Washington State Department of Licensing (DOL) 5/16/2024

ANNUAL INTERNAL ASSESSMENT On an annual basis, based on the execution date of this Agreement, Licensee shall self- assess its own entity to determine whether it is maintaining the Data Security and Permissible Use requirements. This assessment may be completed by obtaining an independent audit; Licensee will provide a copy of that audit to DOL, and will further comply with all matters noted in the audit report. If this assessment is performed internally by the Licensee, then Licensee must provide DOL with a written certification, acknowledging the completion of the assessment and identifying any deficiency findings. The written certification must be executed by a manager, director, or officer of the Licensee who has the expressed signatory authority to make such a certification on behalf of the Licensee. Written Certification: If the assessment determines that Licensee is meeting all Data Security and Permissible Use requirements of this Agreement, then Licensee’s certification may simply note that the assessment was completed and no deficiencies were found. However, if deficiencies are discovered, Licensee must submit a completed Attachment E - Data Security/Permissible Use Non-Compliance/Deviation Form, and include it with its certification to DOL. The requirement for Attachment E may be met by providing a copy of an audit report if Licensee obtained an additional audit. DOL and Licensee will work together to determine the final actions needed in order to correct all deficiencies noted in the certification. Licensee’s annual assessment findings will be reviewed during the next independent audit. If DOL finds inaccuracies in the Licensee’s self-assessments, especially concerning non- reported deficiencies, DOL may deem such inaccuracies and omissions as a possible breach of this Agreement.