SUB-ADMINISTRATION AGREEMENT

Exhibit 10.3

SUB-ADMINISTRATION AGREEMENT

This Sub-Administration Agreement (“Agreement”) dated and effective as of June 2, 2022, is by and between State Street Bank and Trust Company, a Massachusetts trust company (the “Sub-Administrator”), and Varagon Capital Partners, L.P., a Delaware limited partnership (the “Administrator”).

WHEREAS, Varagon Capital Corporation (the “Fund”), a closed-end management investment fund that has elected to be regulated as a business development company under the Investment Company Act of 1940, as amended (the “1940 Act”);

WHEREAS, the Fund has retained the Administrator to furnish certain administrative services to it; and

WHEREAS, the Administrator desires to retain the Sub-Administrator to furnish certain sub-administrative services to the Administrator in respect of the Fund, as set forth in Schedule A, as such schedule may be amended from time to time, and the Sub-Administrator is willing to furnish such services, on the terms and conditions set forth in this Agreement.

NOW, THEREFORE, in consideration of the premises and mutual covenants herein contained, the parties hereto agree as follows:

The Administrator hereby engages the Sub-Administrator to act as sub-administrator with respect to the Fund and to provide certain sub-administrative services for the period and on the terms set forth in this Agreement. The Sub-Administrator agrees to such engagement and to render the services to the Administrator in relation to the Fund as stated herein.

The Administrator will promptly deliver to the Sub-Administrator copies of each of the following documents with respect to the Fund and/or the Administrator and all future amendments and supplements, if any:

The Sub-Administrator represents and warrants to the Administrator that:

The Administrator represents and warrants to the Sub-Administrator that:

The Sub-Administrator shall provide the services as listed on Schedule A, subject to the authorization and direction of the Administrator or the Fund and, in each case where appropriate, the review and comment by the Administrator’s or the Fund’s independent accountants and legal counsel and in accordance with procedures which may be established from time to time between the Administrator and the Sub-Administrator.

The Sub-Administrator shall perform such other services for the Administrator that are mutually agreed to by the parties from time to time, for which the Administrator will pay such fees as may be mutually agreed upon, including the Sub-Administrator’s reasonable out-of-pocket expenses, as set out under the written fee schedule approved by both the Administrator and the Sub-Administrator. The provision of such services shall be subject to the terms and conditions of this Agreement.

The Sub-Administrator shall provide the office facilities and the personnel determined by it to perform the services contemplated herein.

The Sub-Administrator shall be entitled to reasonable compensation for its services provided under this Agreement and expenses related thereto, as agreed upon from time to time in a written fee schedule approved by the Administrator and the Sub-Administrator.

The Administrator agrees promptly, following receipt of a written invoice from the Sub-Administrator, to reimburse the Sub-Administrator for any equipment and supplies specially ordered by or for the Fund through the Sub-Administrator and for any other expenses not contemplated by this Agreement that the Sub-Administrator may incur on the Administrator’s or Fund’s behalf, in each case at the Administrator’s or Fund’s request or with the Administrator’s or Fund’s consent.

The Administrator acknowledges and agrees that the Administrator and/or the Fund, as the case may be, will bear all expenses that are incurred in the operation of the Fund and not specifically assumed by the Sub-Administrator. For the avoidance of doubt, Fund expenses not assumed by the Sub-Administrator, include, but are not limited to: organizational expenses; cost of services of independent accountants and outside legal and tax counsel (including such counsel’s review of the Registration Statement, Form 10-K, Form 10-Q, proxy materials, federal and state tax qualification as a regulated investment company and other notices, registrations, reports, filings and materials prepared by the Sub-Administrator under this Agreement); cost of any services contracted for by the Administrator or the Fund directly from parties other than the Sub-Administrator; cost of trading operations and brokerage fees, commissions and transfer taxes in connection with the purchase and sale of securities for the Fund; investment advisory fees; taxes, insurance premiums and other fees and expenses applicable to its operation; costs incidental to any meetings of shareholders including, but not limited to, legal and accounting fees, proxy filing fees and the costs of preparation (e.g., typesetting, XBRL-tagging, page changes and all other print vendor and ▇▇▇▇▇ charges, collectively referred to herein as “Preparation”), printing, distribution and mailing of any proxy materials; costs incidental to Board meetings, including fees and expenses of Board members; the salary and expenses of any officer, director\trustee or employee of the Fund; costs of Preparation, printing, distribution and mailing, as applicable, of the Fund’s Registration Statements and any amendments and supplements thereto and shareholder reports; cost of Preparation and filing of the Fund’s tax returns, Form 10-K, Form 10-Q, and all notices, registrations and amendments associated with applicable federal and state tax and securities laws; all applicable registration fees and filing fees required under federal and state securities laws; the cost of fidelity bond and D&O/E&O liability insurance; and the cost of independent pricing services used in computing the Fund’s net asset value.

At any time, the Sub-Administrator may apply to any officer of the Administrator or the Fund or his or her designee for instructions or, at the direction or with the consent of the Administrator, the independent accountants for the Administrator or Fund, with respect to any matter arising in connection with the services to be performed by the Sub-Administrator under this Agreement. The Sub-Administrator shall be entitled to rely on and may act upon advice of counsel (who may be counsel for the Administrator or the Fund) on all matters, and shall be without liability for any action reasonably taken or omitted pursuant to such advice.

The Sub-Administrator shall not be liable, and shall be indemnified by the Administrator, for any action taken or omitted by it in good faith in reliance upon any such instructions or advice or upon any paper or document believed by it to be genuine and to have been signed by the proper person or persons. The Sub-Administrator shall not be held to have notice of any change of authority of any person until receipt of written notice thereof from the Administrator or the Fund. Nothing in this section shall be construed as imposing upon the Sub-Administrator any obligation to seek such instructions or advice, or to act in accordance with such advice when received.

The Sub-Administrator shall be responsible for the performance only of such duties as are set forth in this Agreement and, except as otherwise provided under Section 14, shall have no responsibility for the actions or activities of any other party, including other service providers. The Sub-Administrator shall have no liability in respect of any loss, damage or expense suffered by the Administrator insofar as such loss, damage or expense arises from the performance of the Sub-Administrator’s duties hereunder in reliance upon records that were maintained for the Administrator or the Fund by entities other than the Sub-Administrator prior to the Sub-Administrator’s appointment as Sub-Administrator for the Administrator. The Sub-Administrator shall have no liability for any error of judgment or mistake of law or for any loss or damage resulting from the performance or nonperformance of its duties hereunder unless solely caused by or resulting from the gross negligence or willful misconduct of the Sub-Administrator, its officers or employees. No party shall not be liable for any special, indirect, incidental, punitive or consequential damages, including lost profits, of any kind whatsoever (including, without limitation, attorneys’ fees) under any provision of this Agreement or for any such damages arising out of any act or failure to act hereunder, each of which is hereby excluded by agreement of the parties regardless of whether such damages were foreseeable or whether either party or any entity had been advised of the possibility of such damages. In any event, the Sub-Administrator’s cumulative liability for each calendar year (a “Liability Period”) with respect to the services performed under this Agreement regardless of the form of action or legal theory shall be limited to its total annual compensation earned and fees payable hereunder during the preceding Compensation Period, as defined herein, for any liability or loss suffered by the Administrator. “Compensation Period” shall mean the calendar year ending immediately prior to each Liability Period in which the event(s) giving rise to the Sub-Administrator’s liability for that period have occurred. Notwithstanding the foregoing, the Compensation Period for purposes of calculating the annual cumulative liability of the Sub-Administrator for the Liability Period commencing on the date of this Agreement and terminating on December 31, 2022 shall be the date of this Agreement through December 31, 2022, calculated on an annualized basis, and the Compensation Period for the Liability Period commencing January 1, 2023 and terminating on December 31, 2023 shall be the date of this Agreement through December 31, 2022, calculated on an annualized basis.

The Sub-Administrator shall not be responsible or liable for any failure or delay in performance of its obligations under this Agreement arising out of or caused, directly or indirectly, by circumstances beyond its control, including without limitation, work stoppage, power or other mechanical failure, computer virus, natural disaster, governmental action or communication disruption.

The Administrator shall indemnify and hold the Sub-Administrator and its directors, officers, employees and agents harmless from all direct losses, costs, damages and expenses, including reasonable fees and expenses for counsel incurred by the Sub-Administrator resulting from any claim, demand, action or suit in connection with the Sub-Administrator’s acceptance of this Agreement, any action or omission by it in the performance of its duties hereunder,

or as a result of acting upon any instructions reasonably believed by it to have been duly authorized by the Administrator or the Fund or upon reasonable reliance on information or records given or made by the Administrator or the Fund or the Fund’s investment adviser, provided that this indemnification shall not apply to actions or omissions of the Sub-Administrator, its officers or employees in cases of its or their own gross negligence or willful misconduct.

The limitation of liability and indemnification contained herein shall survive the termination of this Agreement.

All information provided under this Agreement by a party to this Agreement (the “Disclosing Party”) to the other party to this Agreement (the “Receiving Party”) regarding the Disclosing Party’s business and operations shall be treated as confidential. Subject to Section 10 below, all confidential information provided under this Agreement by Disclosing Party shall be used, including disclosure to third parties, by the Receiving Party, or its agents or service providers, solely for the purpose of performing or receiving the services and discharging the Receiving Party’s other obligations under the Agreement or managing the business of the Receiving Party and its Affiliates (as defined in Section 10 below), including financial and operational management and reporting, risk management, legal and regulatory compliance and client service management. The foregoing shall not be applicable to any information (a) that is publicly available when provided or thereafter becomes publicly available, other than through a breach of this Agreement, (b) that is independently derived by the Receiving Party without the use of any information provided by the Disclosing Party in connection with this Agreement, (c) that is disclosed to comply with any legal or regulatory proceeding, investigation, audit, examination, subpoena, civil investigative demand or other similar process, (d) that is disclosed as required by operation of law or regulation or as required to comply with the requirements of any market infrastructure that the Disclosing Party or its agents direct the Sub-Administrator or its Affiliates to employ (or which is required in connection with the holding or settlement of instruments included in the assets subject to this Agreement) or (e) where the party seeking to disclose has received the prior written consent of the party providing the information, which consent shall not be unreasonably withheld.

The Administrator acknowledges that the Administrator and Fund assume full responsibility for complying with all securities, tax, commodities and other laws, rules and regulations applicable to it.

The Sub-Administrator agrees that all records which it maintains for the Administrator shall at all times remain the property of the Administrator or the Fund, as applicable, shall be readily accessible during normal business hours, and shall be promptly surrendered upon the termination of the Agreement or otherwise on written request except as otherwise provided in Section 13. The Sub-Administrator further agrees to preserve the records required to be maintained hereunder for the period required by law unless any such records are earlier surrendered as provided above. Records may be surrendered in either written or machine-readable form, at the option of the Sub-Administrator. In the event that the Sub-Administrator is requested or authorized by the Administrator, or required by subpoena, administrative order, court order or other legal process, applicable law or regulation, or required in connection with any investigation, examination or inspection of the Administrator or Fund by state or federal regulatory agencies, to produce the records of the Administrator or Fund or the Sub-Administrator’s personnel as witnesses or deponents, the Administrator agrees to pay the Sub-Administrator for the Sub-Administrator’s time and expenses, as well as the fees and expenses of the Sub-Administrator’s counsel incurred in such production.

The Sub-Administrator will allow the Administrator and the Administrator’s regulators or supervisory authorities to perform periodic on-site audits as may be reasonably required to examine the Sub-Administrator’s performance of the Services. For inspections requested by the Administrator (such request will include reasonable advance notice) and agreed to by the Sub-Administrator, the Sub-Administrator reserves the right to impose reasonable limitations on the number, frequency, timing, and scope of such audits.

Nothing contained in this Section 11 will obligate the Sub-Administrator to provide access to or otherwise disclose: (i) any information that is unrelated to the Administrator and the provision of the Services to the Administrator; (ii) any information that is treated as confidential under the Sub-Administrator’s corporate policies, including, without limitation, internal audit reports, compliance or risk management plans or reports, work papers and other reports, and information relating to management functions; or (iii) any other documents, reports, or information that the Sub-Administrator is obligated or entitled to maintain in confidence as a matter of law or regulation. In addition, any access provided to technology will be limited to a demonstration by the Sub-Administrator of the functionality thereof and a reasonable opportunity to communicate with the Sub-Administrator’s personnel regarding such technology.

The services of the Sub-Administrator are not to be deemed exclusive, and the Sub-Administrator shall be free to render similar services to others. The Sub-Administrator shall be deemed to be an independent contractor and shall, unless otherwise expressly provided herein or authorized by the Administrator or the Fund from time to time, have no authority to act or represent the Administrator or the Fund in any way or otherwise be deemed an agent of the Administrator or the Fund.

This Agreement shall remain in full force and effect for an initial term ending on the one-year anniversary of the effective date of this Agreement (the “Initial Term”). After the expiration of the Initial Term, this Agreement shall automatically renew for successive one-year terms (each, a “Renewal Term”) unless a written notice of non-renewal is delivered by the non-renewing party no later than ninety (90) days prior to the expiration of the Initial Term or any Renewal Term, as the case may be. During the Initial Term and thereafter, either party may terminate this Agreement: (i) in the event of the other party’s material breach of a material provision of this Agreement that the other party has either (a) failed to cure or (b) failed to establish a remedial plan to cure that is reasonably acceptable, within 60 days’ written notice of such breach, or (ii) in the event of the appointment of a conservator or receiver for the other party or upon the happening of a like event to the other party at the direction of an appropriate agency or court of competent jurisdiction. Upon termination of this Agreement pursuant to this paragraph with respect to the Fund, the Administrator shall pay Sub-Administrator its compensation due and shall reimburse Sub-Administrator for its costs, expenses and disbursements in accordance with this Agreement.

In the event of: (i) the Administrator’s termination of this Agreement for any reason other than as set forth in the immediately preceding paragraph or (ii) a transaction not in the ordinary course of business pursuant to which the Sub-Administrator is not retained to continue providing services hereunder to the Administrator or the Fund (or its successor), the Administrator shall pay the Sub-Administrator its compensation due through the end of the then-current term (based upon the average monthly compensation previously earned by Sub-Administrator with respect to the Fund) and shall reimburse the Sub-Administrator for its reasonable costs, expenses and disbursements. Upon receipt of such payment and reimbursement, the Sub-Administrator will deliver the Fund’s records as set forth herein. For the avoidance of doubt, no payment will be required pursuant to clause (ii) of this paragraph in the event of any transaction such (a) the liquidation or dissolution of the Fund and distribution of the Fund’s assets as a result of the Board’s determination in its reasonable business judgment that the Fund is no longer viable (b) a merger of the Fund into, or the consolidation of the Fund with, another entity, or (c) the sale by the Fund of all, or substantially all, of the or Fund’s assets to another entity, in each of (b) and (c) where the Sub-Administrator is retained to continue providing services to the Administrator or the Fund (or its successor) on substantially the same terms as this Agreement.

In connection with the operation of this Agreement, the Sub-Administrator and the Administrator may from time to time agree on such provisions interpretive of or in addition to the provisions of this Agreement as may in their joint opinion be consistent with the general tenor of this Agreement. Any such interpretive or additional provisions shall be in a writing signed by all parties, provided that no such interpretive or additions provisions shall contravene any applicable laws or regulations or any provision of the Administrator’s or the Fund’s Governing Documents. No interpretive or additional provisions made as provided in the preceding sentence shall be deemed to be an amendment of the Agreement.

Any notice, instruction or other instrument required to be given hereunder will be in writing and may be sent by hand, or by facsimile transmission, or overnight delivery by any recognized delivery service, to the parties at the following address or such other address as may be notified by any party from time to time:

If to the Administrator:

VARAGON CAPITAL PARTNERS, L.P.

▇▇▇ ▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇, ▇▇▇▇▇ ▇▇▇▇

▇▇▇▇ ▇▇▇▇▇, ▇▇ ▇▇▇▇▇

Attn: ▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇▇

Telephone: ▇▇▇-▇▇▇-▇▇▇▇

Email: ▇▇▇▇▇▇▇▇▇▇@▇▇▇▇▇▇▇.▇▇▇

With a copy to:

VARAGON CAPITAL PARTNERS, L.P.

▇▇▇ ▇▇▇▇ ▇▇▇▇▇▇, ▇^▇▇ ▇▇▇▇▇

▇▇▇ ▇▇▇▇, ▇▇ ▇▇▇▇▇

Attn: ▇▇▇▇▇ ▇▇▇▇▇▇-▇▇▇▇▇▇▇▇, Esq.

Email: ▇▇▇▇▇@▇▇▇▇▇▇▇.▇▇▇

If to the Sub-Administrator:

STATE STREET BANK AND TRUST COMPANY

State Street Financial Center

▇▇▇ ▇▇▇▇▇▇▇ ▇▇▇▇▇▇

▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇-▇▇▇▇

Attention: ▇▇▇▇▇ ▇▇▇▇▇, Managing Director

Telephone: (▇▇▇) ▇▇▇-▇▇▇▇

with a copy to:

STATE STREET BANK AND TRUST COMPANY

Legal Division – Global Services Americas

▇▇▇ ▇▇▇▇▇▇▇ ▇▇▇▇▇▇

▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇

Attention: Senior Vice President and Senior Managing Counsel

This Agreement may be amended at any time in writing by mutual agreement of the parties hereto.

This Agreement shall not be assigned by (a) the Administrator without the prior written consent of the Sub-Administrator or (b) the Sub-Administrator without the prior written consent of the Administrator, except that the Sub-Administrator may assign this Agreement to a successor of all or a substantial portion of its business, or to a party controlling, controlled by or under common control with the Sub-Administrator.

This Agreement shall be binding on and shall inure to the benefit of the Administrator and the Sub-Administrator and their respective successors and permitted assigns.

The Sub-Administrator shall implement and maintain a comprehensive written information security program that contains appropriate security measures to safeguard the personal information of the Fund’s shareholders, employees, directors and/or officers that the Sub-Administrator receives, stores, maintains, processes or otherwise accesses in connection with the provision of services hereunder. For these purposes, “personal information” shall mean (i) an individual’s name (first initial and last name or first name and last name), address or telephone number plus (a) social security number, (b) driver’s license number, (c) state identification card number, (d) debit or credit card number, (e) financial account number or (f) personal identification number or password that would permit access to a person’s account or (ii) any combination of the foregoing that would allow a person to log onto or access an individual’s account. Notwithstanding the foregoing “personal information” shall not include information that is lawfully obtained from publicly available information, or from federal, state or local government records lawfully made available to the general public.

21.1 Business Continuity Plans. The Sub-Administrator will at all times maintain a written business contingency plan for the restoration of critical processes and operations, and a written disaster recovery plan and will take commercially reasonable measures to maintain and periodically test such plans. The Sub-Administrator will implement such plans following the occurrence of an event which results in an interruption or suspension of the services to be provided by the Sub-Administrator hereunder.

21.2 Information Security Systems and Controls. The Sub-Administrator will maintain written policies and procedures and commercially reasonable information security systems and controls, which include administrative, technical, and physical safeguards that are designed to: (i) maintain the security and confidentiality of the Administrator’s or the Fund’s data; (ii) protect against any anticipated threats or hazards to the security or integrity of such data, including appropriate measures designed to meet legal and regulatory requirements applying to the Sub-Administrator; and (iii) protect against unauthorized access to or use of the Administrator’s or the Fund’s data.

21.3 Virus Detection. The Sub-Administrator will at all times employ a current version of one of the leading commercially available virus detection software programs to test the hardware and software applications used by it to deliver the services hereunder for the presence of any computer code designed to disrupt, disable, harm, or otherwise impede operation.

21.4 Internal Controls Review and Report. The Sub-Administrator will retain a firm of independent auditors to perform an annual review of certain internal controls and procedures employed by the Sub-Administrator in the provision of the Services and issue a standard System and Organization Controls 1 or equivalent report based on such review. The Sub-Administrator will provide a copy of the report to the Administrator upon request.

21.5 The State Street Client Information Security Schedule hereto is incorporated by reference into this Agreement.

This Agreement contains the entire understanding between the parties hereto with respect to the subject matter hereof and supersedes all previous representations, warranties or commitments regarding the services to be performed hereunder whether oral or in writing.

The failure of a party to insist upon strict adherence to any term of this Agreement on any occasion shall not be considered a waiver nor shall it deprive such party of the right thereafter to insist upon strict adherence to that term or any term of this Agreement or the failure of a party hereto to exercise or any delay in exercising any right or remedy under this Agreement shall not constitute a waiver of any such term, right or remedy or a waiver of any other rights or remedies, and no single or partial exercise of any right or remedy under this Agreement shall prevent any further exercise of the right or remedy or the exercise or any other right or remedy. Any waiver must be in writing signed by the waiving party.

If any provision or provisions of this Agreement shall be held to be invalid, unlawful or unenforceable, the validity, legality and enforceability of the remaining provisions shall not in any way be affected or impaired.

This Agreement shall be construed and the provisions thereof interpreted under and in accordance with the laws of The Commonwealth of Massachusetts, without regard to its conflicts of laws rules.

This Agreement and all schedules, exhibits, attachments and amendments hereto may be reproduced by any photographic, xerographic, photostatic, microfilm, micro-card, miniature photographic or other similar process. The parties hereto all/each agree that any such reproduction shall be admissible in evidence as the original itself in any judicial or administrative proceeding, whether or not the original is in existence and whether or not such reproduction was made by a party in the regular course of business, and that any enlargement, facsimile or further reproduction of such reproduction shall likewise be admissible in evidence.

This Agreement may be executed in several counterparts, each of which shall be deemed to be an original, and all such counterparts taken together shall constitute one and the same Agreement. Counterparts may be executed in either original or electronically transmitted form (e.g., faxes or emailed portable document format (PDF) form), and the parties hereby adopt as original any signatures received via electronically transmitted form.

[Remainder of page intentionally left blank.]

IN WITNESS WHEREOF, the parties hereto have caused this Agreement to be executed by their officers designated below as of the date first written above.

[VCC - Sub-Administration Agreement]

SUB-ADMINISTRATION AGREEMENT

SCHEDULE A

LIST OF SERVICES

Schedule A1

Treasury Services

B1-1

SCHEDULE A2

Accounting Services

State Street Client Information Security Schedule

All capitalized terms not defined in this State Street Client Information Security Schedule (this “Security Schedule”) shall have the meanings ascribed to them in the Sub-Administration Agreement by and between State Street Bank and Trust Company (“State Street”) and Varagon Capital Partners, L.P (“Client”) dated April ____, 2022 (the “Agreement”).

State Street and Client hereby agree that State Street shall maintain an Information Security policy (“Security Policy”) that satisfies the requirements set forth below; provided, that, because Information Security is a highly dynamic space (where laws, regulations and threats are constantly changing), State Street reserves the right to make changes to its information security controls at any time and at the sole discretion of State Street in a manner that it believes does not materially reduce the protection it applies to Client Data.

From time to time, State Street may subcontract services performed under the Agreement (to the extent provided for under the Agreement) or provide access to Client Data or its network to a subcontractor or other third party; provided, that, such subcontractor or third party implements and maintains security measures State Street believes are at least as stringent as those described in this Security Schedule.

The objective of State Street’s Security Policy and related Information Security Program is to implement data security measures consistent in all material respects with applicable prevailing industry practices and standards (“Objective”). In order to meet such Objective, State Street uses commercially reasonable efforts to:

a. Protect the privacy, confidentiality, integrity, and availability of all confidential data and information disclosed by or on behalf of Client to, or otherwise comes into the possession of State Street, in connection with the provision of services under the Agreement and to the extent the same is deemed confidential information under the terms of the Agreement (collectively, “Client Data”);

b. protect against accidental, unauthorized, unauthenticated or unlawful access, copying, use, processing, disclosure, alteration, transfer, loss or destruction of the Client Data;

c. comply with applicable governmental laws, rules and regulations that are relevant to the handling, processing and use of Client Data by State Street in accordance with the Agreement; and

d. implement customary administrative, physical, technical, procedural and organizational safeguards.

a. Risk Assessment—State Street shall, at least annually, perform risk assessments that are designed to identify material threats (both internal and external) against Client Data, the likelihood of those threats occurring and the impact of those threats upon the State Street organization to evaluate and analyze the appropriate level of information security safeguards (“Risk Assessments”).

b. Risk Mitigation—State Street shall use commercially reasonable efforts to manage, control and remediate any threats identified in the Risk Assessments that it believes are likely to result in material unauthorized access, copying, use, processing, disclosure, alteration, transfer, loss or destruction of Client Data, consistent with the Objective, and commensurate with the sensitivity of the Client Data and the complexity and scope of the activities of State Street pursuant to the Agreement.

c. Security Controls Testing—State Street shall, on approximately an annual basis, engage an independent external party to conduct periodic reviews of State Street’s Information Security practices. State Street shall have a process to review and evaluate high risk findings resulting from this testing.

3. Security Controls. Annually, upon Client’s reasonable request, State Street shall provide Client’s Chief Information Security Officer or his or her designee with a copy of its Corporate Information Security Controls that form the basis for State Street’s Security Policy and an opportunity to discuss State Street’s Information Security measures with a qualified member of State Street’s Information Technology management team. State Street shall review its Security Policy annually.

a. Responsibility—State Street shall assign responsibility for information security management to senior personnel only.

b. Access—State Street shall permit only those personnel performing roles supporting the provision of services under the Agreement to access Client Data.

c. Confidentiality—State Street personnel who have accessed or otherwise been made known of Client Data shall maintain the confidentiality of such information in accordance with the terms of the Agreement.

d. Training—State Street will provide information security training to its personnel on approximately an annual basis.

a. Data Sensitivity—State Street acknowledges that it understands the sensitivity of Client Data.

b. External Hosting Facilities – State Street shall implement controls, consistent with applicable prevailing industry practices and standards, regarding the collection, use, storage and/or disclosure of Client Data by an external hosting provider.

a. Securing Physical Facilities—State Street shall maintain systems located in State Street facilities that host Client Data or provide services under the Agreement in an environment that is designed to be physically secure and to allow access only to authorized individuals. A secure environment includes the availability of onsite security personnel on a 24 x 7 basis or equivalent means of monitoring locations supporting the delivery of services under the Agreement.

b. Physical Security of Media—State Street shall implement controls, consistent with applicable prevailing industry practices and standards, that are designed to deter the unauthorized viewing, copying, alteration or removal of any media containing Client Data. Removable media on which Client Data is stored (including thumb drives, CDs, and DVDs, and PDAS) by State Street must be encrypted using at least 256 bit AES (or equivalent).

c. Media Destruction—State Street shall destroy removable media and any mobile device (such as discs, USB drives, DVDs, back-up tapes, laptops and PDAs) containing Client Data or use commercially reasonable efforts to render Client Data on such physical media unintelligible if such media or mobile device is no longer intended to be used. All backup tapes that are not destroyed must meet the level of protection described in this Security Schedule until destroyed.

d. Paper Destruction—State Street shall cross shred all paper waste containing Client Data and dispose in a secure and confidential manner.

a. Network Penetration Testing—State Street shall, on approximately an annual basis, contract with an independent third party to conduct a network penetration test on its network having access to or holding or containing Client Data. State Street shall have a process to review and evaluate high risk findings resulting from this testing.

b. Data Protection During Transmission - State Street shall encrypt, using an industry recognized encryption algorithm, personally identifiable Client Data when in transit across public networks.

c. Data Loss Prevention - State Street shall implement a data leakage program that is designed to identify, detect, monitor and document Client Data leaving State Street’s control without authorization in place.

d. Malicious Code – State Street shall implement controls that are designed to detect the introduction or intrusion of malicious code on information systems handling or holding Client Data and implement a process for removing said malicious code from information systems handling or holding Client Data.

a. Authorized Access—State Street shall have controls that are designed to maintain the logical separation such that access to systems hosting Client Data and/or being used to provide services to Client will uniquely identify each individual requiring access, grant access only to authorized personnel based on the principle of least privileges, and prevent unauthorized access to Client Data.

b. User Access - State Street shall have a process to promptly disable access to Client Data by any State Street personnel who no longer requires such access. State Street will also promptly remove access of Client personnel upon receipt of notification from Client.

c. Authentication Credential Management—State Street shall communicate authentication credentials to users in a secure manner, with a proof of identity check of the intended users.

d. Multi-Factor Authentication for Remote Access—State Street shall use multi factor authentication and a secure tunnel, or another strong authentication mechanism, when remotely accessing State Street’s internal network.

a. Encryption Requirements—State Street shall encrypt any laptops or mobile devices (e.g., Blackberries, PDAs) containing Client Data used by State Street’s personnel using an industry recognized encryption algorithm with at least 256 bit encryption AES (or equivalent).

b. Secure Storage—State Street shall require that all laptops and mobile devices be securely stored whenever out of the personnel’s immediate possession.

c. Inactivity Timeout—State Street shall employ access and password controls as well as inactivity timeouts of no longer than thirty (30) minutes on laptops, desktops and mobile devices managed by State Street and used by State Street’s personnel.

d. State Street shall maintain the ability to remotely remove Client Data promptly from mobile devices managed by State Street.

a. Client Data – Client Data shall only be used by State Street for the purposes specified in the Agreement.

b. Virus Management—State Street shall maintain a malware protection program designed to deter malware infections, detect the presence of malware within the State Street environment, and recover from any impact caused by malware.

a. Incident Management/Notification of Breach - State Street shall develop and implement an incident response plan that specifies actions to be taken when State Street or one of its subcontractors suspects or detects that a party has gained material unauthorized access to Client Data or systems or applications containing any Client Data (the “Response Plan”). Such Response Plan shall include the following:

i. Escalation Procedures—An escalation procedure that includes notification to senior managers and appropriate reporting to regulatory and law enforcement agencies. This procedure shall provide for reporting of incidents that compromise the confidentiality of Client Data (including backed up data) to Client via telephone or email (and provide a confirmatory notice in writing as soon as practicable); provided that the foregoing notice obligation is excused for such period of time as State Street is prohibited by law, rule, regulation or other governmental authority from notifying Client.

ii. Incident Reporting—State Street will use commercially reasonable efforts to promptly furnish to Client information that State Street has regarding the general circumstances and extent of such unauthorized access.

iii. Investigation and Prevention—State Street shall reasonably assist Client in investigating of any such unauthorized access and shall use commercially reasonable efforts to: (A) cooperate with Client in its efforts to comply with statutory notice or other legal obligations applicable to Client or its clients arising out of unauthorized access and to seek injunctive or other equitable relief; (B) cooperate with Client in litigation and investigations against third parties reasonably necessary to protect its proprietary rights; and (C) take reasonable actions necessary to prevent mitigate against loss from any such authorized access.