Exhibit 10.1
Final Execution Version

AMENDMENT NO. 3 TO
MASTER SERVICES AGREEMENT

This Amendment No. 3 to Master Services Agreement (“Amendment”) is made as of
this August 9, 2012, (“Amendment 3 Effective Date”) by and between Cognizant
Technology Solutions U.S. Corporation (“Supplier”) and Health Net, Inc., a
Delaware corporation (“Health Net”) with reference to the following facts:
A.    Supplier and Health Net entered into a Master Services Agreement dated
September 30, 2008, as previously amended (collectively the “Agreement”) which,
among other things, requires Supplier to perform Services for Health Net;
B.    Supplier and Health Net wish to amend the Agreement to incorporate Exhibit
A-1 (HNFS Requirements) in support of certain Health Net Federal Services, LLC
applications; and
D.    Supplier and Health Net desire to modify certain terms and conditions
contained in the Agreement as provided in this Amendment.
NOW, THEREFORE, in consideration of the mutual promises, covenants, agreements
and other undertakings set forth herein and for other good and valuable
consideration, the receipt and sufficiency of which is hereby acknowledged, the
parties hereby agree as follows:
1.    Definitions: Defined terms used in this Amendment shall have the same
meaning as in the Agreement unless otherwise specifically defined herein.
2.    The Exhibit A-1 (HNFS Requirements) attached hereto is incorporated into
to Schedule A of the Master Services Agreement and each party hereby agrees to
comply with and adhere to all of its respective obligations and requirements in
the HNFS Requirements document, as may be amended from time to time.
3.    With respect to the HNFS Requirements only and notwithstanding Section
25.11 (Order of Precedence) of the Agreement, in the event of a conflict between
the HNFS Requirements and any other term or condition of the Agreement, the HNFS
Requirements shall prevail.
4.    Except as amended and modified by this Amendment, all of the terms and
conditions of the Agreement shall remain in full force and effect. This
Amendment may not be modified except in writing signed by both parties hereto.
This Amendment, the Agreement and exhibits and schedules thereto constitute the
entire agreement of the parties with respect to the subject matter contained
therein and supersedes any and all prior or contemporaneous agreements between
the parties, whether oral or written, concerning the subject matter contained
herein.

IN WITNESS WHEREOF, the parties hereto by their duly authorized representatives
executed this Amendment to be effective as of the Amendment Effective Date.

COGNIZANT TECHNOLOGY SOLUTIONS    HEALTH NET, INC.
U.S. CORPORATION

By    /s/ David Brown                By    /s/ Robert Bushey        
Name    David Brown                    Name    Robert Bushey            
VP, Strategic Sourcing &
Title    Senior Director                    Title    Procurement            

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 1    Health Net / Cognizant Confidential

--------------------------------------------------------------------------------

Final Execution Version

EXHIBIT A-1
HNFS REQUIREMENTS

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 2    Health Net / Cognizant Confidential

--------------------------------------------------------------------------------

Final Execution Version

EXHIBIT A-1
HNFS REQUIREMENTS

1.
INTRODUCTION

1.1
Background.

(a)
Health Net Federal Services, LLC (HNFS) is a business unit within Health Net.

(i)
HNFS’ primary line of business is the TRICARE Program. The TRICARE program is a
Department of Defense health care entitlement program, which is administered by
private contractors who are selected for participation through a competitive
procurement process.

(ii)
In addition to the TRICARE line of business, HNFS has other revenue generating
sources, including:

(A)
    Veterans Administration (VA) Preferred Pricing Contract-Health Net is a
subcontractor to our Service Disabled Veteran-Owned Small Business Partners,
Enterprise Technology Solutions and Primeaux Health Strategies. Their contracts
cover five regions. The five regions are made up of all 21 Veterans Integrated
Service Networks (“VISNs”). VA’s Preferred Pricing Program services allow
participating VA Medical Centers to share in savings available through discount
agreements with Health Net’s nationwide provider network for a variety of health
care services, including hospitalization, outpatient care, ambulatory surgery,
behavioral health, ancillary and other services. (Note that this contract was
terminated effective Friday, August 3, 2012, but the parties are working toward
restoration of the contract.)

(B)
    DRG Audit and Recovery Services - HNFS also provides the VA with a review of
inpatient medical claims that the VA may have overpaid. HNFS currently holds a
single contract to perform this service for all Veterans Administration Medical
Centers (VAMCs) nationwide.

(C)
    DoD Victims Advocate Program – HNFS currently provides Domestic Abuse Victim
Advocates (DAVAs) at military installations around the US through a contract
with the Department of Defense. The Advocates provide a range of support and
advocacy services for victims of domestic violence, including initial response
and safety planning and ongoing assistance. The Advocates are HNFS Associates
and

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 3    Health Net / Cognizant Confidential

--------------------------------------------------------------------------------

Final Execution Version

are managed by the DAVA Management Team located in Johnstown, PA.
(D)
    HNFS also bids on additional government health care programs that may
include comprehensive medical and behavioral health benefits and/or unbundled
administrative services applicable to such programs, including, but not limited
to provider network, utilization management, claims administration and direct
services.

(E)
    VA Rural Mental Health Program-The VA Rural Mental Health Program is a pilot
program authorized by Congress in Sec. 105 of P.L. 110-387 to provide mental
health services to OIF/OEF Veterans who do not live in close proximity to VA
Hospital or Community Based Outpatient Clinics. Health Net is the current
contractor for VISNs 19 and 20 and the former contractor for the VISN 6’s Rural
Mental Health initiative, which was largely based on the pilot.

(F)
    California Department of Corrections and Rehabilitation contract whereby
HNFS provides administrative support services, including preferred provider
organization network services to the California State Prison system.

 
1.2
General Obligations.

(a)
This Exhibit A-1 (HNFS Requirements) defines security requirements and related
compliance requirements applicable to HNFS. Security requirements applicable to
Health Net under the Agreement that are not in conflict with this Exhibit, shall
also apply to HNFS.

(b)
As of the Effective Date, Supplier shall comply with all HNFS security-related
requirements, policies and standards that apply to the processes, systems,
networks, personnel, and facilities that Supplier supports, each as explicitly
set forth in this Exhibit A-1, and Supplier shall also comply with all other
Health Net security policies and standards as set forth in the Agreement.

(c)
For the avoidance of doubt, and except in the event of a Change Notice, the
Production Support Charge shall be Supplier's sole compensation for Supplier's
efforts in complying with and adhering to the obligations and requirements in
this Exhibit A-1. Notwithstanding the foregoing, in accordance with Section
27.6(c) of the terms and conditions of the Agreement, a Regulatory Change may
result in a Change pursuant to the Change Control Process.

2.
SERVICE REQUIREMENTS

2.1
General.

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 4    Health Net / Cognizant Confidential

--------------------------------------------------------------------------------

Final Execution Version

(d)
Supplier must comply with all security requirements applicable to HNFS, as
explicitly set forth in this Exhibit A-1.

(e)
Supplier must also comply with the following documents and guidelines in their
support and operation of HNFS systems:

(i)
“OMB M-06-16, Protection of Sensitive Agency Information” June 23, 2006:
http://www.whitehouse.gov/omb/memoranda/fy2006/m06-16.pdf

(ii)
DoD Directive 5400.11, “DoD Privacy Program,” September 1, 2011:
http://www.dtic.mil/whs/directives/corres/pdf/540011p.pdf

(iii)
DoD Publication 5200.2-R, “DoD Personnel Security Program,” January 1987:
http://www.dtic.mil/whs/directives/corres/pdf/520002r.pdf

(iv)
FIPS-140 Validated Cryptography:
http://csrc.nist.gov/groups/STM/cmvp/validation.html

(f)
Configuration and operation of systems supported by Supplier will be conducted
in compliance with the Defense Information Systems Agency (DISA) Security
Technical Implementation Guides (STIGs) and STIG checklists. Compliance with
these guides is mandatory for all systems and applications that process, store,
access, or transmit Department of Defense data, and associated critical security
and support systems as defined by INFOSEC.

(i)
DISA Security Technical Implementation Guides (STIGs) and checklists:
http://iase.disa.mil/stigs/a-z.html

(g)
Supplier must also comply with HIPAA Privacy and Security rules and
corresponding DoD issuances, as described in the TRICARE Operations Manual (TOM)
Chapter 19 Section 3 to assure that Military Health System (MHS) data is
protected. The Military Health System is the enterprise within the United States
Department of Defense responsible for providing health care to active duty and
retired military personnel and their dependants.

(h)
Supplier must also comply with Health Net Incident Response requirements,
policies and processes as required by DoD 5400.11-R C4.5, DoD 6025.18-R and DoD
8580.02-R, HIPAA Breach rules

(i)
Supplier must also comply with the Health Information Technology for Economic
and Clinical Health (HITECH) Act, which is subject to regulatory enforcement by
the HHS Office for Civil Rights (OCR).

(j)
The provisions of the Military Family Life Consultant (“MFLC”) contract held by
HNFS’ Affiliate, MHN Government Services, Inc. and any follow on contract under
the MFLC program. To the extent any requirements or obligations change with
respect to a follow-on contract, such changes would be subject to the Change
Notice procedures set forth in the Agreement.

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 5    Health Net / Cognizant Confidential

--------------------------------------------------------------------------------

Final Execution Version

The remainder of this Exhibit A-1 summarizes and consolidates certain of the
critical requirements referenced in the documents provided above, and provides
additional requirements that Supplier must meet in support of the HNFS security
programs.
(k)
Background Investigations

(i)
DoD Sensitive Information (DoD SI) includes Protected Health Information (PHI)
and other Personally Identifiable Information (PII) associated with DoD
personnel, as well as any other information that could adversely affect the DoD
if it were disclosed (e.g. security vulnerabilities, troop data, etc.).

PII is defined as any information about an individual that identifies, links,
relates, or is unique to, or describes him or her. This also includes
information which can be used to distinguish or trace an individual's identity
and any other personal information which is linked or linkable to a specified
individual.
PHI is defined in Section A of Schedule K to the Terms and Conditions.
(ii)
Supplier Personnel with permissions to access DoD SI on information systems must
be US citizens and must be able to successfully pass a DoD background
investigation (National Agency Check with Law Enforcement and Credit (NACLC))
providing an ADP/IT-II Position of Trust. This includes all Supplier Personnel
with indirect or potential access to DoD SI as a result of their administrative
privileges. The majority of HNFS production systems are involved in the storage
or processing of DoD SI, and therefore these requirements apply to most
personnel with access to those systems.

(iii)
The Supplier will coordinate efforts to obtain ADP/IT-II Positions of Trust for
its employees and subcontractors with Health Net Industrial Security. The
Supplier is responsible for performing pre-employment background checks prior to
submission for a Position of Trust to include:

(A)
Verification of U.S Citizenship

(B)
Criminal Background Check

(C)
Credit Check

(D)
Drug Screen

The background checks are valid for 90 days only. If a resource is not complete
with the NACLC process within the 90 days of the completion of the background
check, then the background check will need to be repeated. Supplier must

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 6    Health Net / Cognizant Confidential

--------------------------------------------------------------------------------

Final Execution Version

receive notification from Health Net’s Industrial Security Department before
access to systems will be provided.
(iv)
System access that requires ADP/IT-II Positions of Trust includes, but is not
limited to, the following applications:

AHLTA
ART
B2B- Other (DISA)
CCDD
CCS
CHCS
Civilian PCM Panel Reassignment
CLR
CPPR
CRM
DCS
DEERS Security App
DEERS Web
DFAS (DISA)
Direct Care PCM Panel
DMDC/DWR
DOES
DS Logon
Duplicate Claims
Fastrieve (SourceCorp)
Fee interface
FS PEGA (UAT, Staging and Production)
GIQD
Information Warehouse
Mercury Products
MMS (UAT, Staging and Production)
Notifications (PNT)
OHI/SIT
Patient ID Service
PCDIS/TePRV (DHSS)
PCM Load
PCM Research
PEPR
PERR (Other Applications) DHSS
PGBA CCM
PGBA Claims
PGBA DocFinity
RRS
TED
TePRV Inquiry
TIP
TITAN
TRICARE Online (TOL)
VISTA

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 7    Health Net / Cognizant Confidential

--------------------------------------------------------------------------------

Final Execution Version

WFA
(l)
Security & Privacy Training.

(i)
Initially (within 30 days of assignment) and annually, all Supplier Personnel
are required to take the Security Awareness training with the appropriate
content provided by Health Net in advance. For Supplier Personnel who hold a
Position of Trust (National Agency Check), they are required to take and pass
the Security Baseline training course within five days of hire or prior to
receiving any government system access. All Supplier Personnel who will have
access to HNFS-related systems or data shall be trained in an expeditious manner
during the Transition Period, or for Supplier Personnel who start work on the
Health Net account after Transition, within five days of starting work (provided
that in either case, such training shall occur prior to the applicable Supplier
Personnel being granted access to any DoD SI or associated applications).
Subsequent refresher training shall be conducted annually and must be completed
within 30 days of assignment of the refresher requirement. This refresher
training applies to all Supplier personnel regardless of holding an ADP/IT-II
position of trust or not. Retraining may also be required as necessary if any
material changes are made to HIPAA Rules affecting DoD or Health Net policies
and procedures, and must occur within 30 days of assignment of the training.

(ii)
In order to assist with Aerojet’s International Traffic in Arms Regulations
(ITAR) and required Department of State (DoS) license and DoS approvals, Health
Net has entered into an agreement with Aerojet, whereby employees and
contractors who are Foreign Nationals (a Foreign National is an individual who
is a citizen of any country other than the United States) and require unescorted
access be granted at the Aerojet-Sacramento Facility, will comply with the
requirements of Aerojet’s Foreign National Visitor Access Control Plan. Health
Net associates and contractors who are Foreign Nationals shall be required to
attend a briefing by Aerojet Security regarding identified areas where they are
allowed and will wear an identification badge to delineate them as Foreign
Nationals on a secured site. Aerojet Security will provide all training and
badging services.

(iii)
In addition to formal training, HNFS will email security newsletters and
bulletins to all personnel (including Supplier Personnel) using or supporting
HNFS systems throughout the year as a part of HNFS' security awareness

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 8    Health Net / Cognizant Confidential

--------------------------------------------------------------------------------

Final Execution Version

program. HNFS may also require certain security and privacy-related postings at
various locations throughout the facilities supporting HNFS to serve as
reminders of HNFS security polices and standards. Supplier Personnel shall at
all times comply with all policies and standards referenced in such newsletters,
bulletins or postings.
(iv)
In addition to the training required in Schedule A and Section 2.8(c) of the
General Terms and Conditions, Supplier Personnel supporting the HNFS
applications are required to take the following Health Net provided training:

G&SS HIPPAA Privacy Training
GSS Security Awareness
GSS Records Management Training    
Security Baseline Training
ISO 101-2009
HNFS URAC CORE V3.0 (TRICARE ONLY)
URAC Applied Training (TRICARE ONLY)
HNFS Reporting Quality of Care and Serious
Reportable Events
 
(m)
Security Audits and Assessments

(i)
The HNFS NIST Authorization boundary includes all information systems that
access, process, display, store or transmit DoD or Veterans Affairs (VA) SI, PII
or PHI. It can also include any systems interconnected with these systems,
including systems with which information is exchanged via messaging. It
typically extends to all intended users of these systems, both directly and
indirectly connected, who receive output from the system.

(ii)
The supplier will support security audit and assessments as required to comply
with the NIST SP 800-53 controls listed in the Checklist and Certification for
Minimum Level of Enhanced Safeguarding for Unclassified DoD Information as
referenced by TMA Policy no. 11-63 below:

http://www.tricare.mil/tma/ams/downloads/policyalerts/PA11-63att2.doc
The associated details for the NIST SP 800-53 control requirements listed in
that checklist are provided in the following document:
http://csrc.nist.gov/publications/

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 9    Health Net / Cognizant Confidential

--------------------------------------------------------------------------------

Final Execution Version

nistpubs/800-53-Rev3/sp800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf.
The Supplier will also support security audits and assessments for HNFS systems
supporting any HNFS contract. The NIST authorization boundary for VA systems is
categorized as NIST “System High.” Supplier will support those systems and
associated audits to meet the system high requirements as specified by NIST SP
800-53.
(iii)
Supplier shall provide documentation and support for NIST compliance assessments
and any other audits or third-party assessments of applications and information
systems that Supplier administers. Typically, this support will consist of
requests for information relating to applicable security controls, user access,
and system architecture or configuration for the systems and applications
supported by the Supplier. However, in depth assessments may be conducted from
1-3 times per year that require extensive access to applications/systems and
audit support from Supplier personnel. Supplier will provide adequate personnel
to support such efforts. Such assessments may include, but are not limited to:
(a) attending and supporting audit/assessment meetings; (b) supporting the
INFOSEC team during system security testing and evaluation, including
provisioning of access to systems and participating in the assessment process
(c) participating in any other audit (i.e completing assessment checklists) as
required; and (d) providing remediation and/or approved mitigating controls to
address any deficiencies identified.

(n)
Physical Security

(i)
In the event that Supplier provides service from a non Health Net facility
Supplier shall support physical security assessments performed by both
Industrial Security and the MHS Information Assurance (external government
auditors) assessment team using the criteria from the Physical Security
Assessment Matrix in Schedule M (Policies and Procedures). Supplier shall
correct any deficiencies of its physical security posture indentified.

(ii)
Supplier facilities and data center(s) supporting HNFS functions will submit to
a pre-audit physical security inspection performed by a member of the Industrial
Security team and comply with all directives to ensure mitigation of findings.

(iii)
In addition, a binder containing site security policies standards and procedures
will be provided by Industrial

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 10    Health Net / Cognizant Confidential

--------------------------------------------------------------------------------

Final Execution Version

Security and maintained at each facility supporting HNFS functions.
 
(o)
Security Administration.

(i)
Supplier shall provide security administration support for all applications and
systems supported by Supplier. Supplier shall provide an assigned point of
contact (POC) for Information Security support of each application/system.

(ii)
Each assigned POC will coordinate Supplier support for the security requirements
detailed in this document with INFOSEC. They will act as the primary POCs for
the notification and response for security vulnerabilities, will coordinate
collection of information for each system/application, and will act as the
primary POC for any audit/assessment-related activities for each supported
system/application.

(p)
Applications & Systems Inventory

(i)
Supplier will provide an updated software inventory list for all supported
systems and applications to INFOSEC on a monthly basis. The list provided will
include the software name, manufacturer, version, patch level, installed modules
or components, and a list of all host names where that software is installed.

(q)
Data & Systems Network Security and Separation Requirements

(i)
Non-DoD data may reside on systems within the NIST authorization boundary and
access may be provided to that data as necessary as long as appropriate access
control mechanisms are in place.

(ii)
Physical hardware separation between NIST authorization boundary systems and
non-NIST systems is required. Virtual server separation such as that provided by
VMware or Citrix is not sufficient.

(iii)
Systems that support VA contracts must be physically separated from all other
systems. All VA sensitive information, PHI and PII must be encrypted (refer to
Section 2.1(b)(iv) of this document for encryption standards) in transit and at
rest.

(iv)
Software supported by Supplier that is required to be included within the NIST
Authorization boundary must be configured and installed in accordance with the
network controls that define that boundary. Such software will be installed on
the VLANs and subnets identified for NIST boundary systems and will comply with
Health Net

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 11    Health Net / Cognizant Confidential

--------------------------------------------------------------------------------

Final Execution Version

network communications guidance for permitted ports and protocols.
(r)
Change/Configuration Management.

(i)
Any proposed changes to an information system within the NIST authorization
boundary that could affect the security configuration of that system must be
reviewed and approved by the INFOSEC team prior to implementation. Any such
changes could result in additional testing and evaluation by the INFOSEC team.

(s)
Disaster Recovery and Continuity of Operations.

(i)
Without limiting Supplier’s obligations under Section 2.7 of Schedule A,
Supplier shall provide input to HNFS’ Continuity of Operations Plan (COOP),
revised on an annual basis, which provides for the continued operation of the
systems and data that Supplier supports under Health Net’s TRICARE contract. It
will include all actions that will be taken to continue operations should a
disaster be declared and in the event of hardware, software and/or
communications failures. It shall also include plans for relocation/recovery of
operations, timeline for recovery, and relocation site information. It shall
include connection to the DoD Business to Business (B2B) Gateway to and from the
relocation/recovery site in compliance with all security requirements and
associated B2B Gateway connectivity processes. Restoration of critical functions
such as claims and enrollment is required within five days of the disaster. HNFS
reserves the right to re-prioritize the functions and system interactions
proposed in the COOP during the review and approval process for the COOP.

(ii)
Annual disaster recovery testing of all aspects of the COOP for major HNFS
functions is required in coordination with HNFS on a timeline agreed to with
HNFS in coordination with the DoD and other contractors responsible for the
transmission of DoD and/or HNFS data. In the event that any portion of the
annual disaster recovery test fails, the Supplier will conduct problem
resolutions and retesting of all Services test components in a timely manner.

(t)
Security Documentation. Supplier will assist INFOSEC in developing and
maintaining security and compliance related documentation by providing any
information associated with the applications and systems that the Supplier
supports as required. Examples include but are not limited to:

(i)
Technical specifications

(ii)
Security specifications

(iii)
System/application architecture diagrams

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 12    Health Net / Cognizant Confidential

--------------------------------------------------------------------------------

Final Execution Version

(iv)
Processes, procedures, and workflows

(v)
Roles and responsibilities

(vi)
Other information to support security review of applications and systems

(u)
Information Assurance Vulnerability Management (IAVM).

(i)
Supplier will comply with HNFS IAVM processes as detailed below. The IAVM
process is a DoD-mandated patch management process that applies to all HNFS
systems. The compliance window for IAVM Alerts (Information Assurance
Vulnerability Alerts or IAVA’s) is determined by the DoD and is specific to each
individual alert - it is typically 3 weeks, although they have varied from as
few as 10 days to as long as a month. IAVA notifications are typically released
a few weeks following vendor notifications for security patches, so it is
possible that the appropriate patches may have been applied before the IAVA for
those patches were received.

(ii)
Supplier will provide:

(A)
Acknowledgement of receipt within two days of delivery of IAVA’s, IAV Bulletins,
or IAV Technical Advisories from INFOSEC.

(B)
A list of applicable applications/systems that are supported by the Supplier and
a detailed remediation plan for each within five days of delivery of the IAVA’s,
IAV Bulletins, or IAV Technical Advisories.

(C)
Remediation of applicable IAVA-identified vulnerabilities within the compliance
date specified within the IAVA document.

(D)
A detailed remediation report to INFOSEC upon the successful remediation of each
vulnerability. The report must include a detailed description of the remediation
steps taken and verification that the remediation was successful (e.g.
screenshots, log files, monitoring reports, test results, etc.).

(iii)
If remediation of an IAVA vulnerability is not reasonably achievable within the
timeframe specified by the IAVA (as approved by INFOSEC), Supplier will

(A)
Develop a detailed Plan of Action & Milestones (POA&M), (form to be provided by
INFOSEC) within five days of delivery of the IAVA from INFOSEC.

(B)
Document and implement mitigating control measures to reduce the associated
security risk to a low risk (as determined by INFOSEC).

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 13    Health Net / Cognizant Confidential

--------------------------------------------------------------------------------

Final Execution Version

(C)
Initiate projects or appropriate vendor software modifications as necessary to
address the risk.

(v)
Security Vulnerability Remediation.

Supplier will provide:
(i)
Acknowledgement of receipt within two days of delivery of vulnerability
information from INFOSEC.

(ii)
A detailed remediation plan for all applicable vulnerabilities to INFOSEC within
five days of the delivery of the vulnerability information from INFOSEC.

(iii)
Remediation of all vulnerabilities (other than IAVA’s) within the timeframes
described below:

Vulnerability Type
Required Remediation Timeframe
(Upon Supplier receipt of vulnerability data)
Critical:
DoD Category I findings and any High Risk findings as specified by INFOSEC
25 Days*
Non-Critical:
All other findings
85 Days*

*For remediation efforts that would require a change by the vendor of Commercial
Off the Shelf (products that are commercially available, or COTS) or Government
Off the Shelf (products that are supplied and owned by the government, or GOTS
product or if INFOSEC agrees that the finding should not be remediated due to
other circumstances, Supplier will:
•
Develop a detailed POA&M within five days of delivery of the vulnerability
information or approval of the extended timeline by HNFS IA.

•
Document and implement mitigating control measures to reduce the associated
security risk to a low risk (as determined by INFOSEC).

•
Initiate projects or appropriate vendor software modifications as necessary to
address the risk.

(iv)
A detailed remediation report to INFOSEC upon the successful remediation of each
vulnerability. The report must include a detailed description of the remediation
steps taken and verification that the remediation was successful (e.g.
screenshots, log files, monitoring reports, test results, etc.).

All efforts associated with security remediation efforts will be considered
Adaptive Maintenance as defined in the Agreement.

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 14    Health Net / Cognizant Confidential

--------------------------------------------------------------------------------

Final Execution Version

(w)
Privacy & Security Incident Response

(i)
The Health Net Incident Response team must be notified immediately regarding any
potential or confirmed loss of Health Net Data, loss of assets, unauthorized
access, exploit of a security vulnerability, or bypass of security controls
identified by Supplier personnel.

(ii)
The Supplier will immediately complete an Incident Report available from the
following Lotus Notes Database entitled “Lotus Notes Privacy and Security
Incident Report Database” as well as Health Net Connectˆ Business Unitsˆ HNFSˆ
Quick Linksˆ Incident Reporting. If the database is not immediately available,
Supplier will immediately report the incident to HNGSS_Incidents@healthnet.com
            or by phone at 866-321-5876. Supplier will maintain and use the most
recent reporting contact information as provided by Health Net.

(iii)
Supplier will assist the Health Net Incident Response coordinators in addressing
any security or privacy incidents in an expedient manner, providing
investigative support (e.g. through event correlation, log analysis, and
associated reporting) and remediation of any associated vulnerabilities within
the timelines specified elsewhere within this document.

(iv)
Detection and reporting of security events is a responsibility of the Supplier.
When an event is reported as required, INFOSEC will track actions taken and
build an accurate timeline of events while also providing analysis and direction
to incident response actions. Accurate documentation is required from Supplier
to provide accountability and tracking of incident response activities.

2.2
Additional Security Policies & Standards

In addition, there are a number of additional HNFS-specific security policies,
procedures, processes and standards with which Supplier and its subcontractors
must comply. They are available on the Health Net Intranet through HNConnect at
the following links, and have been extracted and provided to Supplier separately
from this SOW:
(a)
Health Net Corporate Security Policy

http://hnconnect.healthnet.com/business_units/security/policies_and_procedures/list.jsp
(b)
HNFS Information Security Policies, Procedures, & Processes

http://kb.hnfs.healthnet.com/hnfskb_itsec.htm

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 15    Health Net / Cognizant Confidential

--------------------------------------------------------------------------------

Final Execution Version

(c)
HNFS Industrial Security Policies, Procedures, & Processes

http://kb.hnfs.healthnet.com/hnfskb_ssis.htm
(d)
HNFS Privacy Compliance Policies, Procedures, & Processes

http://kb.hnfs.healthnet.com/hnfskb_ssprivacy.htm
(e)
HNFS Records Schedule

http://kb.hnfs.healthnet.com/hnfskb_00003053.htm
3.
SERVICE MANAGEMENT

3.1
Service availability:

Supplier will provide security administration support 24 x 7 x 365.

3.2
Escalation:

Supplier will notify INFOSEC and HNFS Industrial Security immediately if at any
time current efforts will not meet the required timeframes. Escalation of issues
encountered in the performance of this Exhibit A-1or of any non-compliance with
this Exhibit A-1 will be addressed according to the issues resolution and
escalation procedures defined elsewhere in the Agreement.
3.3
Points of Contact:

As of August 9, 2012, the following are points of contact for HNFS Security:

Billy Martin
Director of Information Security
billy.martin@healthnet.com
916-935-8151

Matt McCracken
Director of Industrial Security
matthew.t.mccracken@healthnet.com
916-985-1689

--------------------------------------------------------------------------------

Exhibit A-1    A-1 - 16    Health Net / Cognizant Confidential