Kickoff follow-up: agreed actions and next steps

Hello Niamh, Declan, Thank you both for your time at the kickoff earlier today. I said I would send the actions in writing, so here they are, with an owner against each one. Please correct anything I have misremembered. What we agreed: - Outcome: broker distribution and customer service working from one view of each broker firm. Niamh was clear that this is the test of whether the first phase has gone well, and we will keep coming back to it. - Approach: start small and prove the picture for a handful of broker firms before we widen it. The full licence is for 150 users, but we will not roll out to all of them at once. Actions: - BB-Demo (me): send the connector plan, in the order we discussed, with the access each source needs from your side. - BB-Demo (me, with Elena): send the security evidence pack that Declan listed, including the incident history and the notification times. - Ardcarne (Declan): confirm which of your internal teams must approve access to the Snowflake account before we build anything inside it. - Ardcarne (Niamh): name the two or three people who will be the first users and the person who will act as admin. Elena is copied and will stay close to this from Amsterdam, so please include her on anything that touches the contract or the register of information. I will not put dates on your internal approvals, as those are yours to set. For the items on our side I will confirm dates once the plan is in your hands. Kind regards, Ollie Pearson Implementation Consultant, BB-Demo

Ollie, Thank you for the note of Tuesday. I have the following points, which I would like answered in writing. First, the actions on your side carry no dates. Under DORA we need dated commitments for the evidence pack and for the connector plan. Please provide a dated commitment for each. Second, the incident history. Please confirm that it covers the July outage in full, including who at Ardcarne was notified, when, and by whom. I will want to reconcile it with what we were told at the time. Third, the exit plan. For the register of information I need to see how our data is returned or removed from the Snowflake account if the arrangement ends. Please confirm whether this is already documented or still to be written. Fourth, access. Nothing is to be built inside our Snowflake account until I have confirmed in writing that the approvals are complete. A verbal assurance, from either side, will not be sufficient. I will not close any open finding until the evidence is in front of me. Regards, Declan Furlong, CISO

Declan, Niamh, Thank you, Declan. That is fair, and you are right that the actions went out without dates. Taking your points in turn. First, dates. I will send the evidence pack and the connector plan with a date against each item by Tuesday. I would rather give you commitments I have checked with my colleagues than guesses today. Second, the July outage. The incident history will cover it in full, including the timeline of notifications. I do not want to paraphrase it from memory, so you will have the written record rather than my summary. Elena will check it against what was sent to you at the time. Third, the exit plan. I need to confirm with our team whether the document is complete or needs finishing for your register. I will tell you which it is in the same message as the dates, and if it needs work I will say so plainly. Fourth, access. Agreed. Nothing will be built in your Snowflake account until you have confirmed the approvals in writing. I will add that as a stated condition in the plan. Niamh, I realise this slows the first week a little. I think it is the right order, and it keeps Declan comfortable. Kind regards, Ollie Pearson Implementation Consultant, BB-Demo