensure that AT&T’s rights of ownership or licenses to intellectual property in developed Work granted under the MSA, if any, are not materially interfered with, diminished or encumbered, as set forth above.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

11

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

Supplier’s compliance with this Section, and all Services performed in Offshore Locations with AT&T’s consent, shall be subject to the MSA section entitled “Records and Audit”.  Supplier shall ensure that Supplier’s agreements with its employees and Subcontractors allow Supplier to comply with such Section.

b.                                Waiver of Enforcement of Moral Rights.  Notwithstanding the foregoing, if Supplier, its employees or Subcontractors retain Moral Rights (meaning an author’s rights of attribution or integrity and right known as artist’s rights or droit moral) in any developments Work developed under this Agreement that is assigned or licensed by Supplier to AT&T, Supplier hereby agrees (and will obtain necessary acknowledgements and undertakings from its employees and Subcontractors stating that they also agree, to the extent allowable by the laws of the jurisdictions to which such employees and Subcontractors are subject) that the employees of Supplier, its employees and Subcontractors:

i.                  Do not require that any personally identifying information be used in connection with the developments, or any derivative works of or upgrades or updates thereto;

ii.               Do not object to the publication, use, modification, deletion and exploitation of the developments by AT&T, or its licensees, successors and assigns;

iii.            To the extent permitted by applicable law, forever waive and agree not to claim, assert or seek to enforce against AT&T, or its licensees, successors and assigns, any entitlement to any and all such developed Work; and

iv.           To the extent permitted by applicable law, forever release AT&T, its licensees, successors and assigns, from any claims that Supplier, its employees and Subcontractors could otherwise assert against such Parties by virtue of any such Moral Rights.

3.7 MBE/WBE/DVBE Responsibilities

Pursuant to the Master Agreement Section entitled “Utilization of, Minority, Women, and Disabled Veteran Owned Business Enterprises” (and Appendix G), Supplier agrees to provide a Prime Supplier MBE/WBE/DVBE Participation Plan annually by the ****, as provided in Appendix G.  Supplier will submit quarterly reports by the end of the **** following the close of each **** as directed in Appendix G.

3.8 Notices

a.                                      Each Party giving or making any notice, consent, request, demand, or other communication (each, a “Notice”) pursuant to this Agreement must give the Notice in writing and use one of the following methods, each of which for purposes of this Agreement is a writing: in person; first class mail with postage prepaid; Express Mail, Registered Mail, or Certified Mail (in each case, return receipt requested and postage prepaid); internationally recognized overnight courier (with all fees prepaid); or email.  If Notice is given by e-mail, it must be confirmed by a copy sent by any one of the other methods.  Each Party giving Notice shall address the Notice to the appropriate person (the “Addressee”) at the receiving Party at the address listed below:

For Supplier:

Synchronoss Technologies, Inc.

200 Crossing Blvd.

Bridgewater, NJ 08807

Attn: President

Email Address: legal@synchronoss.com

Fax Number: 908-231-0762

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

12

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

For AT&T:

AT&T Services, Inc.

4119 Broadway

Room 650A16

San Antonio, TX 78209

Attn: Notices Administrator

Email Address: g06586@att.com

B               .                     A Notice is effective only if the Party giving notice has complied with the foregoing requirements of this Section and the Addressee has received the Notice.  A Notice is deemed to have been received as follows:

1.              If a Notice is delivered by first class mail, **** after deposit in the mail;

2.              If a Notice is furnished in person, or sent by Express Mail, Registered Mail, or Certified Mail, or internationally recognized overnight courier, upon receipt as indicated by the date on the signed receipt;

3.              If a Notice is sent by e-mail, upon successful transmission to the recipient’s email account, if such Notice is sent in time to allow it to be accessible by the Addressee before the time allowed for giving such notice expires, and a confirmation copy is sent by one of the other methods.

c.               The addresses and telephone numbers to which Notices may be given to the Addressees of either Party may be changed by written Notice given by such Party to the other pursuant to this Section.

3.9 Offshore Work Permitted Under Specified Conditions

a.              Supplier shall not perform any Services related to hosting, data backups and disaster recovery of Supplier’s managed ASP Solution in a country other than the United States (“Offshore Location”) under this Agreement, nor allow such performance by any Subcontractor.  Further, Supplier shall not perform any other Services at an Offshore Location unless AT&T approves Work to be performed by Supplier or a Subcontractor at such Offshore Location.  As of the date hereof, for each Offshore Location, Appendix K sets forth the Offshore Locations that AT&T has approved; the Services to be performed at such location; and, if applicable, the identity of any Subcontractor performing such Work.  Prior to making any additions or deletions to the countries set forth in Appendix K, the Parties shall amend Appendix K.  A change in the location where a Service is performed from one Offshore Location to another AT&T approved Offshore Location, or a change in the Subcontractor performing the Work at the Offshore Location, shall not require approval or an amendment to Appendix K except as expressly set forth in an applicable Order.  The requirements of this Section shall be in addition to the Master Agreement Section entitled, “Assignment”, and the Section of this Agreement entitled “Work Done By Others”.

b.              AT&T shall have the right to withdraw its consent to the performance of Work at an Offshore Location (including any of the locations set forth in Appendix K) at any time by providing written notice to Supplier if AT&T reasonably determines that (i) there has been a breach of the terms of the Master Agreement and/or this Agreement with respect to an Offshore Location, (ii) a violation of any laws or regulations with respect to the Work performed at such Offshore Location, or (iii) the continuation of Work at said Offshore Location constitutes a risk to AT&T’s financial or security interests or could reasonably damage AT&T’s reputation, in which event Supplier shall use commercially reasonable efforts to perform such Work at a location within the United States, or at another approved Offshore Location, and the Parties shall amend this Agreement accordingly.  If the relocation of the Work results in a change in Supplier’s costs, then Supplier may propose modifications to the pricing terms if it reasonably determines that its costs will change due to such relocation.   If the Parties are unable to agree to such pricing terms, the Parties should escalate and resolve such issue under the Dispute Resolution Section of this Agreement.  .

c.               Supplier’s compliance with this Section, and all Services performed in Offshore Locations with AT&T’s consent, shall be subject to the Section of this Agreement entitled “Records and Audit”.  Supplier shall provide, and shall ensure all Subcontractors provide at no cost to AT&T, AT&T with physical access to inspect all Offshore Locations in accordance with such section.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

13

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

d.              Prior to interconnecting with, or otherwise accessing the AT&T internal company network, or doing any other Work at an Offshore Location, Supplier must be in compliance with all AT&T requirements for such interconnection, access or other Services.

e.               Any Services under this Agreement performed by Supplier or any Subcontractor in an Offshore Location without AT&T’s prior written consent shall be a material breach of this Agreement and, in addition to any other legal rights or remedies available to AT&T in law or in equity, AT&T may immediately Cancel and/or Terminate this Agreement without cost, liability or penalty to AT&T.

f.                When AT&T has granted consent for Services to be performed in an Offshore Location, Supplier shall remain fully responsible for compliance with any applicable foreign, federal, state or local law for such Services regardless of whether the Service is being performed by Supplier or a Subcontractor.  Nothing contained within this Agreement is intended to extend, nor does it extend, any rights or benefits to any Subcontractor, and no third party beneficiary right is intended or granted to any third party hereby.

g.               Supplier shall advise AT&T as early as possible prior to any change of Control of the Supplier or any of the entities performing the Work at the Offshore Location. “Control” means the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies by one person or entity or a group of persons or entities acting in concert; provided, however, that the legal or beneficial ownership, directly or indirectly, by persons or entities, including governmental entities, acting alone or in concert, of more than **** of the voting stock for the election of directors of a Party shall always be deemed Control.

3.10 Records and Audits

a.              Supplier shall maintain complete and accurate records relating to the Work and the performance of this Agreement. AT&T and its auditors (including internal audit staff and external auditors) and governmental authorities shall have the right to review such records at Supplier’s offices at mutually agreeable times (“AT&T Audits”), to verify the following:

****

b.              Supplier shall provide and shall require that its Subcontractors provide to AT&T, its auditors (including internal audit staff and external auditors), and governmental authorities access at all reasonable times to:

1.              any facility at which the Services or any portion thereof are being performed;

2.              systems and assets used to provide the Services or any portion thereof;

3.              Supplier employees and Subcontractor employees providing the Services or any portion thereof; and

4.              all Supplier and Subcontractor records, including financial records relating to the invoices and payment obligations and supporting documentation, pertaining to the Services.

The scope of AT&T Audits shall also include:

****

AT&T’s access to the records and other supporting documentation shall include the right to inspect and photocopy Supplier’s documentation and the documentation of its Subcontractors, and the right to retain copies thereof

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

14

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

outside of their physical location with appropriate safeguards, if such retention is deemed reasonably necessary by AT&T.

c.               AT&T Audits may be conducted **** (or more frequently if requested by governmental authorities who regulate AT&T’s business, if required by applicable Law or if auditors require follow-up access to complete audit inquiries or if an audit uncovers any problems or deficiencies), upon at least **** advance written notice (unless otherwise mandated by Law) provided that the time of such audit does not adversely affect Supplier’s operations or performance hereunder.  Supplier will cooperate, and will ensure that its Subcontractors cooperate, in the AT&T Audits, and will make the information reasonably required to conduct the AT&T Audits available on a timely basis.

d.              If, as a result of an AT&T Audit, AT&T determines that Supplier overcharged AT&T, then AT&T will notify Supplier in writing of the amount of such overcharge and, provided that Supplier agrees with such determination, Supplier will promptly pay to AT&T the amount of the overcharge. If any such AT&T Audit is agreed to by Supplier reveals an overcharge to AT&T during any **** period exceeding **** of all charges in the aggregate paid by AT&T hereunder during such period, then Supplier will reimburse AT&T for the cost of such AT&T Audit. If, as a result of an AT&T Audit, AT&T determines (and Supplier agrees) that Supplier has not performed or has unsatisfactorily performed any obligation under this Agreement, then Supplier will promptly remedy the non-performance or unsatisfactory performance.

e.               Supplier will maintain and retain the records set forth in Subsection (a) during the term of the Agreement and for **** thereafter (unless a discovery or legal hold request is made with respect to such records, in which case AT&T shall notify Supplier in writing of such request and Supplier shall retain such records until AT&T notifies Supplier that such discovery or legal hold request has expired). Supplier will provide AT&T, at AT&T’s request, with paper and electronic copies of documents and information reasonably necessary to verify Supplier’s compliance with this Agreement. Upon notification by AT&T of a discovery or legal hold request, Supplier shall fully cooperate with such request and immediately preserve any Supplier records covered by such request and promptly provide such Supplier records requested by AT&T related to the inquiry.

f.                Except as provided in Subsection (d), all reasonable out-of-pocket costs and expenses incurred by AT&T in connection with an AT&T Audit shall be paid by AT&T. Supplier shall be solely responsible for all costs and expenses incurred by Supplier in connection with its obligations under this Section.  In the event that either Party requires that an audit be performed by an independent auditor, unless otherwise specified herein, the Party requesting such independent auditor will be responsible for the costs and expenses associated with the independent auditor.

g.               With respect to AT&T requests for audits or inspections of Supplier subcontractors, the following applies:

i)            If Supplier’s agreement with its applicable subcontractor permits an AT&T Audit, AT&T shall work through Supplier in connection with such audit. Supplier shall work with AT&T in facilitating the subcontractor’s cooperation for an expeditious and thorough audit or inspection.

ii)   If Supplier’s contract with its applicable subcontractor precludes AT&T from directly conducting an audit or inspection, Supplier shall use reasonable best efforts to enable AT&T to perform an audit of the subcontractor with Supplier coordinating the audit process. Failing those efforts, Supplier shall, upon AT&T’s request, conduct the audit or inspection on behalf of AT&T, subject to terms agreed to by Supplier and AT&T for the

subcontractor audit, such as areas to be audited, applicable fees, and the timeframe for reporting audit results to AT&T. If AT&T’s request for a Supplier audit or inspection arises from, in AT&T’s good faith opinion, materially and consistently deficient Service provided by the subcontractor under AT&T’s account, and the audit in both Parties’ opinions confirms such deficiencies, Supplier shall not charge AT&T a fee for the Supplier’s audit of its subcontractor.

3.11 Termination

a.              Termination for Cause - If either Party breaches any provision of this Agreement and/or any Order, and (i) if the breach is one that by its nature could be cured, and such breach is not cured within **** after the breaching Party receives written notice, or (ii) if the breach is material and one that by its nature cannot be cured, then, in addition to all other rights and remedies at law or in equity or otherwise, the non-breaching Party shall

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

15

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

have the right upon written notice to immediately terminate this Agreement and/or any such Order without any obligation or liability.  Failure of the non-breaching Party to immediately terminate this Agreement and/or any Order (x) following a breach which continues longer than such cure period, provided such breach has not been cured prior to the non-breaching Party’s providing notice of termination, or (y) following a breach that cannot be cured or that constitutes a violation of Laws shall not constitute a waiver of the non-breaching Party’s rights to terminate; provided, however, if the non-breaching Party does not exercise such termination right within **** of the date such right is triggered, the non-breaching Party shall waive its right to terminate with respect to such breach.

b.              Termination for Convenience in Whole - AT&T may at any time,  for its own convenience and without cause, by providing Supplier written notice of at least **** prior to the effective date of the termination, terminate this Agreement in whole without any further liability to Supplier except as set forth herein.  The termination or expiration of this Agreement shall not affect the obligations of either Party to the other Party pursuant to any Order previously executed hereunder, and the terms and conditions of this Agreement shall continue to apply to such Order as if this Agreement were still in effect.  Likewise, termination or expiration of the Master Agreement shall not affect the obligations of either Party to the other Party pursuant to this Agreement or any Order thereunder, and the terms and conditions of the Master Agreement shall continue to apply to this Agreement or any Order thereunder as if the Master Agreement were still in effect.  For the avoidance of doubt, (a) such termination of the Agreement shall not relieve AT&T of any obligations for any minimums under the Agreement and, (b) the provisions for termination of Services under an Order for convenience by AT&T shall be as set forth in each Order.

c.               In the event that all Orders under the Agreement are terminated, this Agreement will be deemed to be terminated as of the effective date of the termination of the last such Order.

d.              Termination of Related Orders - Whenever law or a provision of this Agreement permits AT&T to terminate any Order, AT&T may also terminate such other Orders as are related to the same transaction or series of transactions as the Order in question to the extent such other Orders cannot be performed if the original Order is terminated.

e.               Return of Information Obligations upon Expiration or Termination

Each Party shall, except as required under law or this Agreement, upon expiration or termination of this Agreement and after all Wind Down and Transition efforts have concluded, promptly return all papers, materials, and property of the other Party.

f.                Wind Down and Transitioning.

1.              The Parties acknowledge that upon the termination or expiration of the Agreement (provided that such termination is not a result of termination by Supplier for cause), existing Customers will need to be migrated to AT&T-hosted or to third party-hosted platforms.  Because of the volume of Customer provisioning that is handled by Supplier at the time of execution of this Agreement, the Parties agree that they will need to develop a Transition Plan at that time in order to carry out an orderly, migration that mitigates disruption of operations for AT&T.  For purposes of this section, Transition Plan shall be defined as a mutually negotiated, written document outlining the respective obligations of each Party in carrying out an incremental or phased cutover of Customer Order provisioning provided by Supplier under this Agreement to AT&T, including the continued payment of agreed unit prices under any supplemental Order, to the extent incurred, and the payment of any agreed time and material charges incurred above the existing unit prices.

2.              The Parties agree to negotiate in good faith toward a Transition Plan that will cover at least the following points:

(i)                   Segmenting Customer Information from the view, modification, deletion or any other access by Supplier or Supplier-chosen subcontractors who will continue to work for Supplier on other, non-AT&T e-commerce businesses after the Transition Plan;

(i)                   Electronic capture, transfer and backup during Transition Plan of (a) Customer Information, including names, addresses, and IP addresses and other identifying information needed to carry out the

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

16

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

migration and (b)pending trouble tickets, billing or provisioning corrections, and other data for Customer Orders in process; and

(iii)             The length of time needed to complete the Transition Plan, including a schedule for phased or incremental cutovers.

3.              Supplier shall not be required, pursuant to subsections (g) (1) and (g) (2) above or otherwise, to disclose or otherwise make available to the AT&T the proprietary technology, software, or source code of Supplier or Supplier subcontractors, as well as any Confidential Information relating thereto.

3.12 Third Party Beneficiaries

The provisions of this Agreement are solely for the benefit of the Parties hereto and are not intended to confer upon any person or entity, except the Parties hereto, any rights or remedies hereunder. There are no third party beneficiaries of this Agreement, and this Agreement shall not provide any third person or entity with any remedy, claim, liability, reimbursement, claim of action or other right in excess of those existing without reference to this Agreement.

4.0 Special Terms

4.1 AT&T Supplier Information Security Requirements (SISR)

Supplier agrees to comply with the AT&T Supplier Information Security Requirements (SISR) set forth in Appendix O attached hereto and incorporated by reference herein. Supplier agrees to cooperate fully with AT&T, including completing checklists or similar documentation, to ensure that Software and/or computer systems Supplier develops, designs, supports and/or uses under this Agreement comply with the standards and requirements set forth in the SISR.  Supplier agrees to indemnify, defend at its expense, and hold AT&T, its Affiliates and its and their agents, employees and customers harmless against any Loss arising from or in connection with, or resulting from, any breach of the terms set forth in the SISR, in accordance with the Master Agreement Section entitled “Indemnity.”

4.2 Reimbursable Expenses

AT&T is not responsible for any travel, meal or other business related expense incurred by Supplier, whether or not incurred in its performance of its obligations under this Agreement, unless reimbursement of expenses is expressly authorized in this Agreement or an Order pursuant to this Agreement.  If reimbursement of expenses is so authorized, in order to be reimbursable, each and every such expense must comply with the requirements of AT&T’s Vendor Expense Policy attached hereto and incorporated herein as Appendix Z.  Supplier must provide in a timely manner receipts and other documentation as required by the Vendor Expense Policy and such additional documentation or information requested by AT&T to substantiate expenses submitted by Supplier for reimbursement.  All references to “Vendor” in Appendix Z apply to Supplier.

4.3 Supplier`s Audited Financial Statements

In the event that Supplier is not a publically traded corporation, Supplier shall provide to AT&T (or its third party delegate), upon request and at no charge, its bona fide and unedited audited fiscal year financial statements and other financial documents as reasonably requested by AT&T to allow an assessment of Supplier’s financial condition.  If Supplier is a subsidiary, owned, majority interest holder, or controlled by an entity (e.g., a parent company) that is not a publically traded corporation, then Supplier shall furnish such documents for both Supplier and its owning, controlling or parent company. If Supplier is a subsidiary, owned, majority interest holder, or controlled by an entity (e.g., a parent company) that is a publically traded corporation, then Supplier shall furnish such documents for both Supplier and its owning, controlling or parent company to the extent that such documents are not publically available.

4.4 Work Done By Others

If any part of Supplier’s Work is dependent upon Work performed by others or subcontracted consistent with the terms herein, Supplier shall inspect and promptly report to AT&T any defect that renders such other Work unsuitable for Supplier’s proper performance.  Any use of, including any changes to the use of, a Subcontractor must be approved by

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

17

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

AT&T in writing before commencement of the Work. Supplier shall provide to AT&T, upon request, information about the Subcontractor including the identity of, the location of, and a complete description of the activities to be performed by such Subcontractor. Where a portion of the Work is approved to be subcontracted, Supplier remains fully responsible for performance thereof and shall be responsible to AT&T for the acts and omissions of any Subcontractor.  Nothing in this Agreement shall create any contractual obligation or other liability of AT&T to any Subcontractor or its employees.  Supplier agrees to bind every Subcontractor to terms consistent with the terms of this Agreement.

4.5 Dispute Resolution

a.              Except for any claim or action concerning the breach of a license right, validity, enforceability or infringement of any patent, copyright, trademark (including trade dress and service mark) or other intellectual property right, nor a breach (or alleged breach) of a Party’s obligations in the sections entitled “Information,” “Ownership of Work Product,” or “Publicity.” If the Parties are unable promptly to resolve a dispute informally or by mediation, the Party alleging a material breach (the “Moving Party”) may initiate arbitration by providing the other Party written notice of its intent to arbitrate; provided, however, nothing herein shall limit a Party’s right to seek appropriate injunctive relief.  If the Parties are unable to agree upon an arbitrator within **** of the Moving Party’s written notice to arbitrate, the Moving Party may request the American Arbitration Association (“AAA”) to appoint an arbitrator.  The AAA shall select an arbitrator who can promptly proceed with and strive to conclude the arbitration as specified herein.  If a dispute is submitted to an arbitrator, it shall be finally resolved through binding arbitration in Chicago, Illinois, according to the Commercial Arbitration Rules of the AAA, except as modified herein.  The award rendered by the arbitrator shall be final and binding on the Parties and shall be deemed enforceable in any court having jurisdiction thereof.  The arbitration shall be heard by a single arbitrator who shall by training, education, or experience have knowledge of the general subject matter of this Agreement.  The arbitrator shall have only the power to award damages, injunctive relief and other remedies to the extent the same would be available in a court of law having jurisdiction of the matter, except that the arbitrator shall not have the power to vary the provisions of this Agreement.  The arbitrator shall promptly commence the arbitration proceeding with the intent to conclude the proceedings and issue a written decision stating in reasonable detail the basis for the award, which must be supported by law and substantial evidence, as promptly as the circumstances demand and permit, but generally no later than **** after the arbitrator’s appointment.  Each Party acknowledges that it is giving up judicial rights to a jury trial, discovery and most grounds for appeal under the foregoing provision.

b.              The prevailing Party shall be entitled to recover from the non-prevailing Party the reasonable attorneys’ fees, expenses and costs incurred by the prevailing Party in any arbitration.

c.               No provision of this Section shall limit the right of any Party to exercise its rights of setoff.  The exercise of a remedy does not waive the right of either Party to resort to arbitration.

d.             During dispute resolution proceedings, including arbitration, the Parties shall continue to perform their obligations under this Agreement, except for those obligations directly related to the dispute at issue.

4.6 Special Events

a.              AT&T and Supplier agree and acknowledge that from time to time “Special Events” (as defined below) may arise that will temporarily increase volumes of Customer Orders, Contacts and/or Manual Transaction Processing and may require changes in processes or processing requirements.   The Parties will work in good faith to agree upon the appropriate temporary staffing levels to accommodate volume increases and process changes during such Special Events.  Each Special Event of increased volume shall be forecasted and the requirements negotiated at least **** in advance of such Special Event “go live” date.  Each Special Event will include a detailed “project plan” to be mutually agreed upon by the Parties containing at a minimum the following elements:

****

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

18

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

****

b.   For purposes of this Agreement, “Special Event” shall mean any event that is reasonably expected to result in **** where, and in each case, such condition ****.

4.7 AT&T Data and AT&T Derived Data

a.              Definitions.  For purposes of this Section:

1.                                       “AT&T Data” means any data or information of AT&T or its customers, that is disclosed or provided to Supplier by, or otherwise obtained by Supplier from, AT&T or its customers, including Customer Information and customer proprietary network information (as that term is defined in Section 222 of the Communications Act of 1934, as amended, 47 U.S.C. 222), as well as data and information with respect to the businesses, customers, operations, networks, systems, facilities, products, rates, regulatory compliance, competitors, consumer markets, assets, expenditures, mergers, acquisitions, divestitures, billings, collections, revenues and finances of AT&T.

2.                                       “AT&T Derived Data” means any data or information that is a result of or modification of, collection, adaption, revision, translation, abridgement, condensation, compilation, evaluation, expansion, or any other recasting or processing of the AT&T Data, for example, as a result of Supplier’s observation, analysis, or visualization of AT&T Data in furtherance of this Agreement or an Order hereunder or arising out of the performance of Supplier’s obligations under this Agreement or an Order or as a result of Supplier having access to AT&T infrastructure, systems, data, hardware, software or processes (for

example, through data processing input and output, service level measurements, or ascertainment of network and system information).

b.                                      Ownership of AT&T Data and AT&T Derived Data.

1.                                       AT&T Data is the property of AT&T.  To the extent needed to perfect AT&T’s ownership in AT&T Data, Supplier hereby assigns all right, title and interest in AT&T Data to AT&T.  No transfer of title in AT&T Data is implied or shall occur under this Agreement.  Supplier shall promptly return AT&T Data, at no cost to AT&T, and in the format and on the media prescribed by AT&T (i) at any time at AT&T’s request, regardless of the expiration or termination of this Agreement, (ii) at the expiration or termination of this Agreement, or (iii) with respect to particular AT&T Data, whenever such data is no longer needed by Supplier to perform its obligations under this Agreement. AT&T Data shall not be (a) utilized by Supplier for any purpose other than as required to fulfill its obligations under this Agreement, (b) sold, assigned, leased, commercially exploited or otherwise provided to or accessed by third Parties, whether by or on behalf of Supplier, (c) withheld from AT&T by Supplier, or (d) used by Supplier to assert any lien or other right against or to it.  Supplier shall promptly notify AT&T if Supplier believes that any use of AT&T Data by Supplier contemplated under this Agreement or to be undertaken as part of the performance of this Agreement is inconsistent with the preceding sentence.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

19

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

2.                                      AT&T shall own all right, title and interest to the AT&T Derived Data.  To the extent needed to perfect AT&T’s ownership in AT&T Derived Data, Supplier hereby assigns all right, title and interest in AT&T Derived Data to AT&T.  AT&T grants to Supplier a license to access, use, and copy the AT&T Derived Data, with no right to grant sublicenses, solely for the performance of Supplier’s obligations during the Term of this Agreement and solely in compliance with AT&T’s privacy policies, including obligations relating to Customer Information.  Supplier shall deliver AT&T Derived Data, at no cost to AT&T, in the format, on the media and in the timing prescribed by AT&T.  For the avoidance of doubt, Supplier shall not create or develop AT&T Derived Data after the expiration or termination of this Agreement.

3.                                      For the avoidance of doubt, AT&T Data and AT&T Derived Data that was disclosed to Supplier prior to the Effective Date shall be considered AT&T Data and AT&T Derived Data under this Agreement.  Supplier’s obligation to return AT&T Data and AT&T Derived Data upon AT&T’s request shall survive the expiration or termination of this Agreement, but shall not apply to AT&T Data and AT&T Derived Data which, at the time of AT&T’s request for return, is no longer retained by or on behalf of Supplier.

(Signature Page to Follow Immediately Hereafter)

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

20

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

5.0 Execution of Agreement

5.1 Transmission of Original Signatures and Executing Multiple Counterparts

Original signatures transmitted and received via facsimile or other electronic transmission of a scanned document (e.g., pdf or similar format) are true and valid signatures for all purposes hereunder and shall bind the Parties to the same extent as that of original signatures. This Agreement may be executed in multiple counterparts, each of which shall be deemed to constitute an original but all of which together shall constitute only one document.

IN WITNESS WHEREOF, the Parties have caused this Agreement to be executed as of the Effective Date.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

21

Appendices

Appendix A — Description of Supplier’s Material and/or Services

Supplier shall provide the following Material and Services:

1.0          Order Management Center and ASP Solution (the “Managed Service”)

Supplier shall provide and manage a scalable, reliable and flexible OMC and ASP Solution for support of AT&T eCommerce operations.  Supplier shall focus on meeting service level agreements (“SLAs”) for Customer Order processing, Manual Transaction Processing, Inbound Call handling and other Customer Contacts for AT&T eCommerce.  Supplier shall, in all material respects, adhere to all of AT&T business processes and security standards set forth in this Agreement in performing its OMC Services to support an AT&T branded customer experience.  Supplier shall support business from AT&T eCommerce consumer and business customers.

1.1             Customer Order Processing

The primary source of Customer Order volumes will be generated from AT&T eCommerce front-end clients (applications or systems). Supplier shall utilize the OMC to strive to consistently deliver at or above the SLA commitments.  The Supplier OMC operating hours will be flexible to support the overall AT&T eCommerce objectives and mutually agreed upon in writing by the Parties for each program and identified in the applicable Order.  The OMC will operate seven days a week and will support the hours of operation agreed upon by the Parties and shall include **** OMC technical NOC support as set forth in Section 3.0 below.

1.2             Order Management Center Work Flow

Supplier shall strive to consistently meet a the Customer Order cycle time objectives for the Customer Order or Transactions types identified herein (and excluding any Customer Orders or Transactions where Manual Processing is done by AT&T as set forth in Section 5 below) , in accordance with AT&T’s requirements identified in an applicable Order.  In order to accomplish this, Supplier will strive to streamline the process by reducing the number of manual handoffs in the current process.  In addition, Supplier’s Agents will manage all inbound and outbound AT&T Customer Contacts associated with AT&T eCommerce Customer Orders.  The OMC will leverage Supplier’s integrated suite of the products described in Section 4.0 below to meet or exceed SLA objectives in this Agreement or an applicable Order.

2.0          Supplier OMC

2.1             Order Gateway

Supplier shall provide AT&T with access to the order gateway (“Order Gateway”) component of the ASP Solution.  The Order Gateway is the functionality of the ASP solution supporting ****.  The Order gateway is ****.  The Order Gateway interfaces with ****.  The Order Gateway provides a ****.

2.2             Workflow Manager

The “Workflow Manager” is the web-based workflow component of the ASP Solution.  The Workflow Manager is used to (a) ****.  Supplier utilizes the Workflow Manager to provide ****. The key benefits are:

****

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

22

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

****

2.3             Reporting Platform

Supplier shall provide AT&T eCommerce with operational metrics and visibility to all Customer Orders flowing through the Order Gateway and Workflow Manager.  The reporting capability of the ASP Solution (“Reporting Platform”) provides ****.  The Reporting Platform shall provide ****.

The following reporting tools are components of the Reporting Platform and will be managed by Supplier throughout the term of this Agreement, at no additional cost to AT&T:

****

2.4             Integrated IVR Solution

Supplier will provide AT&T with a voice and/or DTMF enabled Interactive Voice Response (IVR) capability of the ASP Solution that will provide AT&T with the following capabilities for Inbound Calls:  ****.  The IVR will be implemented and managed by Supplier.

2.5            Email Manager

Email Manager is the functionality of the ASP Solution supporting **** via email.  Supplier shall provide AT&T with the email manager functionality of the ASP Solution.

3.0          ASP Solution Hosting

Supplier shall host the ASP Solution.  In addition to hosting the ASP Solution, Supplier will provide Tier 1—3 support for the ASP Solution and hosting environment including;

a)             Tier 1 - NOC

Supplier’s Network Operations Center (NOC) provides first level support for all ASP Solution Defects or infrastructure related issues. The NOC monitors all Supplier ASP Solution systems **** utilizing an array of network an

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

23

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

application management tools. The NOC also provides first line support for all AT&T end user questions and application account management requests received from designated AT&T staff.

b)             Tier 2 - MDF

The Supplier’s Managed Data Center Facility (MDF) team consists **** that provide second level support for all ASP Solution system-related issues. The MDF team works directly with the NOC to respond to any system generated alerts or end user reports of system issues or anomalies.  The MDF team will address any issues related to ASP Solution system performance, hardware failures, OS and DBMS tuning and system configuration.

The MDF team will also work with AT&T to define and configure system integration points like VPN, shared security keys etc.

c)              Tier 3 - Application Support / R&D

The Supplier’s Application Support and R&D team works directly with the NOC and MDF teams to address any issues related to ASP Solution performance or functionality that require software development support. This team will participate in troubleshooting efforts that may point to code related or system integration issues and will develop any software patches/fixes required to address systems issues.

3.1             Hosting Requirements

Supplier will provide and maintain all facilities for hosting the ASP Solution, including: physical premises, server(s), database server(s), firewall(s), Internet connectivity and any other facilities required to support the Order Gateway and Order Manager.

Supplier shall provide sufficient hardware, software and equipment to meet applicable service levels defined in an applicable Order for the ASP Solution.

3.2             Secure Environment

The physical premises hosting and supporting the ASP Solution will provide security solutions designed to permit access only by authorized personnel.  ****.

3.3             Access Security

Supplier shall adhere to all AT&T access control requirements as defined in Section 4.1 of the Master Agreement.  Supplier utilizes a combination of ****.

3.4             Security and Privacy

In the event Supplier receives AT&T Information, including AT&T Customer Information (as defined in Section 2.10 of this Agreement), Supplier shall not use such AT&T Information for any purpose other than the fulfillment of Supplier’s obligations of this Agreement or an applicable Customer Order.  Supplier shall not provide such AT&T Information to any third-party (other than Supplier’s contractors who have a need to know such information in connection with performing Services on Supplier’s behalf hereunder and have agreed in writing to keep such AT&T Data confidential and abide by the other obligations applicable to Supplier hereunder, in which case Supplier represents and warrants that it assumes all obligations of this Agreement on behalf of its contractors) for any reason, unless specifically authorized in writing by AT&T or to the extent such release is contemplated by the nature of the Services under an Order; provided, however, if Supplier is required to produce such AT&T Information to comply with any legal, regulatory or law enforcement requirement or law enforcement investigations, Supplier may do so after providing AT&T i) prior written notice of its intent to produce the AT&T Information (to the extent permitted under the law) and ii) an opportunity to seek a protective order or similar mechanism to prevent disclosure as AT&T deems necessary.  Supplier shall comply with the AT&T security or privacy requirements set forth in Section 4.1 of this Agreement entitled “AT&T Supplier Information Security Requirements (SISR)” and attached Appendix O - Security Attachment (SISR).  In the event such

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

24

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

requirements are modified, AT&T shall provide such modifications to Supplier in writing.  Such requirements include, but are not limited to, ****.  At a minimum, Supplier will undertake the following measures to ensure the security of all AT&T Information and other AT&T Customer Information:

****

3.5             Environmental Standards

Supplier represents and warrants that any hardware required to perform the Services under this Agreement will be protected from damage by:

****

In the event of a loss of commercial power, the facility is connected to **** capable of supporting the Supplier Managed Data Facility located in **** (“MDF”) for no less than ****.

3.6             Monitoring

The following monitoring tools and practices will be provided by Supplier.

****

The production system will reside in the Supplier MDF.  The MDF is equipped with an automated WAN/LAN monitoring system, a spare parts cabinet, as well as various technical problem determination and resolution tools.

3.7             Backups

Supplier shall automatically backup Data and applications ****.  Supplier shall provide a real-time mechanism to ensure the safety and integrity of Order Gateway data.  On the ****.  The backup is an automated process. Additionally, the backup from the **** is stored ****.

4.0          Disaster Recovery (DR)

Supplier shall provide a disaster recovery solution for the all Services required under this Agreement or an applicable Order that enables rapid restoration of all functions of the system in event of a long-term service disruption to the

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

25

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

Supplier MDF.  This section provides an overview of the infrastructure required to support the disaster recovery solution as well as the service levels associated with the solution.

4.1             DR Solution Overview

Supplier shall leverage a **** to provide a highly available system that will restore Supplier’s ASP Solution to be available to provide full service within ****of a total service outage that is anticipated to preclude use of its primary MDF (currently ****) for an extended period and enacting the DR plan.  Supplier will place the current UAT **** in the alternate facility as the core component of this solution.  This environment will be augmented to provide sufficient server hardware and software to be a functional equivalent to the current production environment in terms of handling the forecasted Customer Order volume and user load.  The **** environment will contain a full compliment of network infrastructure including firewalls, load balancers and high-speed switches to ensure all network connectivity is materially equivalent to that used to support forecasted production needs.

A **** will be implemented to ensure that a full copy of the production database is maintained in the **** at all times.  In the event of a total ASP Solution service disruption in the primary facility, upon enacting the DR plan, the **** will be reconfigured to access the production database and provide the production instance of the ASP Solution.

4.2             DR Service Levels

Supplier shall meet or exceed the following DR solution service levels:

a)             Service restoration time: ****from enacting DR plan;

b)             System performance level: equal to production in terms of user and order volume; and

c)              ASP Solution System SLA’s while in DR environment: same as for production.

NOTE: This solution will rely on the existing dedicated, private circuit (e.g. friends net connection) between Supplier’s **** office and AT&T’s ****.  Service levels are subject to reasonable support being provided by AT&T in such restoration (i.e.: connectivity to AT&T applications from alternate site).

d)             A DR plan test will be performed **** at a mutually agreed to time by both Parties.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

26

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

Appendix B — Supplier’s Prices

Supplier shall provide the Managed Services and other Services, including any applicable deliverables set forth in the scope of such Services, for the following fees:

1.0          Technology Fee

The following rates shall be effective on the Effective Date of this Agreement.  On or about the ****, Supplier shall provide AT&T with its calculation of the number of Customer Orders processed through the Order Gateway during the **** period immediately preceding such **** (the “Rolling **** Actual Orders Volumes”).  The Technology Fee **** in such ****shall be based on the Rolling **** Actual Orders Volumes in accordance with Table 1 below.  For each such ****, the “Aggregate **** Technology Fee” shall be equal to the product of ****.

Supplier shall invoice each Channel in arrears for its allocation of the Aggregate ****Technology Fee in accordance with such Channel’s applicable Customer Order volume as follows:  ****.

The Technology Fee covers all costs related to the software maintenance and support of Supplier’s ASP Solution.

Table 1 Technology Fee

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

27

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

Notwithstanding the foregoing, a minimum fee of **** shall apply for the Aggregate **** Technology Fee during each ****of the Initial Term or any Renewal Term.  The calculation of the Rolling **** Actual Customer Order Volume shall be based on all Channels supported on the given billing ****.  By way of example, ****.

2.0          Hosting Fee

For each Channel supported on the Effective Date of this Agreement, AT&T shall pay Supplier an annual “Hosting Fee” **** of the Initial Term or any Renewal Term.

Supplier shall invoice each Hosting Fee monthly in arrears in **** by Channel in accordance with the applicable Order for such Channel.

Upon the Effective Date of this Agreement Supplier shall ensure that each Channel has the necessary hosting infrastructure and network capacity to support up to **** the Customer Order volume of the of the highest monthly volume of Customer Orders processed by such Channel during preceding the ****period (the “Capacity Expectation”).

In the event that AT&T requests that Supplier increase such Channel’s capacity by greater the Capacity Expectation, then the Parties will work together through the Change Control process documented in the applicable Order with respect to the increased equipment or infrastructure required for Supplier to acquire to increase such capacity and to mutually determine if any additional fees are applicable.  Any such increase in Customer Orders estimates provided by AT&T will follow the existing Technology Fees set forth in Table 1 (no change to the fees in Table 1).

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

28

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

3.0          IT Professional Services Fees

Supplier shall provide a minimum number of **** of IT professional services, as shown in the Table below, to be performed by Supplier at AT&T’s sole discretion and direction, with such **** consumed (a) across all Channels and (b) in reasonably even distribution for each Channel during each **** period. Unused **** may not be carried forward or applied as a credit against other services or fees.

Table 3

In the event of any Renewal Terms the minimum number of hours of IT professional services shall be ****.

Supplier shall invoice its IT professional services fees ****in arrears, by Channel, based on actual project ****worked in accordance with the following blended ****:

****

In addition, in the event that Supplier provides IT professional service **** in excess of the **** Threshold for the applicable Period identified in the table below (in aggregate, across all Channels in any such Period), Supplier shall provide a credit to AT&T equal to **** for such IT professional services paid in such Period.

Table 3.1

In the event of any Renewal Term, the **** Threshold for each **** period shall be ****.

Supplier agrees that projects will be scoped and resources forecasted and allocated in a manner consistent with professional industry practices (including advance planning timelines and forecasts for **** anticipated), and that projects with equivalent scope will have comparable costs under the above pricing.  Supplier shall provide detailed documentation of proposed and actual utilization of **** as agreed by the Parties and Supplier shall provide **** the aggregate **** used to date in the then-current annual period and AT&T’s attainment of **** towards the credit based on the discount above.  The Parties agree that, unless otherwise agreed upon by the Parties, (i) Supplier shall not unreasonably withhold **** that have been incorporated in a forecast causing AT&T not to reach a credit threshold that would otherwise have been met but for the withholding of **** and where Supplier should reasonably been able to have supplied such resources based on prior **** billed over the prior **** period, and (b) Supplier shall not be obligated to work **** in excess of the forecasted and planned resource allocation for IT Professional Services in a compressed timeline in order to meet a threshold or provide a resource allocation that is more that **** than the average of the prior **** actual run rate in IT Professional Service **** billed.

Notwithstanding the foregoing, AT&T requires further clarification with respect to Supplier’s estimating process for IT professional services work and time reporting capability and the determination of IP ownership relative to the delivered Work.  Within **** of the Effective Date of this Agreement, AT&T shall provide proposed language that outlines the current process used and the Parties shall mutually agree to any changes required to such process.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

29

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

Notwithstanding anything to the contrary, AT&T shall provide Supplier with the opportunity to provide at least **** release **** dedicated to performance refactoring and scalability enhancements.  Such release(s) shall be at no additional cost to AT&T and shall not be part of the annual IT professional services commitment referenced above or constitute a remedy for Supplier’s failure to miss an SLA.

4.0          Customer Care Support and Manual Transaction Processing Fees

4.1       The following rates shall be effective on the Effective Date of this Agreement.  AT&T shall pay Supplier for Customer Care Support and Manual Transaction Processing as follows:

The Parties shall mutually agree if Manual Transaction Processing or Customer Care Support for a given program (or element of a program) shall be invoiced either on (a) an “FTE Pricing” basis or (b) a fixed fee per Transaction, Inbound Call, Outbound Call or Chat, as applicable, “Transaction Price” (or “Transaction Pricing”) basis.  Both the FTE Pricing and the Transaction Price shall be determined using the Baseline Rate **** in Tables 4 and 5 below and using the methodology set forth below in this Section 4.1 and Section 4.2 and 4.3, respectively and adjusted pursuant to the terms of Section 4.4 below as applicable.  In the event that Transaction Pricing Basis is agreed upon, the Parties shall mutually agree on the makeup of each “Transaction Type” as well as the effective date for such billing (if not previously in place).  There may be multiple Transaction Types in a given program and each Transaction Type may have a unique Transaction Price.

Table 4: Baseline Rate Per Hour Table As of the Effective Date

For any program element where Agents supporting Inbound Calls or Outbound Calls or Chats are located entirely at OMC locations within the United States and Canada (“North America Program(s)”) as of the Effective Date of this Agreement, AT&T may elect to permit Supplier to provide such support from approved countries (as set forth in Appendix K).  For such North America Program(s) and for any program element **** where Agents support Inbound Calls or Outbound Calls or Chats at OMC locations within the United States and Canada (together with any North America Program, an “Eligible Program”), the Parties shall agree in writing on a threshold for the amount of volume of Contacts to be supported by Agents outside of the United States and Canada.  Such threshold shall be either (a) up to **** of volume of Contacts in ****, or (b) up to **** of volume of Contacts in ****.  Table 6 sets forth the threshold amount of volume of Contacts to be supported by Agents outside of the United States and Canada for each Channel as of the Effective Date.  Supplier shall be permitted to process a volume of such Contacts in approved countries up to the agreed upon threshold amount agreed upon by the Parties.  Such processing shall be in accordance with the terms of any Order, including service level.  Upon production processing of Contacts outside of the United States and Canada for such Eligible Program (i.e. upon completion of Agent training and nesting), the applicable Baseline Rate **** set forth in Table 4 above shall be reduced as follows based on the agreed upon threshold (such reduction shall apply for such Eligible Program only; provided, however, that for an Eligible Program that no reduction shall be provided for any Eligible Program that is listed on Table 6 unless the Parties agree that the threshold amount for such Eligible Program changes from the threshold amount as of the Effective Date to a higher threshold amount):

Table 5

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

30

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

    *     Note: The maximum reduction allowed per Table 5 is **** from the Baseline Rates **** shown in Table 4 and, for any Channel that is already within a Tier of Table 5 above, shall as shown in Table 6 below, the Baseline Rate shall be deemed to already include any such reduction for such Tier.

For purposes of illustration on the reduction of baseline rates ****, here are examples:

****

Table 6 below establishes by program element each Channel’s current mix of onshore/offshore resources:

Table 6

** Baseline Rate in Table 4 above already reflects Tier 1 reduction in Table 5 above.

Charges to AT&T by Supplier for Agent training and the related costs of migration shall be mutually agreed upon by the Parties in writing prior to any such change.

Supplier shall invoice its fees **** in arrears, by Channel, (i) in accordance with the Transaction pricing (each a “Transaction Price”) as described in the applicable Order or (ii), in situations where a Transaction Price has not been established or for periods where FTE Pricing applies, at the **** rates shown above based on the FTE Staff Plan (as defined below) for such ****.

4.2       “Transaction Pricing” for Customer Care Support and Manual Transaction Processing for a Transaction Type for given Channel and program:

Upon agreeing on the Transaction Types applicable for a Transaction Price, the fixed Transaction Price for each such Transaction Type shall be determined by the following calculations and such Transaction Price shall be effective on the Effective Date for Transaction Type(s) currently in use or the first day of the month in which the Transaction Type(s) is established:

For Inbound Calls, Outbound Calls & Chats:

****

For Non call or Non-Chat Manual Transaction Processing:

****

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

31

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

The “CPH” for a given Transaction Type shall mean the ****, as agreed upon by the Parties.   For the avoidance of doubt, as used above, the term CPH shall apply for ****, as applicable for the Transaction Type).

Average Handle Time (AHT) for Inbound Calls and Outbound Calls and Chats supported under an Order, means the ****.  Average Handle Time for manual processing of Transactions supported under an Order, means ****.  AHT shall be determined by applicable ASP Solution reports and, to the extent such reports are not available, a Time Study for such task or task component for which reporting data is not available.  AHTs shall be determined assuming volumes within forecasted levels and distribution patterns and for Agent performance in compliance of required quality and other SLAs.

The foregoing pricing terms shall be subject to any additional terms and conditions set forth in Sections 4.4 and 4.5 below and in an applicable Order (such as forecast requirements, minimums and additional pricing assumptions).  Upon determining applicable Transaction Prices, Synchronoss shall provide a chart of such Transaction Prices for each Transaction Price to AT&T (the “Price Chart”).  Such Price Chart shall apply to applicable Transactions until modified or replaced pursuant to the terms of this Agreement or the Order.  Upon any such modification, a modified Price Chart shall be supplied.

4.3  “FTE Pricing” for Customer Care Support where a Transaction Price does not apply or is not available for a given program or program element (i.e. in a new program) shall be determined as follows:  ****.    For such program for such period, AT&T will be invoiced based on the ****.  Each ****.   Synchronoss shall notify AT&T prior to its consuming any **** to be invoiced as Overtime ****.   The foregoing pricing terms shall be subject to any additional terms and conditions set forth in an applicable Order (such as forecast requirements, minimums and pricing assumptions).

4.4  During periods where Customer Care Support is subject to an Exclusion (as defined in the applicable Order), in the event that Supplier determines that the number of available  Agents for support of Contacts or Manual Transaction Processing may be able to be augmented or maintained by retaining Agents outside of or following the conclusion of their scheduled shift where such retention would require Overtime **** for such Agents, Supplier shall notify AT&T of such potential availability.  Upon the written approval of AT&T, Supplier may bill, in addition to any Transaction Price, an amount of **** of the Baseline Rate **** applicable to the program for each Overtime **** authorized by AT&T (or other amount as agreed upon by the Parties in writing).

For the avoidance of doubt, the premiums in excess of base Transaction Prices or the applicable Baseline Rate ****(for FTE Pricing) set forth above are not billable to AT&T in the event that such Overtime **** are (i) not

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

32

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

approved by AT&T in writing, or (ii) consumed, at Supplier’s election, to maintain required service levels during periods where such Overtime **** are the result of Agent staffing shortages due to sick call outs or Agent attrition (and not the result of an Exclusion).

4.5  Pricing Assumptions

Except as otherwise set forth in an Order, the following terms (the “Price Assumptions”) shall apply to programs or program elements with Transaction Pricing:

i)                 Supplier and AT&T will meet once every **** (as requested by either Party) to review and adjust, in accordance with the terms set forth herein and the Order, the applicable Transaction Price where appropriate based on changes in CPH or as set forth in this Section 4.5 below.

ii)              In the event that the ASP Solution reporting data or Time Studies reveal a material change in Supplier’s or Customer Care Support costs greater than **** for a given Transaction Type, both Parties agree to review in detail the core reasons for such change.  Except to the extent where a change in processing costs is attributed to Supplier not meeting its performance obligations and not to a change in the process or applications supporting the process, then both Parties will negotiate in good faith a change in the pricing to reflect such change factoring such metrics as ****.

iii)           Supplier anticipates Customer Care Support for additional Transaction Types or Contact types may be added form time to time.  The fees for these new Transactions or Contact types could be priced at a different rate.  The fee for processing for such new Transactions Types or Contacts would be determined by the complexity and processing requirements associated with the Transaction and the Transaction Price for Manually Transactions Processing or Contacts will be determined (in accordance with the terms of Section 4.2) after a large enough sample size is processed by the ASP Solution and will be mutually agreed to in writing by both Parties.  During this period which shall not exceed ****, the Parties shall mutually agree on a price until an amendment to the Order is completed with mutually agreed upon pricing and associated SLA and remedies reflecting such new Transaction Types or Contacts.

iv)          New Customer Care Support elements or changes as set forth in this Section 4.5 above would be handled through a written change request.  New Contact support or Manual Transaction Processing will require an initial trial period that will produce a large enough sample size to provide Transaction Pricing (and the respective Transaction Price) for such Contacts or Manually Processing.  Service levels and remedies will not apply during the initial trial period, which shall not exceed **** unless mutually agreed by the Parties.

v)             Any modifications requested by AT&T that impact the CPH, configuration or processing methodology by Supplier may require adjustments to the fees herein.  Upon receipt and review of AT&T’s modification request, Supplier shall inform AT&T of any proposed increase to the fees. AT&T will have the sole option of whether or not to move forward with its requested modification.

vi)          Supplier shall be entitled to an additional period, not to exceed ****, upon a large ramp of Agents for a program or the addition, enhancement, upgrade or re-release of a material change to process or procedure requested by a AT&T, where the Parties agree (such agreement not to be unreasonably withheld) that such change can reasonably be expected to materially affect Supplier’s ability to meet one or more Service Levels (each, an “SL Relief Period”).  Such SL Relief Period shall apply only with respect to the Service Level(s) that the Parties agree are adversely affected by such addition, ramp, enhancement, upgrade, modification or re-release.  During a SL Relief Periods, Remedies shall not be imposed with regard to the affected Service Level(s) for the impacted Services, however, that Supplier shall use commercially reasonable efforts to meet the Services Levels.

vii)       In the event that daily Contact or Transaction volumes for a program element are not sufficient to support a staff of **** (as demonstrated by typical statistical evaluations used in the industry that take into consideration program SLAs), Supplier may require a reasonable minimum number of

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

33

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

Transactions and/or Contacts for such programs for such periods or elect to bill for such portion using FTE Pricing (as set forth in Section 4.2) above) applicable to the program.  In addition, the Parties shall agree on changes to the Transaction Price (and **** fees if applicable) for additions to the normal days or hours of operation for a given program prior to implementing such change.

viii)    In the event that Manual Transaction Processing or Contact processing times are materially increased (or CPH materially decreased) as a result of an error, delay or increased as a result of an error or failure of an AT&T (or its agents) provided application or system or other Exclusion, Supplier, shall notify AT&T of such condition and the Parties shall discuss options to address such condition.  Unless otherwise agreed by the Parties, Vendor, if such condition is not resolved in a reasonable period of time, Vendor, may, upon notification to AT&T, require for such impacted periods to bill using for Agents working such program during such period to be billed at the Baseline **** Rate **** applicable to the program in lieu of the applicable Transaction Price for Transactions or Contacts supported during such interval.

ix)          Pricing includes, for Inbound Calls, call recording with retention of such recordings for ****.  AT&T shall have access to such recordings, in accordance with processes mutually agreed upon by the Parties, for purposes off monitoring and evaluation of Customer Care Support quality.

5.0          ****

5.1 ****

5.2 ****

6.0          Additional Channels

AT&T may add additional Channels (which may be outside of AT&T eCommerce) to this Agreement at the same terms and conditions. In the event a new Channel requires material changes to the ****, Supplier shall inform AT&T of the cost variance and the Parties shall work together to

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

34

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

determine whether or not to increase or decrease the Hosting Fee set forth in Section 2.0 for such new Channel or all Channels, as applicable.

For example if the **** systems architecture consists of ****, which are of substantially similar cost to support and maintain to the existing systems architecture with no incremental costs for ****, the Hosting Fee for such new Channel would not exceed the then current **** Channel Hosting Fee.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

35

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

Appendix G — Prime Supplier MBE/WBE/DVBE Participation Plan

YEAR  REPORTING:

DESCRIBE GOODS OR SERVICES BEING PROVIDED UNDER THIS AGREEMENT:

(what product or service is the Prime Supplier providing to AT&T)

DESCRIBE YOUR M/WBE-DVBE OR SUPPLIER DIVERSITY PROGRAM AND THE PERSONNEL DEDICATED TO THAT PROGRAM

(Prime Supplier should note their outreach activities to diverse suppliers, membership in National Diversity Organizations, commitment from company leadership on engaging diversity suppliers, etc.)

THE FOLLOWING, TOGETHER WITH ANY ATTACHMENTS IS SUBMITTED AS AN MBE/WBE/DVBE PARTICIPATION PLAN.

1.              GOALS

A. WHAT ARE YOUR MBE/WBE/DVBE PARTICIPATION GOALS?

B. WHAT IS THE ESTIMATED ANNUAL VALUE OF THIS CONTRACT:  $

C. WHAT ARE THE DOLLAR AMOUNTS OF YOUR PROJECTED MBE/WBE/DVBE PURCHASES:

Multiply % in A. above against contract value listed in B. above

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

36

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

2.              LIST THE PRINCIPAL GOODS AND SERVICES TO BE SUBCONTRACTED TO MBE/WBE/DVBEs OR DELIVERED THROUGH MBE/WBE/DVBE VALUE ADDED RESELLERS

(what part of the Prime Suppliers supply chain provides opportunities for diversity subcontracting)

DETAILED PLAN FOR USE OF M/WBEs-DVBEs AS SUBCONTRACTORS, DISTRIBUTORS, VALUE ADDED RESELLERS

For every product and service you intend to use, provide the following information. (attach additional sheets if necessary)

3.              SELLER AGREES THAT IT WILL MAINTAIN ALL NECESSARY DOCUMENTS AND RECORDS TO SUPPORT ITS EFFORTS TO ACHIEVE ITS MBE/WBE/DVBE PARTICIPATION GOAL(S). SELLER ALSO ACKNOWLEDGES THE FACT THAT IT IS RESPONSIBLE FOR IDENTIFYING, SOLICITING AND QUALIFYING MBE/WBE/DVBE SUBCONTRACTORS, DISTRIBUTORS AND VALUE ADDED RESELLERS.

4.              THE FOLLOWING INDIVIDUAL, ACTING IN THE CAPACITY OF MBE/WBE/DVBE COORDINATOR FOR SELLER, WILL:

ADMINISTER THE MBE/WBE/DVBE PARTICIPATION PLAN, SUBMIT SUMMARY REPORTS, AND COOPERATE IN ANY STUDIES OR SURVEYS AS MAY BE REQUIRED IN ORDER TO DETERMINE THE EXTENT OF COMPLIANCE BY THE SELLER WITH THE PARTICIPATION PLAN.

Within sixty (60) days from the Effective Date of this Agreement, Supplier shall email a copy of the initial annual plan to attsd@att.com.  Thereafter, Supplier shall furnish its monthly results to AT&T in accordance with instructions to be provided to Supplier following AT&T’s receipt of Supplier’s initial annual plan.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

37

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

Appendix K — Approved Offshore Locations

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

38

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

39

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

Appendix O — Supplier Information Security Requirements (SISR)

(AT&T Supplier Information Security Requirements (SISR) — v5.1, September, 2012)

The following AT&T Supplier Information Security Requirements (“Security Requirements”) apply to Supplier, its affiliates, its subcontractors, and each of their employees and/or temporary workers, contractors, vendors and/or agents who perform any Services for, on behalf of, and/or through AT&T and/or other obligations (for the purpose of this Appendix, each or all “Supplier”) that include any of the following:

****

Supplier represents and warrants that during the term of the Agreement and thereafter (as applicable with respect to Supplier’s obligations under the Survival of Obligations clause) Supplier is, and shall continue to be, in compliance with its obligations as set forth herein. In addition to all other remedies specified in the Agreement, Supplier agrees that AT&T shall be entitled to seek an injunction, specific performance or other equitable relief and be reimbursed the costs (including reasonable attorney’s fees) by Supplier to enforce the obligations in these Security Requirements, including those that survive termination or expiration of the Agreement in accordance with the indemnification procedures and other limitations set forth in the Master Agreement. The provisions of this Appendix shall not be deemed to, and shall not, limit any more stringent security or other obligations of the Agreement. For the avoidance of doubt, these requirements apply to Supplier’s performance of Services from all locations, including primary, non-primary, remote, virtual, and/or telecommuting or telework locations, if any, used in connection with the Agreement. Section and paragraph headings contained in parentheses that follow the requirements below are for reference purposes only and are not to affect the meaning or interpretation of these Security Requirements.

AT&T reserves the right to update or modify its Security Requirements from time to time. Upon notification by AT&T of its need to modify the Security Requirements, Supplier agrees to promptly negotiate in good faith and expedite execution of an amendment to the Agreement to incorporate any such modification. Supplier acknowledges that AT&T may require modifications to Security Requirements:

1.              Upon extension or renewal of the Agreement;

2.              Upon any change in work scope or other substantive modification of the Agreement; or

3.              At such time that AT&T deems necessary.

Definitions:

Unless otherwise set forth or expanded herein, defined terms shall have the same meaning as set forth in the main body of the Agreement.

“Customer Facing System(s)” means an Information Resource(s) accessible from public networks, intended for use by AT&T and/or its customers, which resides in a ****, as defined below, and where that ****:

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

40

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

****

Note: A Customer Facing System which also is used by AT&T employees, contractors, vendors or suppliers to perform work on behalf of AT&T is not considered a Customer Facing System when performing such work.

****

The following must only be located within the trusted internal network:

****

The following must not be located within the ****:

****

“Incident Management Process” is a Supplier-developed documented procedure to be followed in the event of an actual or suspected attack upon, intrusion upon, unauthorized access to, loss of, or other breach involving AT&T’s Information Resources.

“Information Resource(s)” means systems, applications, networks, network elements, and other computing and information storage devices, including smart phones, tablets, and USB memory sticks, and AT&T’s Information stored, transmitted, or processed with these resources in conjunction with supporting AT&T and/or used by Supplier in fulfillment of its obligations under the Agreement.

“Mobile and Portable Devices” means mobile and/or portable computers, devices, media and systems capable of being easily carried, moved, transported or conveyed that are used in connection with the Agreement. Examples of such devices include laptop computers, tablets, USB hard drives, USB memory sticks, Personal Digital Assistants (PDAs), and wireless phones, such as smartphones.

“Nonpublic Information Resources” means those Information Resources used under the Agreement to which access is restricted and cannot be gained without proper authorization and identification.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

41

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

“Sensitive Personal Information” or “SPI” means any information that: (a) requires a high degree of protection by law and where loss or unauthorized disclosure would require notification by AT&T to government agencies, individuals or law enforcement, and (b) any information that, if made public, could expose individuals to a risk of physical harm, fraud, or identity theft. Examples of SPI include, but are not limited to, social security numbers, national government issued identification numbers, such as passport and visa numbers, state- or province-issued identification numbers, drivers license numbers, dates of birth, bank account numbers, credit card numbers, customer authentication credentials, and Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA). Note: ****.

“Security Gateway” means a set of control mechanisms between two or more networks having different trust levels which filter and log traffic passing, or attempting to pass, between networks, and the associated administrative and management servers. Examples of Security Gateways include ****.

“Strong Authentication” means the use of authentication mechanisms and authentication methodologies stronger than the passwords required by Security Requirement 34 herein. Examples of Strong Authentication mechanisms and methodologies include digital certificates, two-factor authentication, and one-time passwords.

“Strong Encryption” means the use of encryption technologies with minimum key lengths of **** whose strength provides reasonable assurance that it will protect the encrypted information from unauthorized access and is adequate to protect the confidentiality and privacy of the encrypted information, and which incorporates a documented policy for the management of the encryption keys and associated processes adequate to protect the confidentiality and privacy of the keys and passwords used as inputs to the encryption algorithm.

In accordance with the foregoing, Supplier shall:

System Security

1.              Actively monitor industry resources (e.g., www.cert.org and pertinent software vendor mailing lists and websites) for timely notification of all applicable security alerts pertaining to Supplier’s Information Resources. (Security Alerts)

2.              At least ****, and in addition immediately following all significant changes and upgrades, scan externally-facing Information Resources related to the ASP Solution, including, but not limited to, networks, servers, and applications, with applicable industry-standard security vulnerability scanning software to uncover security vulnerabilities. (Externally-facing System Scanning)

3.              At least quarterly, and in addition immediately following all significant changes and upgrades, scan internal Information Resources, including, but not limited to, networks, servers, applications and databases, with applicable industry-standard security vulnerability scanning software to uncover security vulnerabilities, ensure that such Information Resources related to the ASP Solution are properly hardened as documented in Security Requirement 9 below, and identify any unauthorized wireless networks. (Internal System Scanning)

4.             RESERVED

5.              In environments where such technology is commercially available and to the extent practicable, deploy one or more Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), or Intrusion Detection and Prevention Systems (IDP) in an active mode of operation that monitors all traffic entering and leaving Information Resources in conjunction with the Agreement. (Intrusion Detection/Prevention Systems)

6.              Have and use a documented process to remediate security vulnerabilities in the Information Resources, including, but not limited to, those ****, and apply appropriate security patches promptly with respect to the probability that such vulnerability can be or is in the process of being exploited. (Remediating/Patching Service Vulnerabilities)

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

42

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

7.              Assign security administration responsibilities for configuring host operating systems to specific individuals. (Security Administration Responsibilities)

8.              Ensure that its information security staff has reasonable and necessary experience in information and network security. (Necessary Staff Experience)

9.              Ensure that all of Supplier’s Information Resources are and remain ‘hardened’ including, but not limited to, ****. (Hardened Systems)

10.       Change all default account names and/or default passwords. (Changing Default Account Names and Passwords)

11.       Limit system administrator (also known as root, privileged, or super user) access to operating systems intended for use by multiple users only to individuals requiring such high-level access in the performance of their jobs. (Limit Super User Privileges)

12.       Require application, database, network and system administrators to restrict access by users to only the **** necessary for them to perform authorized functions. (Administrators to Restrict User Access)

Physical Security

13.       Ensure that all of Supplier’s Information Resources intended for use by multiple users are located in secure physical facilities with access limited and restricted to authorized individuals only. (Information Resources in Secure Facilities)

14.       Monitor and record, for audit purposes, access to the physical facilities containing Information Resources intended for use by multiple users used in connection with Supplier’s performance of its obligations under the Agreement. (Monitoring and Recording Access)

Network Security

15.       When providing Internet-based services to AT&T, protect AT&T’s Information by the implementation of a network DMZ. Web servers providing service to AT&T shall reside in the ****. Information Resources storing AT&T’s Information (such as application and database servers) shall reside in a trusted internal network. (Internet Services Must Use ****)

16.       Upon AT&T’s request, provide to AT&T a logical network diagram documenting the Information Resources (including, but not limited to, ****) that will support AT&T. (Provision of Logical Network Diagram)

17.       Have a documented process and controls in place to detect and handle unauthorized attempts to access AT&T’s Information. (Detection and Handling of Unauthorized Access)

18.       a.              Use Strong Encryption for the transfer of AT&T’s Information outside of AT&T- or Supplier-controlled facilities or when transmitting AT&T’s Information over any untrusted network.

b.              By no later than ****, always use Strong Encryption to protect AT&T’s customer proprietary network information (“CPNI”), as that term is defined in the Telecommunications Act of 1996, 47 U.S.C. §222 (h)(1), and

AT&T’s SPI when transmitted. Exception: Where elsewhere authorized in writing by AT&T, AT&T’s CPNI transmitted for distribution to AT&T’s customers may be exempted from this requirement.

(Note: This also applies to AT&T’s Information contained in email, or the attachments embedded within the email, as the case may be. For greater clarity, if, for example, the text in an email does not contain AT&T’s Information, but the embedded attachments within that email do contain AT&T’s Information, then the embedded attachments, but not the email, need to be encrypted.) (Encryption of Information in Transit)

19.       Require Strong Authentication for any remote access use of Nonpublic Information Resources. (Remote Access Authentication)

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

43

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

Information Security

20.       Isolate AT&T’s applications and AT&T’s Information from any other customer’s or Supplier’s own applications and information either by using ****or alternatively by using ****. (Separate AT&T’s Information from non-AT&T information)

21.       Have documented procedures for the secure backup and recovery of AT&T’s Information which shall include, at a minimum, procedures for the **** and, upon AT&T’s request, provide such documented procedures to AT&T. (Secure Backup, Transport, Storage and Disposal of AT&T’s Information)

22.       Maintain and, upon AT&T’s request, furnish to AT&T a documented business continuity plan that ensures that Supplier can meet its contractual obligations under the Agreement, including the requirements of any applicable Statement of Work or Service Level Agreement. Such plan shall include the requirement that the included procedures be regularly tested at least ****. Supplier shall promptly review its business continuity plan to address additional threat scenarios. (Business Continuity Plan)

23.       Use Strong Encryption to protect AT&T’s CPNI and AT&T’s SPI when stored. (Encryption at Rest/Storage)

24.       Limit access to AT&T’s Information, including, but not limited to, paper hard copies, only to authorized persons or systems. (Limit Access to AT&T’s Information Regardless of Form)

25.       Be compliant with any applicable government- and industry-mandated information security standards. (Examples of such standards include, but are not limited to, the Payment Card Industry-Data Security Standards (PCI-DSS), National Automated Clearing House Associates (NACHA) Rules, and Electronic Data Interchange (EDI) standards, and the information security requirements documented within laws, such as HIPAA.) (Compliance with Industry and Government Requirements)

26.       At no additional charge to AT&T:

a.              Upon AT&T’s request, provide copies of any of AT&T’s Information to AT&T within **** of such request.

b.              Return, or, at AT&T’s option, destroy all of AT&T’s Information, including electronic and hard copies, within **** after the sooner of:

i.                  expiration or Termination of the Agreement;

ii.               AT&T’s request for the return of AT&T’s Information; or

iii.            the date when Supplier no longer needs AT&T’s Information to perform Services under the Agreement.

c.               In the event that AT&T approves destruction as an alternative to returning AT&T’s Information, then certify in writing the destruction (e.g., ****) as rendering AT&T’s Information non-retrievable.

d.              In the event that Supplier needs to retain copies of AT&T’s Information more than **** past either the expiration or Termination of the Agreement, or AT&T’s request for the return or destruction of AT&T’s Information, Supplier shall be allowed to retain such copies when elsewhere agreed to in writing with AT&T. Exception: Copies of AT&T’s Information retained as part of a backup-and-recovery, business continuity or disaster recovery process may be retained for more than **** past the expiration or Termination of the Agreement without obtaining agreement in writing from AT&T allowing such retention provided that all such copies are destroyed within no more than **** of the date of creation. (Return of AT&T’s Information)

27.       Unless otherwise instructed by AT&T in writing, when collecting, generating or creating Information for, through or on behalf of AT&T or under the AT&T brand, ensure that such Information shall be AT&T’s Information and, whenever practicable, label such Information of AT&T as “AT&T Proprietary Information” or at a minimum, label AT&T’s Information as “Confidential” or “Proprietary”. Supplier acknowledges that AT&T’s Information shall remain AT&T-owned Information irrespective of labeling or the absence thereof. (Confidential or Proprietary Markings)

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

44

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

Identification and Authentication

28.       Assign unique UserIDs to individual users. (Unique UserIDs)

29.       Have and use a documented UserID lifecycle management process including, but not limited to, procedures for **** for all Information Resources and across all environments (e.g., production, test, development, etc.). Such process shall include review of access privileges and account validity to be performed at least ****. (UserID Life Cycle Management)

30.       Enforce the rule of least privilege (i.e., ****). (Rule of Least Privilege)

31.       Limit failed login attempts to no more than **** attempts and lock the user account upon reaching that limit. Access to the user account can be reactivated subsequently through a manual process requiring **** or, where such capability exists, can be automatically reactivated after at least ****. Exception: Where elsewhere authorized in writing by AT&T, AT&T customer usage of Customer Facing Systems may be exempted from this requirement. (Limit Failed Logins)

32.       Terminate interactive sessions, or activate a secure, locking screensaver requiring authentication, after a period of inactivity not to exceed ****. Exception: Where elsewhere authorized in writing by AT&T, AT&T customer usage of Customer Facing Systems may be exempted from this requirement. (Terminate Inactive Interactive Sessions)

33.      Require password expiration at regular intervals not to exceed ****. Exception: Where elsewhere authorized in writing by AT&T, AT&T customer usage of Customer Facing Systems may be exempted from this requirement. (Expire Passwords)

34.       a.              Use an authentication method based on the sensitivity of AT&T’s Information. Whenever authentication credentials are stored, Supplier shall protect them using Strong Encryption.

b.              When passwords are used, they shall be complex and shall at least meet the following password construction requirements:

****

Exception: Where elsewhere authorized in writing by AT&T, AT&T customer usage of Customer Facing Systems may be exempted from the password construction requirements.

c.               Applications housing more sensitive copies of AT&T’s Information, as identified in writing by AT&T, may require an authentication mechanism stronger than passwords. In such case the authentication mechanism shall be mutually agreed to in advance in writing. Examples of stronger authentication methods include ****. (Passwords and Construction Rules)

35.       Use a secure method for the conveyance of authentication credentials (e.g., passwords) and authentication mechanisms (e.g., tokens or smart cards). (Use Secure Method to Convey UserIDs and Passwords)

Warning Banner

36.       For AT&T branded products or services or for software developed for AT&T, display a warning banner on login screens or pages as specified in writing by AT&T. (Display Warning Banners)

Software and Data Integrity

37.       In environments related to the ASP Solution where antivirus software is commercially available and to the extent practicable, have current antivirus software installed and running to scan for and promptly remove or quarantine

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

45

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

viruses and other malware. (Note: For the avoidance of doubt, this requirement also applies to Mobile and Portable Devices where antivirus software is commercially available.) (Scan and Remove Viruses)

38.       Separate non-production Information Resources from production Information Resources. (Separate Production and Non-Production Information Resources)

39.       Have a documented change control process including back-out procedures for all production environments. (Software Change Control Process)

40.       For applications which utilize a database that allows modifications to AT&T’s Information, have logging features enabled and retain logs pertaining to access, change and modification by users logs for a minimum of ****. (Utilize Database Transaction Logging)

41.       a.              For all software developed under the Agreement, review such software to find and remediate security vulnerabilities during initial implementation and upon any modifications and updates.

b.              Where technically feasible, for all software used, furnished and/or supported under the Agreement, review such software to find and remediate security vulnerabilities during initial implementation and upon any modifications and updates. (Review Code for Vulnerabilities)

42.       Perform quality assurance testing for the security components (e.g., ****), as well as any other activity designed to validate the security architecture, during initial implementation and upon any modifications and updates. (Quality Assurance Test Security Components)

Privacy Issues

43.       Restrict access to any of AT&T’s CPNI and AT&T’s SPI to authorized individuals. (Restrict Access to AT&T CPNI and SPI)

44.       Not store AT&T’s CPNI and AT&T’s SPI on removable media (e.g., USB flash drives, thumb drives, memory sticks, tapes, CDs, or external hard drives) except: (a) for backup, business continuity, disaster recovery, and data interchange purposes as allowed and required under contract, and (b) using Strong Encryption. Exception: Where elsewhere authorized in writing by AT&T, AT&T’s CPNI stored for distribution to AT&T’s customers may be exempted from this requirement. (Control AT&T CPNI and SPI on Removable Media)

Monitoring and Auditing Controls

45.      Restrict access to security logs to authorized individuals, and protect security logs from unauthorized modification. (Restrict Access to Security Logs)

46.       Review, on no less than a **** basis, all security and security-related audit logs for anomalies and document and resolve all logged security problems in a timely manner. (Review Security Logs and Resolve Security Problems)

47.       Retain complete and accurate records relating to its performance of its obligations arising out of these Security Requirements and Supplier’s compliance herewith in a format that will permit assessment or audit for a period of no less than ****, or longer as may be required pursuant to a court order or civil or regulatory proceeding. Notwithstanding the foregoing, Supplier shall only be required to maintain security logs for a minimum of ****. (Retain Records)

48.       Permit AT&T to conduct an assessment or audit to verify Supplier’s compliance with its contractual obligations in connection with these AT&T Supplier Information Security Requirements. Upon AT&T’s request for audit, Supplier shall schedule a security audit to commence within **** from such request. In the event that AT&T, in its sole discretion, deems that a security breach has occurred, which has not been promptly reported to AT&T in compliance with the Supplier’s Incident Management Process, Supplier shall schedule the audit to commence within **** of AT&T’s notice requiring an audit. This provision shall not be deemed to, and shall not, limit any more stringent audit obligations permitting the examination of Supplier’s records contained in the Agreement. (Audit Rights)

49.       Within **** of receipt of the assessment or audit report, provide AT&T a written report outlining the corrective actions that Supplier has implemented or proposes to implement with the schedule and current status of

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

46

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

each corrective action. Supplier shall update this report to AT&T every ****reporting the status of all corrective actions through the date of implementation. Supplier shall implement all corrective actions within **** of Supplier’s receipt of the assessment or audit report. (Remediate Audit Findings)

Reporting Violations

50.       Have and use an Incident Management Process and promptly notify AT&T whenever there is an attack upon, intrusion upon, unauthorized access to, loss of, or other breach of AT&T’s Information Resources at:

a.              Asset Protection by telephone at 800-807-4205 from within the US and at 1-908-658-0380 from elsewhere, and

b.              Supplier’s contact within AT&T for Service-related issues.

(Maintain and Use Incident Response Procedures)

51.       After notifying AT&T whenever there is an attack upon, intrusion upon, unauthorized access to, loss of, or other breach of AT&T’s Information Resources, provide AT&T with regular status updates, including, but not limited to, actions taken to resolve such incident, at mutually agreed intervals or times for the duration of the incident and, within five (5) days of the closure of the incident, provide AT&T with a written report describing the incident, actions taken by the Supplier during its response and Supplier’s plans for future actions to prevent a similar incident from occurring. (Provide AT&T Incident Response Status and Final Resolution)

Software Development

52.       RESERVED

Security Policies and Procedures

53.       Ensure that all personnel, subcontractors or representatives performing work under this Agreement are in compliance with these Security Requirements. (All Work to Be In Compliance with SISR)

54.       RESERVED

55.      Return all AT&T-owned or -provided access devices (including, but not limited to, ****) as soon as practicable, but in no event more than **** after the sooner of: (a) expiration or Termination of the Agreement; (b) AT&T’s request for the return of such property; or (c) the date when Supplier no longer needs such devices. (Return all AT&T Owned or Provided Access Devices)

Mobile and Portable Devices

56          Use Strong Encryption to protect all of AT&T’s Information stored on Mobile and Portable Devices.

57          Use Strong Encryption to protect all of AT&T’s Information transmitted using or remotely accessed by network-aware Mobile and Portable Devices.

58          a.              When using network aware Mobile and Portable Devices that are not laptop computers to access and/or store AT&T’s Information, such devices must be capable of deleting all stored copies of AT&T’s Information upon receipt over the network of a properly authenticated command. (Note: Such capability is often referred to as a “remote wipe” capability.)

b.              Have documented policies, procedures and standards in place to ensure that the authorized individual who should be in physical control of a network-aware Mobile and Portable Device that is not a laptop computer and that is storing AT&T’s Information promptly initiates deletion of all AT&T’s Information when the device becomes lost or stolen.

c.               Have documented policies, procedures and standards in place to ensure that Mobile and Portable Devices that are not laptop computers and are not network aware, will automatically delete all stored copies of AT&T’s Information after no more than three times the number of consecutive failed login attempts documented within Security Requirement 31.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

47

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

59.      Have documented policies, procedures and standards in place which ensure that any Mobile and Portable Devices used to access and/or store AT&T’s Information:

a.              Are in the physical possession of authorized individuals;

b.              Are physically secured when not in the physical possession of authorized individuals; or

c.               Have their data storage promptly and securely deleted when not in the physical possession of authorized individuals nor physically secured.

60.       Prior to allowing access to AT&T’s Information stored on or through the use of Mobile and Portable Devices, Supplier shall have and use a process to ensure that:

a.              The user is authorized for such access; and

b.              The identity of the user has been authenticated.

61.       Implement a policy that prohibits the use of any Mobile and Portable Devices that are not administered and/or managed by Supplier or AT&T to access and/or store AT&T’s Information.

62.       Review, at least annually, the use of, and controls for, all Supplier-administered or -managed Mobile and Portable Devices to ensure that the Mobile and Portable Devices can meet the applicable Security Requirements.

Security Gateways

63.       Require Strong Authentication for administrative and/or management access to Security Gateways, including, but not limited to, any access for the purpose of reviewing log files.

64.       Have and use documented controls, policies, processes and procedures to ensure that unauthorized users do not have administrative and/or management access to Security Gateways, and that user authorization levels to administer and manage Security Gateways are appropriate.

65.       At least once every ****, ensure that Security Gateway configurations are hardened by selecting a sample of Security Gateways and verifying that each default rule set and set of configuration parameters ensures the following:

****

66.       Ensure that monitoring tools are used to validate that all aspects of Security Gateways (e.g., hardware, firmware, and software) are continuously operational.

67.      Ensure that all Security Gateways are configured and implemented such that all non-operational Security Gateways shall deny all access.

Wireless Networking

68.       When using **** based wireless networking technologies to perform or support Services for AT&T, ensure that all of AT&T’s Information transmitted is protected by the use of appropriate encryption technologies sufficient to protect the confidentiality of AT&T’s Information; provided, however, that in any event such encryption shall use no less than key lengths of ****. Exception: The use of **** wireless headsets, keyboards, microphones, and pointing devices, such as mice, touch pads, and digital drawing tablets, is excluded from this requirement.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

48

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

Connectivity Requirements

69.       In the event that a data connection agreement, such as a “Master Data Connection Agreement,” “Data Connection Agreement,” and/or “Connection Supplement” (“DCA”) exists between the Parties, and incorporates the Agreement by reference, or is otherwise integrated with, or used to govern the Parties’ connectivity obligations under, this Agreement, agree that any information security requirements incorporated within such DCA are hereby superseded by the terms of these Security Requirements, effective as of the date these Security Requirements become effective under the Agreement, and the terms of such DCA are amended to require that the Security Requirements and not the information security requirements incorporated within the DCA are controlling in the Agreement (as well as any agreements subordinate to the Agreement). Notwithstanding the foregoing, the DCA remains in full force and effect for all other agreements between the Parties to which it applies.

70.       In the event that Supplier has, or will be provided, connectivity to AT&T’s or AT&T’s customers’ Nonpublic Information Resources in conjunction with this Agreement, then in addition to the foregoing:

a.              Use only the mutually agreed upon facilities and connection methodologies to interconnect AT&T’s and AT&T’s customers’ Nonpublic Information Resources with Supplier’s Information Resources.

b.              NOT establish interconnection to AT&T’s and AT&T’s customers’ Nonpublic Information Resources without the prior consent of AT&T.

c.               Provide AT&T access to any applicable Supplier facilities during normal business hours for the maintenance and support of any equipment (e.g., router) provided by AT&T under the Agreement for connectivity to AT&T’s and AT&T’s customers’ Nonpublic Information Resources.

d.              Use any equipment provided by AT&T under this Agreement for connectivity to AT&T’s and AT&T’s customers’ Nonpublic Information Resources only for the furnishing of those Services or functions explicitly authorized in the Agreement.

e.               If the agreed upon connectivity methodology requires that Supplier implement a Security Gateway, maintain logs of all sessions using such Security Gateway. These session logs must include sufficiently detailed information to identify the end user or application, origination IP address, destination IP address, ports/service protocols used and duration of access. These session logs must be retained for a minimum of ****.

71.       In the event that Supplier has, or will be provided, connectivity to AT&T’s or AT&T’s customers’ Nonpublic Information Resources in conjunction with this Agreement, in addition to other rights set forth herein, permit AT&T to:

a.              Gather information relating to access, including Supplier’s access, to AT&T’s and AT&T’s customers’ Nonpublic Information Resources. This information may be collected, retained and analyzed by AT&T to identify potential security risks without further notice. This information may include trace files, statistics, network addresses, and the actual data or screens accessed or transferred.

b.              Immediately suspend or terminate any interconnection to AT&T’s and AT&T’s customers’ Nonpublic Information Resources if AT&T, in its sole discretion, believes there has been a breach of security or unauthorized access to or misuse of AT&T data facilities or AT&T Information Resources.

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

****CERTAIN INFORMATION HAS BEEN OMITTED AND FILED SEPARATELY WITH THE COMMISSION.  CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS.

49

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

Appendix Z - AT&T’s Vendor Expense Policy (Updated 1/11/2013)

1.0       General

The AT&T Vendor Expense Policy (VEP) provides guidelines to be followed by all vendors of AT&T in requesting reimbursement for business travel, meals and other business related expense.  Expenses outside this policy are not reimbursable.

The following principles apply to requests for expense reimbursement:

When spending money that is to be reimbursed, vendors must ensure that an AT&T Company (“Company”) receives proper value in return.

Personal expenditures reported for reimbursement should be billed exactly as they were incurred.  The use of averages for any type expenditure or combination of expenditures is not permitted except as specifically provided or documented in a contract.

Every vendor and AT&T employee who certifies or approves the correctness of any voucher or bill should have reasonable knowledge the expense and amounts are proper and reasonable.  In the absence of the adoption of such policy, or existing contractual agreements, these guidelines are considered the minimum requirements for requesting reimbursement of Company funds.

Deviations from this VEP must be approved in writing by the sponsoring Senior Manager or Officer of an AT&T Company.

Receipts will be requested and reviewed for any unusual or out of the ordinary expenses or where the approver cannot make a reasonable determination of the propriety of the invoice without a receipt.

1.1 Non-Reimbursable Expenses

The following is a list, although not all inclusive, of expenses considered not reimbursable:

·                  Airline club membership fees, dues, or upgrade coupon

·                  Barber/Hairstylist/Beautician Expenses

·                  Birthday cakes, lunches, balloons, and other personal celebration/recognition costs

·                  Break-room supplies for the vendor, such as coffee, creamer, paper products, soft drinks, snack food

·                  Car rental additional fees as an example:  Global Positioning System (GPS) devices, or fee charged for airline frequent flyer miles.

·                  Car Washes

·                  Clothing, personal care items, and toiletries

·                  Credit card fees

·                  Dependent care

·                  Entertainment expenses

·                  Expenses associated with spouses or other travel companions

·                  Expenses to cover meals or expenses for an AT&T employee, whether in a home location or on official travel

·                  Flowers, cards and gifts

·                  Health Club and Fitness facilities

·                  Hotel pay-per-view movies, Video Games and/or mini bar items

·                  Hotel no-show or cancellation charges

Proprietary and Confidential

This Agreement and information contained therein is not for use or disclosure outside of AT&T, its Affiliates, and third party representatives, and Supplier except under written agreement by the contracting parties.

50

CONFIDENTIAL TREATMENT REQUESTED

SG021306.S.025

·                  Insurance for rental car and or flight

·                  Internet access in hotels  (added to 3.5)

·                  Laundry (except when overnight travel is required for 7 or more consecutive nights)

·                  Lawn care

·                  Lost: luggage, cash, personal items and valuables, and tickets

·                  Magazines & newspapers

·                  Meals not consistent with AT&T’s Global Employee Expense Policy and or meals not directly required for doing business on the AT&T account (e.g. vendors cannot voucher lunch with each other simply to talk about AT&T)

·                  Medical supplies

·                  Membership fees to exercise facilities or social/country clubs

·                  Movies purchased while on an airplane

·                  Office expenses of vendors for example: a calendar

·                  PC, cell phone, and other vendor support expenses (unless specifically authorized in the agreement)

·                  Personal entertainment

·                  Phone usage on airline unless AT&T business emergency

·                  Safe rentals during a hotel stay

·                  Souvenirs, personal gifts

·                  Surcharges for providing fast service (not related to delivery charges such as FedEx, UPS, etc.).  AT&T expects all vendors to complete the terms of contracts in the shortest period practicable.  Charges for shortening the timeframe in which contracts are fulfilled are not permissible.

·                  Tips for housekeeping and excessive tips, i.e., in excess of 15% to 18% of cost of meal or services, excluding tax

·                  Tobacco Products

·                  Traffic or Parking Fines

·                  Travel purchased with prepaid air passes.

·                  Upgrades on airline, hotel, or car rental fees

·                  Water (bottled or dispensed by a supplier), (unless authorized for specific countries where it is recommended that bottled water is used)

·                  Fee charged for advanced reservation for airport parking

The failure to comply with the above mentioned restrictions will result in the Company refusing payment of charges or pursuing restitution from the vendor.