**EXHIBIT 10.9**

 

Amendment

 

 

20070105.006.A.002

 

 

Between

 

 

StarTek, Inc.

 

 

And

 

 

AT&T Services, Inc.

 

----

 

**AMENDMENT NO. 2**

 

**AGREEMENT NO. 20070105.006.C**

 

ThisAmendment, effective on the date when signed by the last Party (“Effective Date”),and amending Agreement No. 20070105.006.C, is by andbetween StarTek, Inc., a Delaware corporation (“Supplier”), and AT&TServices, Inc., a Delaware corporation (“AT&T”), each of which may bereferred to in the singular as a “Party” or in the plural as the “Parties.”

 

**WITNESSETH**

 

**WHEREAS**, Supplier and AT&T entered intoAgreement No. 20070105.006.C on January 26, 2007 (the “Agreement”);and

 

**WHEREAS**, Supplier and AT&T desire to amend theAgreement as hereinafter set forth.

 

**NOW, THEREFORE**, in consideration of thepremises and the covenants hereinafter contained, the Parties hereto agree asfollows:

 

1)              Section **2.0 “Definitions”,** is hereby amended asfollows:

 

a.Sub-section 2.11, **“Information”,**is hereby deleted in its entirely and replaced with the following:

 

“**Information**”, with respect to a Party, means allconfidential, proprietary or trade secret information belonging to such Party,including discoveries, ideas, concepts, know-how, techniques, processes,procedures, designs, specifications, strategic information, proposals, requestsfor proposals, proposed products, drawings, blueprints, tracings, diagrams,models, samples, flow charts, data, computer programs, marketing plans,customer information, employee personal information, health or financialinformation, authentication credentials, and other technical, financial orbusiness information, whether disclosed in writing, orally, visually, intangible or intangible form, including in electronic mail or by otherelectronic communication.

 

b.Sub-section 2.19, **“Services”,** isdeleted in is entirety and replaced with the following:

 

**“Service(s)”** means any labor or serviceprovided pursuant to this Agreement or an applicable Order, including, but notlimited to, engineering, installation, removal, maintenance, training, technicalsupport, repair and Call Center Services. The term “Service” 

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

1

----

 

shallalso include any Material, including any Documentation, provided by Supplierpursuant to this Agreement or an applicable Order in connection with providingthe Services. For the sake of clarity, Services (including Call CenterServices) *specifically excludes* consulting andprofessional services whereby enhancements, modifications or any developmentactivities related to software will occur (i.e., development of customizedsoftware).

 

c.Sub-section 2.23, **“Deliverables”,**is hereby added to the Agreement and is fully incorporated therein by thisreference:

 

“**Deliverables**” means any and alldeliverables set forth in an Order to be provided by Supplier pursuant to suchOrder. Deliverables include, but are not limited to, any reports, data,designs, plans, specifications, models, prototypes, performance requirements,and/or Documentation delivered pursuant to this Agreement or such Order.

 

2)              The Section **3.37, “Title to Work Product”,** is herebydeleted in its entirety and is replaced with the following, **“Ownership of Work Product”**:

 

**3.37****Ownership****ofWork Product**

 

*Supplier’s Intellectual Property*. The Parties acknowledge that Supplier and/or third-parties own certainintellectual property, including pre-existing or independently developedMaterials, software, processes, tools, methodologies and other intellectualproperty used to create the Work Product (the “Supplier’s IP”).  The notion of “independently developed”refers to development performed outside of this Agreement without use of oraccess to any Information provided by or on behalf of AT&T.  Something that is independently developedremains Supplier’s IP, even though Supplier may use it in connection withproviding Services.  AT&T makes noclaim to such Supplier’s IP which is not defined in or to be delivered pursuantto this Agreement or in an applicable Order.

 

*Work Product*.  Excludingthe Supplier’s IP and Supplier’s Information, ownership and all rights in thework product resulting from or is the outcome produced as a result of theServices or Call Center Services set forth in an Order (“Work Product”)including new trademarks, patents, copyrights, and trade secrets applicable tosame, hereby vests exclusively in AT&T regardless of whether Work Productwas created solely by Supplier or jointly by the Parties.  The Parties expressly agree to consider as a “workmade for hire” any Work Product which qualifies as such under the laws of theUnited States or other jurisdictions.  Tothe extent that the Work Product does not qualify as a “work made for hire”, orwhere necessary for any other reason to perfect the rights of AT&Tthereto,  Supplier hereby assigns toAT&T all right, title and interest thereto. Supplier agrees to provide other assistance, at AT&T’s expense,which AT&T may need through trademark, patent or copyright applications, orotherwise, to obtain the full benefit of the rights provided for herein, andwill execute all documents necessary to carry such assignment into fulleffect.    ***NOTE:***The notion of “work 

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

2

----

 

product”refers to a deliverable or outcome that must be produced to complete a projectand achieve its objectives (*See* definitionat BusinessDictionary.com)

 

*License*.  If the WorkProduct contains Supplier’s IP or other elements Supplier or others on itsbehalf previously or independently developed, then Supplier grants to AT&T,or agrees to obtain for AT&T, a non-exclusive, unrestricted, perpetual,worldwide, royalty-free license to use, copy, modify, distribute, publiclydisplay, publicly perform, import, manufacture, have made, sell, offer to sell(whether directly or through channels of distribution), exploit and sublicensesuch elements (and have others do any of the foregoing acts on AT&T’sbehalf) to the extent necessary for AT&T to exercise its rights in the WorkProduct.  Any such license shall includeAT&T’s right to grant an unrestricted, royalty-free sublicense to itsAffiliates for the purposes stated herein.

 

*Miscellaneous*. Supplier shall place a copyright or other proprietary notice on the WorkProduct at AT&T’s request.  Allnon-public aspects of the Work Product shall constitute AT&T’s Informationunder this Agreement.

 

*Reservation of Rights and Residuals*.  Except as otherwise expressly provided inthis Section entitled “*Ownership of Work Product*,”Supplier retains all right, title, and interest in and to all Supplier’s IP andSupplier’s Information. The Parties agree that either Party may use, without anobligation to the other Party,  anygeneral knowledge and expertise, skills, techniques, concepts or know-howincidentally (and not intentionally) retained in the unaided memory of theParty’s employees to develop or provide similar services for other customers,provided that such use is without reference to the other Party’sInformation.  No license is granted underthis Section by either Party to the other Party for any patent, trademark,Work Product, trade secret or copyright.

 

3)              The following Section 4.19,**“PaymentCard Industry (PCI) Data Security Standards and Credit Card Information”,**is hereby added to the Agreement and is fully incorporated therein by thisreference:

 

**Section 4.19, “****Payment****Card****Industry (PCI) Data Security Standards and Credit Card Information**

 

ThePayment Card Industry (PCI) data security standards are network security andbusiness practice guidelines developed for Visa, MasterCard, American Expressand Discover Card. They were developed to establish a minimum security standardwith regards to the protection of cardholder’s account and transactioninformation. The PCI Security Standards Council, LLC (a non-AT&T entity)owns, develops, maintains and distributes the PCI Data Security Standard (DSS).If Supplier (including its subcontractor, agent or any third party, actingthrough, or on behalf of Supplier) collects, processes, handles, and/ormaintains credit card data and/or related transaction status or identityinformation through, for, or on behalf of 

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

3

----

 

AT&T(including, without limitation, for itself, or in connection with AT&T’sjoint or co-branded relationships and/or its, or their customers, as the casemay be), Supplier represents and warrants that it is, and shall remain PCI DSScompliant, including, but not limited to being, DSS certified, current and ingood standing, if applicable, at no cost to AT&T, for the longer of theterm of this Agreement or any of Supplier’s applicable obligation periods underthis Agreement, in accordance with the requirements of the PCI DSS.Notwithstanding anything to the contrary contained within the clause entitledInformation or any other provision within this Agreement, Supplier acknowledgesthat credit card information shall be deemed, and **shall** be treated asInformation under this Agreement irrespective of whether or not suchInformation is conspicuously marked as confidential or proprietary and Supplier’sobligation to treat credit card related Information as confidential shallsurvive the Termination, Cancellation or expiration of this Agreement. Suppliershall indemnify and hold AT&T harmless from and against any proved oralleged claims, demands or suits, or any losses, damages, liabilities, fines,penalties and expenses (including reasonable attorney’s fees) that arise outof, relate to or result from Supplier’s (and/or its subcontractor, agent or anythird party, if any, acting through or on behalf of Supplier) failure to complywith its obligations under this clause. Except as may be provided elsewhere inthis Agreement, nothing contained within this clause shall be construed tomean, or means that Supplier is authorized to delegate, assign or subcontractany portion of its obligations under this clause to any third party.

 

4)              The following Section 4.20,**“Worker’sExit Process from AT&T’s Program(s)”,** is hereby added to theAgreement and is fully incorporated therein by this reference:

 

**“4.20 Worker’s Exit Process from AT&T’s Program(s)**

 

“Workers” Exit Process from AT&T’sProgram(s).  If the Work is transitioningto another AT&T program, some of these provisions may not apply.

 

a.               Upon Worker’s completion ofServices, includingattrition of Worker, dismissal of Worker, and program expiration ortermination, Supplier shall:

 

·                  Immediately notify AT&T’s Hiring/Program Managerand identify the Worker(s) so the applicable attuid can be deleted.

·                  Ensure that Worker’s critical knowledge as to theperformance of Services is transferred via training of other Worker(s) and/ordocumented.

·                  Ensure that any roles assigned to the Worker areappropriately reassigned, such as:

 

·                  Project team/committee member

·                  Functional representative forinternal/external interfaces

 

·                  Advise the AT&THiring/Program Manager if a security clearance exists.

·                  Advise theAT&T Contract Manager, as applicable, if there is reason to believe theWorker should not be engaged for future assignments.

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

4

----

 

·                  **Remind theWorkers of their obligation to maintain confidentiality of AT&T proprietaryinformation.**

·                  Perform an inventory ofAT&T records (paper and electronic) in Worker’s office or telework/virtualoffice and arrange for appropriate retention or destruction pursuant to anOrder or as directed by AT&T’s Hiring/Program Manager.

·                  HaveWorker establish “Out of Office” Voice Mail message and have the Supplier’sTeam Manager, or its delegate, review for appropriateness.

·                  Ifa reservation or reservationless conference bridge is assigned to the Workerfor AT&T’s Program, Supplier’s Team Manager, or its delegate, shall ensurethat such reservation and reservationless conference bridges are cancelled.

·                  Whentransition of Worker’s job responsibilities under an AT&T Program iscomplete, Supplier Team Manager, or its delegate, requests cancellation ofother system / job specific UserIDs, access codes, and access privileges thatthe Worker may have to support AT&T’s Programs, such as:

 

·                  Shareddrives (transfer ownership, if applicable)

·                  Financialsystems

·                  Datawarehouses

·                  Internetand database services

·                  DigitalCertificates

·                  Othersystems

 
|   | · |   |   |
|--------|--------|--------|--------|
|   | · |   |   |
|   | · |   |   |

 

·                  If reasonably possible to doso, collect and return SecurID Card/Token to AT&T, if applicable.

 

NOTE:              At the same time, AT&Tshall promptly disable access to AT&T assets by means of such SecurIDCard/Token so that access cannot be achieved even if the SecurID Card/Tokencannot be collected.

 

·                  IfTACACS/Config service, applies, notify the AT&T Hiring/Program Manger todelete TACACS/config server ID, if applicable.

·                  Recover andsecure AT&T assets, which may include AT&T assets, in Worker’spossession (including those kept at the individual’s home):

 

·                  Personalcomputers

·                  Software

·                  Monitors

·                  Modems

·                  Printers

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

5

----

 

·                  Faxmachines

·                  Speakers

·                  PDAs

·                  Pagers

·                  Cellphones

 

·                  IfWorkers used a non-Supplier PC or Supplier’s PC (collectively “PC”), Suppliershall ensure that AT&T Proprietary information is cleaned off the PC byhaving them re-imaged.

·                  Have SupplierTeam Manager, or its delegate, ensure that the office space of exiting Workeris cleaned and ready for next occupant.

·                  IfServices are performed at remote locations, Supplier Team Manager, or itsdelegate, ensures the following installed services are disconnected at Worker’slocation (home and/or other work location):

 

·                  Phonelines

·                  DSLlines

·                  Cable modemconnections

 

·                  IfServices are performed at Supplier Locations, Supplier Team Manager, or itsdelegate, ensures the following services are disconnected:

 

·                  OfficeTelephone

·                  VoiceMail

·                  LAN Port

 

·                  Have SupplierTeam Manager, or its delegate, collect all property used for AT&T’sProgram(s). This includes but is not limited to:

 

·                  Worker’sidentification badges, portal passes, parking decals and passes, buildingaccess cards, security ID cards, smart cards, key cards, toll pass cards

·                  Keysto desks, file cabinets, storage cabinets, offices, conference rooms, and otherwork areas

·                  Keysto buildings, gates and vehicles used for AT&T’s Program(s)

·                  Otherequipment or property used for AT&T’s Program(s) not mentioned inprevious tasks, including any items that the Worker has at home or other remotelocation, such as:

 

·                  Microphones,video recorders, cameras and answering machines

·                  Manuals,library materials, software, documentation for software and hardware

·                  Officefurniture (and keys to same) and artwork

·                  Special devices(e.g., scanners, 2-way radios)

·                  Tools andUniforms

 

·                  PrepareAT&T files for storage:

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

6

----

 

·                  SupplierTeam Manager, or its delegate, reviews office records for compliance withAT&T’s retention schedule pursuant to an Order and as required by law, andtransfer active records with retention obligations to appropriate person orgroup inheriting work function. For inactive records with retentionobligations, follow procedures for sending to off-site vendor storage.

·                  Material for which there is no retention obligationor as may be required by law, can be destroyed in accordance with the Order oras directed by AT&T’s Hiring/Program Manager.

 

b.                                 **Obtain Worker’scertification that Worker has returned or destroyed all physical and electroniccopies of AT&T proprietary information.**

 

a.               Upon Worker’s completion of Services, including theattrition of Worker, dismissal of Worker, and program expiration ortermination, Supplier shall use reasonable commercial efforts to cause suchWorker to complete and sign the “Written Certification of Return or Destructionof AT&T Information or Data”, **Appendix L.**

 

b.              Supplier shall deliver either an executed copy of **Appendix L** to the AT&T Hiring/ProgramManager or a statement explaining why such copy cannot be provided, within five(5) business days of completion of Services, and retain the original, ifany, to be placed in the Worker’s personal file as a permanent record, If such executed copy of Appendix L cannot be obtained, Supplier shallnevertheless use reasonable commercial efforts to obtain .thereturn of any AT&T Proprietary Information from the Worker and eitherreturn the same to AT&T or destroy it.

 

5.)           The following Section **4.21AT&T Supplier Information Security Requirements (SISR)”**, ishereby added to the Agreement and is fully incorporated therein by thisreference:

 

“Suppliershall comply with the requirements of Appendix “O” entitled “AT&T SupplierInformation Security Requirements (SISR).”

 

6.)           The attached Appendix L — **“WrittenCertification of Return or Destruction of AT&T Information or Data”**is hereby added to the Agreement and fully incorporated therein by thisreference.

 

7.)          The attached Appendix O, **“SupplierInformation Security Requirements (SISR)”**, is hereby added to theAgreement and fully incorporated therein by this reference.

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

7

----

 

Theterms and conditions of Agreement No. 20070105.006.C in all other respectsremain unmodified and in full force and effect.

 

TheParties hereto acknowledge that they have read this Amendment, understand it,and agree to be bound by its terms and conditions.  They further agree that Agreement No. 20070105.006.Ctogether with Amendment No. 20070105.006.A.001 and this Amendment No. 20070105.006.A.001constitute the entire agreement between the Parties hereto with respect to thesubject matter hereof.

 

**IN WITNESS WHEREOF**, the Parties have causedthis Amendment to Agreement No. 20070105.006.C to be executed, which maybe in duplicate counterparts, each of which will be deemed to be an originalbut all of which together will constitute only one instrument, as of the datethe last Party signs.

 
| **StarTek, Inc.** | ** **            | **AT&T Services, Inc.** |
|------------------------|-----------------------|----------------------------------|
| ** **             | ** **            | ** **                       |
| By:                    | /s/ A. Laurence Jones |                             | By: | /s/ Michael De Palma |
|                   |                  |                             |   |   |
| Printed Name:          | A. Laurence Jones     |                             | Printed Name: Michael De Palma |
|                   |                  |                             |   |
| Title:                 | President and CEO     |                             | Title: Sourcing Director -  Contact Centers and Marketing, AT&T Supply Chain Operations |
|                   |                  |                             |
|                   |                  |                             |   |
|                   |                  |                             |   |
| Date:                  | 4/14/09               |                             | Date: | 4/14/09 |

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

8

----

 

**Appendix L**

 

**WrittenCertification of Return or Destruction of AT&T Information or Data**

 

Pursuant to the terms ofthe Worker Agreement dated                      , 20XX between me and **[NAME OFAT&T COMPANY]** (“AT&T”), I hereby certify that I havereturned to AT&T or have destroyed all physical and electronic copies ofall Information, as that term is defined in the Worker Agreement.

 

 
|                            |       |
|---------------------------------|------------|
| **[NAME AND ATTUID OF WORKER]** | ** ** |
|                            |       |
| ** **                      | ** ** |
| **Signature**                   | ** ** |
|                            |       |
| ** **                      | ** ** |
| **Date**                        | ** ** |

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

1

----

 

## **AppendixO**

## ** **

## **InformationSecurity Policy**

## ** **

# **AT&T Supplier Information SecurityRequirements**

# ** **

Thefollowing AT&T Supplier Information Security Requirements apply to theemployees and/or temporary workers of Supplier and its suppliers,contractors, vendors and/or agents, that perform services for, on behalf of,and/or through AT&T, which require access to AT&T’s infrastructure,systems or applications or handle, process, or store, AT&T, AT&TBranded and/or AT&T Co-branded Information (for the purpose of thisSection, each or all “Supplier”). Supplier represents and warrants that duringthe term of this Agreement and thereafter (as applicable with respect toSupplier’s obligations under the Survival of Obligations and Compliance withLaws clauses) Supplier is, and shall continue to be in compliance with itsobligations as set forth herein.” AT&T’s failure to audit and/or exerciseany of its rights under this Section shall not be construed or deemed tobe a waiver of any rights under this Agreement, equity or law. In addition toall other remedies specified in the Agreement, Supplier agrees that AT&Tshall be entitled to seek an injunction and be reimbursed the costs (includingreasonable attorney’s fees) by Supplier to cease any breach of any obligationthat survives termination or expiration of this Agreement. The followingprovisions shall not be deemed to, and shall not limit any more stringentsecurity or other obligations contained within this Agreement.

 

Definitions:

 

Unlessotherwise set forth or expanded herein, defined terms shall have the samemeaning as set forth in the main body of the Agreement.

 

“AT&TBranded Information” means Information owned, labeled, marked, or collected,which contains any of AT&T’s or its affiliates identifying markings ortrademarks.

 

“AT&TCo-branded Information” means AT&T Branded Information that is jointlymarketed or shared under a co-branding arrangement with a Supplier,irrespective of dominance or emphasis of the co-branding relationship.

 

As used herein, the term “Information”is limited to:

 

(a)          The “ConfidentialInformation” to which the obligations in Section 3.16 of the Agreementapply, and

(b)         The “Customer Information”to which the obligations in Section 4.9 of the Agreement apply.

 

“InformationResources” means any systems, applications, and network elements, and theinformation stored, transmitted, or processed with these resources inconjunction with supporting AT&T and/or utilized by Supplier in fulfillmentof its obligations under this Agreement.

 

“PersonallyIdentifiable Information” or (“PII”) means any information that could be usedto uniquely identify, locate, or contact a single person (or potentially beexploited to steal the identity of an individual, commit fraud or perpetuateother crimes). Examples of PII include personal telephone 

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

1

----

 

numbers, social securitynumbers, national, state or province, issued identification number, driverslicense number, date of birth, bank account numbers, credit card numbers andexpiration dates, and other credit related information, PINs, passwords,passcodes, password hint answers, Protected Health Information as defined bythe Health Insurance Portability and Accountability Act (HIPAA), biometricdata, digitized signatures, and background check details.

 

**In accordance with the foregoing, Supplier shall:**

 

**SystemSecurity**

 
| 1.                                                                   |   | Actively monitor industry resources (e.g. www.cert.org, pertinent  software vendor mailing lists & websites) for timely notification of  all applicable security alerts pertaining to Supplier networks and computers.                                                                              |
|----------------------------------------------------------------------|--------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2.                                                                   |   | Scan its externally-facing systems with applicable industry standard  security vulnerability scanning software (including, but not limited to,  network, server, & application scanning tools) at a minimum monthly.                                                                                |
| 3.                                                                   |   | Scan its internal systems with applicable industry standard security  vulnerability scanning software (including, but not limited to, network,  server, application & database scanning tools) at a minimum monthly.                                                                                |
| 4.                                                                   |   | Upon AT&T’s request, furnish to AT&T its most current  scanning results for those resources used to support AT&T.                                                                                                                                                                           |
| 5.                                                                   |   | Deploy an Intrusion Detection System(s) (IDS) in an active mode  of operation.                                                                                                                                                                                                                          |
| 6.                                                                   |   | Remediate security vulnerabilities, including, but not limited to,  those discovered through industry publications, vulnerability scanning, virus  scanning, and the review of security logs, and apply applicable security  patches in a timely manner, according to the following minimal guidelines:  If: |
|                                                                 |   | ·                                                                                                                                                                                                                                                                                                       | A vulnerability exists and attack is underway: Supplier shall work on  remediating/patching 24x7 |
|                                                                 |   | ·                                                                                                                                                                                                                                                                                                       | A vulnerability exists and attack is determined to be imminent:  Supplier shall remediate/patch within seven (7) days |
|                                                                 |   | ·                                                                                                                                                                                                                                                                                                       | A vulnerability exists and attack is determined to not be imminent:  Supplier shall remediate/patch within thirty (30) days |
| All other security patches shall be applied within ninety (90) days. |
| 7.                                                                   |   | Assign security administration responsibilities for configuring host  operating systems to specific individuals.                                                                                                                                                                                             |
| 8.                                                                   |   | Ensure its security staff has reasonable and necessary experience in  information/network security.                                                                                                                                                                                                          |
| 9.                                                                   |   | Ensure all Supplier’s systems are and remain ‘hardened’ including,  but not limited to, removing or disabling unused network services (e.g.  finger, rlogin, ftp, simple tcp/ip services) and installing a system  firewall, TCP Wrappers or similar technology.                              |
| 10.                                                                  |   | Change all default account names and/or default passwords in  accordance with password requirements as set forth within requirement number  35, below.                                                                                                                                                       |
| 11.                                                                  |   | Limit system administrator/root access to host operating systems only  to individuals requiring high-level access in the performance of their jobs.                                                                                                                                                          |
| 12.                                                                  |   | Require system administrators to restrict access by users to only the  commands, data and systems necessary to perform authorized functions.                                                                                                                                                                 |
|  

**Physical Security**

** **                            |
| 13.                                                                  |   | Ensure all Supplier’s networks and computers are located in secure  physical facilities with limited and restricted access by authorized  individuals only.                                                                                                                                             |

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

2

----

 
| 14.                  |   | Monitor and record, for audit purposes, access to the physical  facilities containing networks and computers used in connection with  Supplier’s performance of its obligations under this Agreement.                                                                                                  |
|----------------------|--------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                 |   |                                                                                                                                                                                                                                                                                                        |
| **Network Security** |
| ** **           |
| 15.                  |   | Separate  AT&T’s data from the Internet and the destination web servers with  a perimeter security gateway (e.g. firewall). For additional clarification of  this requirement, see diagram, however, the written requirements shall  control with respect to the interpretation of this provision. |
|                 |   |                                                                                                                                                                                                                                                                                                        |
|                      |
|                 |
| 16.                  |   | Upon AT&T’s request, provide to AT&T a logical network  diagram detailing the Information Resources (including, but not limited to  firewalls, servers, etc) that will support AT&T.                                                                                                       |
| 17.                  |   | Have a process and controls in place to detect and handle  unauthorized attempts to access AT&T data.                                                                                                                                                                                                   |
| 18.                  |   | Utilize strong encryption technologies (minimum 256-bit encryption)  for the transfer of AT&T Information outside AT&T controlled  facilities and network. This also applies to electronically transmitted email  communications containing proprietary AT&T data or Information.               |
| 19.                  |   | Utilize strong authentication (e.g. two factor token or digital  certificates) for remote access.                                                                                                                                                                                                           |

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

3

----

 
| **Information Security** |
|--------------------------|
| ** **               |
| 20.                      |   | Not co-locate AT&T’s application/data on the same  physical servers with other customers’ or Supplier’s own application/data  unless approved in advance in writing by AT&T. If physical separation  does not exist, documented controls must be in place and approved by AT&T  to ensure separation of data and security of Information between customer,  supplier, and AT&T applications. |
|                     |   | eWFM is a scheduling application that managed the agent  schedules.  Verint is Supplier’s call recording system, and there are on  separate servers, by client.  EDW, is Supplier’s data warehouse.Supplier has  logical controls around database access with specific group memberships  permitting access only to StarTek’s DBAs.  EDW is in SOX scope requiring  regular reviews and is also governed by Change Control for any changes that  need to be made or transactions that would need to be run at the database  level.  The process that surrounds the EDW is as follows.  Only  technical (IT) people “who require such database access” can gain access to  the EDW.  This access has to be approved by Supplier’s VP of Technology  Operations prior to access being granted.  Once approved, the individual  is assigned specific access based on the necessary requirements to perform  their jobs. |
| 21.                      |   | Have a procedure approved in advance in writing by AT&T for the  backup, secure transport and storage of AT&T Information. |
| 22.                      |   | Maintain and furnish to AT&T a business continuity plan that  ensures Supplier can meet its contractual obligations under the Agreement,  including the requirements of any applicable Statement of Work or Service  Level Agreement. |
| 23.                      |   | Store sensitive AT&T data elements utilizing strong encryption  technologies (minimum 256-bit encryption). Sensitive data elements include,  but are not limited to, the following: social security number, national,  state or province, issued identification number, drivers license number, date  of birth, bank account number, credit card number and expiration date, and  other credit related information, PINs, passwords, passcodes, password hint  answers, Protected Health Information as defined by the Health Insurance  Portability and Accountability Act, HIPAA, biometric data, digitized  signature, and background check details. |
| 24.                      |   | Limit access to AT&T Information, including paper hard copies,  only to persons or systems authorized by AT&T under written agreement. |
| 25.                      |   | Be compliant with any applicable government and industry mandated  information security requirements including, but not limited to the Payment  Card Industry- Data Security Standards (PCI) and HIPAA. |
| 26.                      |   | Retain records according to and in compliance with any applicable  federal, state, local and foreign laws, ordinances, regulations and/or codes,  and as otherwise directed by AT&T, for a period of no less than three  (3) years, or longer as may be set forth herein or as may be required  pursuant to a court order or civil or regulatory proceeding. |
| 27.                      |   | Return all AT&T Information, including electronic and hard copies  within thirty (30) days upon the sooner of: (a) expiration or  termination of the Agreement; (b) AT&T’s request for the return of  Information; or (c) when Supplier (or its suppliers or representatives)  no longer need the Information. In the event AT&T approves the  destruction as an alternative to returning the Information, then Supplier  shall certify the destruction (e.g., degaussing, overwriting, performing a  secure erase, performing a chip erase, shredding, cutting, punching holes,  breaking) in a manner approved in advance in writing by AT&T. |

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

4

----

 
| 28.                                                                                                                                                                               |   | Unless otherwise instructed by AT&T, when collecting, generating  or creating Information for, through or on behalf of AT&T or the AT&T  brand, Supplier shall utilize the following AT&T proprietary marking:                                                                                                                                                                          |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                                                                                                              |   |                                                                                                                                                                                                                                                                                                                                                                                                    |
| **“AT&T Proprietary  Information (Internal Use Only)**

 

Not for use or disclosure  outside the AT&T companies

 

except under written  agreement” |
|                                                                                                                                                                              |   |                                                                                                                                                                                                                                                                                                                                                                                                    |
| **Identification and  Authentication**                                                                                                                                            |
| ** **                                                                                                                                                                        |
| 29.                                                                                                                                                                               |   | Assign unique userids to individual users.                                                                                                                                                                                                                                                                                                                                                              |
| 30.                                                                                                                                                                               |   | Have and utilize a documented Userid Lifecycle Management process  including procedures for approved account creation, timely account removal,  and account modification (e.g. changes to privileges, span of access,  functions/roles) for all applications and across all environments  (production, test, development, etc).                                                                         |
| 31.                                                                                                                                                                               |   | Enforce the rule of least privilege (i.e. limiting access to only the commands and Information necessary  to perform authorized functions according to one’s job function).                                                                                                                                                                                                                   |
| 32.                                                                                                                                                                               |   | Limit failed login attempts to no more than six successive attempts  and lock the user account upon reaching that limit. Access to the user  account can subsequently be reactivated through a manual process requiring  verification of the user’s identity or, where such capability exists, can be  automatically reactivated after at least three minutes from the last failed  login attempt. |
| 33.                                                                                                                                                                               |   | Terminate interactive sessions that have been inactive for a  designated period of time, not to exceed fifteen (15) minutes.                                                                                                                                                                                                                                                                            |
| 34.                                                                                                                                                                               |   | Require password expiration at regular intervals not to exceed ninety  (90) days unless approved in advance and in writing by AT&T.                                                                                                                                                                                                                                                                 |
| 35.                                                                                                                                                                               |   | Use an AT&T-approved authentication method based on sensitivity  of Information. When passwords are used, they must meet these requirements:                                                                                                                                                                                                                                                        |
|                                                                                                                                                                              |   | ·                                                                                                                                                                                                                                                                                                                                                                                                  | Passwords must be a minimum of six  (6) characters in length. |
|                                                                                                                                                                              |   | ·                                                                                                                                                                                                                                                                                                                                                                                                  | Passwords must contain characters from at least  two (2) of these groupings: alpha, numeric, and special characters. |
|                                                                                                                                                                              |   | ·                                                                                                                                                                                                                                                                                                                                                                                                  | Password construction must be complex and not  contain names, dictionary words, combinations of words, or words with  substitutions of numbers for letters, e.g., s3cur1ty. |
|                                                                                                                                                                              |   | ·                                                                                                                                                                                                                                                                                                                                                                                                  | Passwords must not contain repeating or sequential  characters or numbers. |
|                                                                                                                                                                              |   | ·                                                                                                                                                                                                                                                                                                                                                                                                  | Passwords must not contain sequences of three  (3) or more characters from the USERID or system name. |
|                                                                                                                                                                              |   | ·                                                                                                                                                                                                                                                                                                                                                                                                  | The new password must not contain sequences of  three (3) or more characters from any of the previous four (4) passwords. |
|                                                                                                                                                                              |   | ·                                                                                                                                                                                                                                                                                                                                                                                                  | Passwords must not contain a sequence of two  (2) or more characters more than once, e.g., a12x12. |
|                                                                                                                                                                              |   | *Note: (Applications housing Restricted  Proprietary Information may require an authentication mechanism stronger than  passwords and the authentication mechanism must be approved by AT&T in  advance in writing. Examples of stronger authentication methods include  tokens, digital certificates, passphrase, and biometrics.)*                                                                |
| 36.                                                                                                                                                                               |   | Use a secure method for the conveyance of authentication credentials  (e.g. passwords) and authentication mechanisms (e.g. tokens or smart cards).                                                                                                                                                                                                                                                      |

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

5

----

 
| **Warning Banner**                    |
|---------------------------------------|
| ** **                            |
| 37.                                   |   | Display a warning or “no-trespassing” banner on applicable login  screens or pages when in Supplier’s environment and not an AT&T  Branded product or service. |
|                                  |   |   |
|                                  |   | **(example long version):** |
|                                  |   | ** ** |
|                                  |   | This is an <company name> system, restricted to authorized  individuals. This system is subject to monitoring. Unauthorized users,  access, and/or modification will be prosecuted. |
|                                  |   |   |
|                                  |   | **(example short version):** |
|                                  |   | ** ** |
|                                  |   | <company name> authorized use ONLY, subject to monitoring. All other  use prohibited. |
|                                  |   |   |
|                                  |   | For AT&T Branded products or services or for software developed  for AT&T, the Supplier shall display a warning banner on login screens or  pages as provided by AT&T. |
|                                  |   |   |
| **Software and Data Integrity**       |
| ** **                            |
| 38.                                   |   | Scan for and promptly remove viruses. |
| 39.                                   |   | Separate non-production systems and data from production systems and  data. |
| 40.                                   |   | Have a documented software change control process including back out  procedures. |
| 41.                                   |   | Have database transaction logging features enabled and retain database  transaction logs for a minimum of six (6) months. |
|                                  |   | eWFM is not in scope for SOX therefore no database logging is  required.  Supplier has logical controls around database access with  specific group memberships permitting access only to StarTek’s DBAs.   EDW is in SOX scope requiring regular reviews and is also governed by Change  Control for any changes that need to be made or transactions that would need  to be run at the database level.  The process that surrounds the EDW is  as follows.  Only technical (IT) people “who require such database  access” can gain access to the EDW.  This access has to be approved by  Supplier’s VP of Technology Operations prior to access being granted.   Once approved, the individual is assigned specific access based on the necessary  requirements to perform their jobs.  While eWFM provides workforce  information, it is strictly a workforce management tool used for scheduling  agents.  EDW provides the metric and call data that is then used for  invoicing and billing back to the Client. |
| 42.                                   |   | Regarding software developed, used or furnished and/or supported  under this Agreement, review code for which Supplier has or is permitted  access, to find and remediate security vulnerabilities. |
| 43.                                   |   | Perform quality assurance testing for the application functionality  and security components (e.g. testing of authentication, authorization, and  accounting functions, as well as any other activity designed to validate the  security architecture). |
|                                  |   |   |
| **Privacy Issues**                    |
| ** **                            |
| 44.                                   |   | NOT publicly disclose, sell, rent, lend, trade or  lease any AT&T Information (including, Information obtained on AT&T’s  behalf). |
| 45.                                   |   | Restrict access to any Personally Identifiable Information to  authorized individuals. |
|                                  |   |   |
| **Monitoring and Auditing  Controls** |
| ** **                            |
| 46.                                   |   | Restrict access to security logs to authorized individuals. |
| 47.                                   |   | Regularly review security logs for anomalies and document and resolve  all logged security problems in a timely manner. |
| 48.                                   |   | Keep security logs for a minimum of six (6) months. |

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

6

----

 
| 49.                                          |   | Provide, and hereby provides to AT&T audit rights to verify  Supplier’s compliance with its contractual obligations in connection with  these AT&T Supplier Information Security Requirements. Upon AT&T’s  request for audit, Supplier shall schedule an audit to commence within thirty  (30) days from such request. In the event AT&T, in its sole  discretion, deems a security breach has occurred, Supplier shall schedule the  audit to commence within one (1) day of AT&T’s notice requiring  an audit. This provision shall not be deemed to, and shall not limit any more  stringent audit obligations permitting the examination of Supplier’s records  contained in this Agreement. |
|----------------------------------------------|--------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 50.                                          |   | Provide AT&T within thirty (30) days from the publication of the  audit report identifying any noncompliance with the contractual security  requirements, a written report of completed or proposed corrective actions  and implementation timeframes unless otherwise stipulated herein, as soon as  possible, but not to exceed ninety (90) days addressing each noncompliance  found within the audit. Supplier shall provide periodic, at least monthly,  updates to AT&T on the implementation of the corrective action plan in  order to track the work to completion.                                                                                                                                                                     |
|                                         |   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| **Reporting Violations**                     |
| ** **                                   |
| 51.                                          |   | Have and utilize a documented procedure to follow when an  unauthorized intrusion or other security violation, including but not limited  to, a physical security or computer security incident (e.g. hacker or  attempted hacker activity or the introduction or attempted introduction of a  virus or malicious code), is suspected which includes immediate notification  to the AT&T Computer Security Incident Response Team (ACSIRT).                                                                                                                                                                                                                                                                                                          |
|                                         |   | ACSIRT 24 hour contact  information:                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
|                                         |   | ·  Phone:  1 866 466-2288, prompt 8 (U.S.)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
|                                         |   | ·  Phone:  1 908 234-3327 (International)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| 52.                                          |   | In addition to providing AT&T with immediate notice of any  security incident, provide AT&T with regular status updates including but  not limited to actions taken to resolve such incident, at four-hour intervals  (or at other mutually agreed intervals or times) for the duration of the  incident, and within five days of the closure of the incident, a written  report describing the incident, actions taken by the Supplier during its  response and the Supplier’s plans for future actions to prevent a similar  incident from occurring in the future.                                                                                                                                                                       |
|                                         |   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| **Software Development and  Implementation** |
| ** **                                   |
| 53.                                          |   | Ensure, prior to furnishing or development of software that such  software incorporates applicable AT&T security requirements.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| ** **                                   |
| **Interconnectivity**                        |
| ** **                                   |
| 54.                                          |   | Use only the AT&T Chief Security Office (CSO) approved facilities  and connection methodologies to interconnect AT&T’s data facilities with  Supplier’s data facilities and to provide access to the data for each  connection.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| 55.                                          |   | NOT establish interconnection to endpoint resources other than in the  United States. Interconnections to endpoint resources other than in the  United States require the express prior written consent of AT&T.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| 56.                                          |   | Permit limited access to Information Resources and the transmission  of Information only to those individuals necessary to carry out the intent  and purpose of the Agreement.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| 57.                                          |   | Maintain logs of user sessions (including application to application  sessions) involving access to AT&T. These logs must include: login  identification, user request records, system configuration, and timestamps  and/or duration of access. These logs must be retained for six  (6) months.                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| 58.                                          |   | Provide AT&T access to any Supplier facilities during normal  business hours for the maintenance and support of any AT&T equipment  (e.g. router) used for the transmission of Information under this Agreement.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

7

----

 
| 59.                                   |   | Use any AT&T equipment provided under this Agreement only for the  furnishing of those services explicitly defined in this Agreement.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
|---------------------------------------|--------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 60.                                   |   | Consent and hereby consents to AT&T’s gathering of information  relating to Supplier’s access to AT&T networks, processing systems and  applications. This information may be collected, retained and analyzed by AT&T  to identify potential security risks without further notice. This information  may include trace files, statistics, network addresses, and the actual data  or screens accessed or transferred.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| 61.                                   |   | Ensure that all Supplier interconnections to AT&T pass through  the designated AT&T perimeter security gateway (e.g. firewall)**.**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| 62.                                   |   | Ensure that Supplier interconnections to AT&T must terminate at a  perimeter security gateway (e.g. firewall) at the Supplier end of the  connection.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| 63.                                   |   | Consent and hereby provides advance consent to AT&T’s immediately  suspending or terminating any interconnection if AT&T, in its sole  discretion, believes there has been a breach of security or unauthorized  access to or misuse of AT&T data facilities or Information. (Notwithstanding  the foregoing, AT&T does not require Supplier’s consent to terminate in  whole or in part any connection if AT&T believes, in its sole discretion,  that disconnection is warranted.)                                                                                                                                                                                                                                                                                                                                                                                                                                     |
|                                  |   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| **Security Policies and  Procedures** |
| ** **                            |
| 64.                                   |   | Ensure that all personnel, subcontractors or representatives  performing work on any AT&T resources or the resources used to  interconnect to AT&T resources or the resources used to house AT&T or  AT&T Branded Information under this Agreement are in compliance with these  Information Security Requirements.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| 65.                                   |   | Notify AT&T of any policy changes that could impact the security  controls put in place to secure AT&T’s data.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| 66.                                   |   | Periodically review these Information Security Requirements to ensure  that Supplier is in compliance with the requirements.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| 67.                                   |   | Return all AT&T owned or provided access devices (including  SecurID tokens, information storage devices, software, and/or computer  equipment, as soon as practicable, but in no event more than fifteen (15)  business days after AT&T provides Supplier with specific, written  instructions for the return thereof (including without limitation the  destination for such return) following the sooner of: (a) expiration or  termination of the Agreement; (b) AT&T’s request for the return of  such property; or (c) when Supplier (or its suppliers or  representatives) no longer need such property. If AT&T fails to provide  such instructions within fifteen (15) business days after Supplier’s request  for such instructions, then all such tokens, devices, software, and equipment  shall be returned to the current AT&T Business Unit contact at the  location on file with Startek. |

 

**Proprietaryand Confidential**

ThisAgreement and information contained therein is not for use or disclosureoutside of AT&T, its Affiliates,and third party representatives, and Supplier except under writtenagreement by the contracting Parties.

 

8

----