EXHIBIT 10.9


 


Amendment


 


 


20070105.006.A.002


 


 


Between


 


 


StarTek, Inc.


 


 


And


 


 


AT&T Services, Inc.


 

















 


AMENDMENT NO. 2


 


AGREEMENT NO. 20070105.006.C


 


This
Amendment, effective on the date when signed by the last Party (“Effective Date”),
and amending Agreement No. 20070105.006.C, is by and
between StarTek, Inc., a Delaware corporation (“Supplier”), and AT&T
Services, Inc., a Delaware corporation (“AT&T”), each of which may be
referred to in the singular as a “Party” or in the plural as the “Parties.”


 


WITNESSETH


 


WHEREAS, Supplier and AT&T entered into
Agreement No. 20070105.006.C on January 26, 2007 (the “Agreement”);
and


 


WHEREAS, Supplier and AT&T desire to amend the
Agreement as hereinafter set forth.


 


NOW, THEREFORE, in consideration of the
premises and the covenants hereinafter contained, the Parties hereto agree as
follows:


 


1)              Section 2.0 “Definitions”, is hereby amended as
follows:


 


a.
Sub-section 2.11, “Information”,
is hereby deleted in its entirely and replaced with the following:


 


“Information”, with respect to a Party, means all
confidential, proprietary or trade secret information belonging to such Party,
including discoveries, ideas, concepts, know-how, techniques, processes,
procedures, designs, specifications, strategic information, proposals, requests
for proposals, proposed products, drawings, blueprints, tracings, diagrams,
models, samples, flow charts, data, computer programs, marketing plans,
customer information, employee personal information, health or financial
information, authentication credentials, and other technical, financial or
business information, whether disclosed in writing, orally, visually, in
tangible or intangible form, including in electronic mail or by other
electronic communication.


 


b.
Sub-section 2.19, “Services”, is
deleted in is entirety and replaced with the following:


 


“Service(s)” means any labor or service
provided pursuant to this Agreement or an applicable Order, including, but not
limited to, engineering, installation, removal, maintenance, training, technical
support, repair and Call Center Services. 
The term “Service” 


 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


1

















 


shall
also include any Material, including any Documentation, provided by Supplier
pursuant to this Agreement or an applicable Order in connection with providing
the Services. For the sake of clarity, Services (including Call Center
Services) specifically excludes consulting and
professional services whereby enhancements, modifications or any development
activities related to software will occur (i.e., development of customized
software).


 


c.
Sub-section 2.23, “Deliverables”,
is hereby added to the Agreement and is fully incorporated therein by this
reference:


 


“Deliverables” means any and all
deliverables set forth in an Order to be provided by Supplier pursuant to such
Order. Deliverables include, but are not limited to, any reports, data,
designs, plans, specifications, models, prototypes, performance requirements,
and/or Documentation delivered pursuant to this Agreement or such Order.


 


2)              The Section 3.37, “Title to Work Product”, is hereby
deleted in its entirety and is replaced with the following, “Ownership of Work Product”:


 


3.37 Ownership of
Work Product


 


Supplier’s Intellectual Property. The Parties acknowledge that Supplier and/or third-parties own certain
intellectual property, including pre-existing or independently developed
Materials, software, processes, tools, methodologies and other intellectual
property used to create the Work Product (the “Supplier’s IP”).  The notion of “independently developed”
refers to development performed outside of this Agreement without use of or
access to any Information provided by or on behalf of AT&T.  Something that is independently developed
remains Supplier’s IP, even though Supplier may use it in connection with
providing Services.  AT&T makes no
claim to such Supplier’s IP which is not defined in or to be delivered pursuant
to this Agreement or in an applicable Order.


 


Work Product.  Excluding
the Supplier’s IP and Supplier’s Information, ownership and all rights in the
work product resulting from or is the outcome produced as a result of the
Services or Call Center Services set forth in an Order (“Work Product”)
including new trademarks, patents, copyrights, and trade secrets applicable to
same, hereby vests exclusively in AT&T regardless of whether Work Product
was created solely by Supplier or jointly by the Parties.  The Parties expressly agree to consider as a “work
made for hire” any Work Product which qualifies as such under the laws of the
United States or other jurisdictions.  To
the extent that the Work Product does not qualify as a “work made for hire”, or
where necessary for any other reason to perfect the rights of AT&T
thereto,  Supplier hereby assigns to
AT&T all right, title and interest thereto. 
Supplier agrees to provide other assistance, at AT&T’s expense,
which AT&T may need through trademark, patent or copyright applications, or
otherwise, to obtain the full benefit of the rights provided for herein, and
will execute all documents necessary to carry such assignment into full
effect.    NOTE:
The notion of “work 


 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


2

















 


product”
refers to a deliverable or outcome that must be produced to complete a project
and achieve its objectives (See definition
at BusinessDictionary.com)


 


License.  If the Work
Product contains Supplier’s IP or other elements Supplier or others on its
behalf previously or independently developed, then Supplier grants to AT&T,
or agrees to obtain for AT&T, a non-exclusive, unrestricted, perpetual,
worldwide, royalty-free license to use, copy, modify, distribute, publicly
display, publicly perform, import, manufacture, have made, sell, offer to sell
(whether directly or through channels of distribution), exploit and sublicense
such elements (and have others do any of the foregoing acts on AT&T’s
behalf) to the extent necessary for AT&T to exercise its rights in the Work
Product.  Any such license shall include
AT&T’s right to grant an unrestricted, royalty-free sublicense to its
Affiliates for the purposes stated herein.


 


Miscellaneous. 
Supplier shall place a copyright or other proprietary notice on the Work
Product at AT&T’s request.  All
non-public aspects of the Work Product shall constitute AT&T’s Information
under this Agreement.


 


Reservation of Rights and Residuals.  Except as otherwise expressly provided in
this Section entitled “Ownership of Work Product,”
Supplier retains all right, title, and interest in and to all Supplier’s IP and
Supplier’s Information. The Parties agree that either Party may use, without an
obligation to the other Party,  any
general knowledge and expertise, skills, techniques, concepts or know-how
incidentally (and not intentionally) retained in the unaided memory of the
Party’s employees to develop or provide similar services for other customers,
provided that such use is without reference to the other Party’s
Information.  No license is granted under
this Section by either Party to the other Party for any patent, trademark,
Work Product, trade secret or copyright.


 


3)              The following Section 4.19, “Payment
Card Industry (PCI) Data Security Standards and Credit Card Information”,
is hereby added to the Agreement and is fully incorporated therein by this
reference:


 


Section 4.19, “Payment Card Industry (PCI) Data Security Standards and Credit Card Information


 


The
Payment Card Industry (PCI) data security standards are network security and
business practice guidelines developed for Visa, MasterCard, American Express
and Discover Card. They were developed to establish a minimum security standard
with regards to the protection of cardholder’s account and transaction
information. The PCI Security Standards Council, LLC (a non-AT&T entity)
owns, develops, maintains and distributes the PCI Data Security Standard (DSS).
If Supplier (including its subcontractor, agent or any third party, acting
through, or on behalf of Supplier) collects, processes, handles, and/or
maintains credit card data and/or related transaction status or identity
information through, for, or on behalf of 


 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


3

















 


AT&T
(including, without limitation, for itself, or in connection with AT&T’s
joint or co-branded relationships and/or its, or their customers, as the case
may be), Supplier represents and warrants that it is, and shall remain PCI DSS
compliant, including, but not limited to being, DSS certified, current and in
good standing, if applicable, at no cost to AT&T, for the longer of the
term of this Agreement or any of Supplier’s applicable obligation periods under
this Agreement, in accordance with the requirements of the PCI DSS.
Notwithstanding anything to the contrary contained within the clause entitled
Information or any other provision within this Agreement, Supplier acknowledges
that credit card information shall be deemed, 
and shall be treated as
Information under this Agreement irrespective of whether or not such
Information is conspicuously marked as confidential or proprietary and Supplier’s
obligation to treat credit card related Information as confidential shall
survive the Termination, Cancellation or expiration of this Agreement. Supplier
shall indemnify and hold AT&T harmless from and against any proved or
alleged claims, demands or suits, or any losses, damages, liabilities, fines,
penalties and expenses (including reasonable attorney’s fees) that arise out
of, relate to or result from Supplier’s (and/or its subcontractor, agent or any
third party, if any, acting through or on behalf of Supplier) failure to comply
with its obligations under this clause. Except as may be provided elsewhere in
this Agreement, nothing contained within this clause shall be construed to
mean, or means that Supplier is authorized to delegate, assign or subcontract
any portion of its obligations under this clause to any third party.


 


4)              The following Section 4.20, “Worker’s
Exit Process from AT&T’s Program(s)”, is hereby added to the
Agreement and is fully incorporated therein by this reference:


 


“4.20 Worker’s Exit Process from AT&T’s Program(s)


 


“Workers” Exit Process from AT&T’s
Program(s).  If the Work is transitioning
to another AT&T program, some of these provisions may not apply.


 


a.               Upon Worker’s completion of
Services, including
attrition of Worker, dismissal of Worker, and program expiration or
termination, Supplier shall:


 


·                  Immediately notify AT&T’s Hiring/Program Manager
and identify the Worker(s) so the applicable attuid can be deleted.


·                  Ensure that Worker’s critical knowledge as to the
performance of Services is transferred via training of other Worker(s) and/or
documented.


·                  Ensure that any roles assigned to the Worker are
appropriately reassigned, such as:


 


·                  Project team/committee member


·                  Functional representative for
internal/external interfaces


 


·                  Advise the AT&T
Hiring/Program Manager if a security clearance exists.


·                  Advise the
AT&T Contract Manager, as applicable, if there is reason to believe the
Worker should not be engaged for future assignments.


 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


4

















 


·                  Remind the
Workers of their obligation to maintain confidentiality of AT&T proprietary
information.


·                  Perform an inventory of
AT&T records (paper and electronic) in Worker’s office or telework/virtual
office and arrange for appropriate retention or destruction pursuant to an
Order or as directed by AT&T’s Hiring/Program Manager.


·                  Have
Worker establish “Out of Office” Voice Mail message and have the Supplier’s
Team Manager, or its delegate, review for appropriateness.


·                  If
a reservation or reservationless conference bridge is assigned to the Worker
for AT&T’s Program, Supplier’s Team Manager, or its delegate, shall ensure
that such reservation and reservationless conference bridges are cancelled.


·                  When
transition of Worker’s job responsibilities under an AT&T Program is
complete, Supplier Team Manager, or its delegate, requests cancellation of
other system / job specific UserIDs, access codes, and access privileges that
the Worker may have to support AT&T’s Programs, such as:


 


·                  Shared
drives (transfer ownership, if applicable)


·                  Financial
systems


·                  Data
warehouses


·                  Internet
and database services


·                  Digital
Certificates


·                  Other
systems


 


	
   

  	
  ·

  	
   

  	
   

  
	
   

  	
  ·

  	
   

  	
   

  
	
   

  	
  ·

  	
   

  	
   

  



 


·                  If reasonably possible to do
so, collect and return SecurID Card/Token to AT&T, if applicable.


 


NOTE:              At the same time, AT&T
shall promptly disable access to AT&T assets by means of such SecurID
Card/Token so that access cannot be achieved even if the SecurID Card/Token
cannot be collected.


 


·                  If
TACACS/Config service, applies, notify the AT&T Hiring/Program Manger to
delete TACACS/config server ID, if applicable.


·                  Recover and
secure AT&T assets, which may include AT&T assets, in Worker’s
possession (including those kept at the individual’s home):


 


·                  Personal
computers


·                  Software


·                  Monitors


·                  Modems


·                  Printers


 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


5

















 


·                  Fax
machines


·                  Speakers


·                  PDAs


·                  Pagers


·                  Cell
phones


 


·                  If
Workers used a non-Supplier PC or Supplier’s PC (collectively “PC”), Supplier
shall ensure that AT&T Proprietary information is cleaned off the PC by
having them re-imaged.


·                  Have Supplier
Team Manager, or its delegate, ensure that the office space of exiting Worker
is cleaned and ready for next occupant.


·                  If
Services are performed at remote locations, Supplier Team Manager, or its
delegate, ensures the following installed services are disconnected at Worker’s
location (home and/or other work location):


 


·                  Phone
lines


·                  DSL
lines


·                  Cable modem
connections


 


·                  If
Services are performed at Supplier Locations, Supplier Team Manager, or its
delegate, ensures the following services are disconnected:


 


·                  Office
Telephone


·                  Voice
Mail


·                  LAN Port


 


·                  Have Supplier
Team Manager, or its delegate, collect all property used for AT&T’s
Program(s). This includes but is not limited to:


 


·                  Worker’s
identification badges, portal passes, parking decals and passes, building
access cards, security ID cards, smart cards, key cards, toll pass cards


·                  Keys
to desks, file cabinets, storage cabinets, offices, conference rooms, and other
work areas


·                  Keys
to buildings, gates and vehicles used for AT&T’s Program(s)


·                  Other
equipment or property used for AT&T’s Program(s) not mentioned in
previous tasks, including any items that the Worker has at home or other remote
location, such as:


 


·                  Microphones,
video recorders, cameras and answering machines


·                  Manuals,
library materials, software, documentation for software and hardware


·                  Office
furniture (and keys to same) and artwork


·                  Special devices
(e.g., scanners, 2-way radios)


·                  Tools and
Uniforms


 


·                  Prepare
AT&T files for storage:


 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


6

















 


·                  Supplier
Team Manager, or its delegate, reviews office records for compliance with
AT&T’s retention schedule pursuant to an Order and as required by law, and
transfer active records with retention obligations to appropriate person or
group inheriting work function. For inactive records with retention
obligations, follow procedures for sending to off-site vendor storage.


·                  Material for which there is no retention obligation
or as may be required by law, can be destroyed in accordance with the Order or
as directed by AT&T’s Hiring/Program Manager.


 


b.                                 Obtain Worker’s
certification that Worker has returned or destroyed all physical and electronic
copies of AT&T proprietary information.


 


a.               Upon Worker’s completion of Services, including the
attrition of Worker, dismissal of Worker, and program expiration or
termination, Supplier shall use reasonable commercial efforts to cause such
Worker to complete and sign the “Written Certification of Return or Destruction
of AT&T Information or Data”, Appendix L.


 


b.              Supplier shall deliver either an executed copy of Appendix L to the AT&T Hiring/Program
Manager or a statement explaining why such copy cannot be provided, within five
(5) business days of completion of Services, and retain the original, if
any, to be placed in the Worker’s personal file as a permanent record, If such executed copy of Appendix L cannot be obtained, Supplier shall
nevertheless use reasonable commercial efforts to obtain .the
return of any AT&T Proprietary Information from the Worker and either
return the same to AT&T or destroy it.


 


5.)           The following Section 4.21
AT&T Supplier Information Security Requirements (SISR)”, is
hereby added to the Agreement and is fully incorporated therein by this
reference:


 


“Supplier
shall comply with the requirements of Appendix “O” entitled “AT&T Supplier
Information Security Requirements (SISR).”


 


6.)           The attached Appendix L — “Written
Certification of Return or Destruction of AT&T Information or Data”
is hereby added to the Agreement and fully incorporated therein by this
reference.


 


7.)          The attached Appendix O, “Supplier
Information Security Requirements (SISR)”, is hereby added to the
Agreement and fully incorporated therein by this reference.


 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


7

















 


The
terms and conditions of Agreement No. 20070105.006.C in all other respects
remain unmodified and in full force and effect.


 


The
Parties hereto acknowledge that they have read this Amendment, understand it,
and agree to be bound by its terms and conditions.  They further agree that Agreement No. 20070105.006.C
together with Amendment No. 20070105.006.A.001 and this Amendment No. 20070105.006.A.001
constitute the entire agreement between the Parties hereto with respect to the
subject matter hereof.


 


IN WITNESS WHEREOF, the Parties have caused
this Amendment to Agreement No. 20070105.006.C to be executed, which may
be in duplicate counterparts, each of which will be deemed to be an original
but all of which together will constitute only one instrument, as of the date
the last Party signs.


 


	
  StarTek, Inc.

  	
   

  	
  AT&T Services, Inc.

  
	
   

  	
   

  	
   

  
	
  By:

  	
  /s/ A. Laurence Jones

  	
   

  	
  By:

  	
  /s/ Michael De Palma

  
	
   

  	
   

  	
   

  	
   

  	
   

  
	
  Printed Name:

  	
  A. Laurence Jones

  	
   

  	
  Printed Name: Michael De Palma

  
	
   

  	
   

  	
   

  	
   

  
	
  Title:

  	
  President and CEO

  	
   

  	
  Title: Sourcing Director -
  Contact Centers and Marketing, AT&T Supply Chain Operations 

  
	
   

  	
   

  	
   

  
	
   

  	
   

  	
   

  	
   

  
	
   

  	
   

  	
   

  	
   

  
	
  Date:

  	
  4/14/09

  	
   

  	
  Date:

  	
  4/14/09

  



 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


8
















 


Appendix L


 


Written
Certification of Return or Destruction of AT&T Information or Data


 


Pursuant to the terms of
the Worker Agreement dated
                  
    , 20XX between me and [NAME OF
AT&T COMPANY] (“AT&T”), I hereby certify that I have
returned to AT&T or have destroyed all physical and electronic copies of
all Information, as that term is defined in the Worker Agreement.


 


 


	
   

  	
   

  
	
  [NAME AND ATTUID OF WORKER]

  	
   

  
	
   

  	
   

  
	
   

  	
   

  
	
  Signature

  	
   

  
	
   

  	
   

  
	
   

  	
   

  
	
  Date

  	
   

  



 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


1

















 


Appendix
O


 


Information
Security Policy


 


AT&T Supplier Information Security
Requirements


 


The
following AT&T Supplier Information Security Requirements apply to the
employees and/or temporary workers of Supplier and its suppliers,
contractors, vendors and/or agents, that perform services for, on behalf of,
and/or through AT&T, which require access to AT&T’s infrastructure,
systems or applications or handle, process, or store, AT&T, AT&T
Branded and/or AT&T Co-branded Information (for the purpose of this
Section, each or all “Supplier”). Supplier represents and warrants that during
the term of this Agreement and thereafter (as applicable with respect to
Supplier’s obligations under the Survival of Obligations and Compliance with
Laws clauses) Supplier is, and shall continue to be in compliance with its
obligations as set forth herein.” AT&T’s failure to audit and/or exercise
any of its rights under this Section shall not be construed or deemed to
be a waiver of any rights under this Agreement, equity or law. In addition to
all other remedies specified in the Agreement, Supplier agrees that AT&T
shall be entitled to seek an injunction and be reimbursed the costs (including
reasonable attorney’s fees) by Supplier to cease any breach of any obligation
that survives termination or expiration of this Agreement. The following
provisions shall not be deemed to, and shall not limit any more stringent
security or other obligations contained within this Agreement.


 


Definitions:


 


Unless
otherwise set forth or expanded herein, defined terms shall have the same
meaning as set forth in the main body of the Agreement.


 


“AT&T
Branded Information” means Information owned, labeled, marked, or collected,
which contains any of AT&T’s or its affiliates identifying markings or
trademarks.


 


“AT&T
Co-branded Information” means AT&T Branded Information that is jointly
marketed or shared under a co-branding arrangement with a Supplier,
irrespective of dominance or emphasis of the co-branding relationship.


 


As used herein, the term “Information”
is limited to:


 


(a)          The “Confidential
Information” to which the obligations in Section 3.16 of the Agreement
apply, and


(b)         The “Customer Information”
to which the obligations in Section 4.9 of the Agreement apply.


 


“Information
Resources” means any systems, applications, and network elements, and the
information stored, transmitted, or processed with these resources in
conjunction with supporting AT&T and/or utilized by Supplier in fulfillment
of its obligations under this Agreement.


 


“Personally
Identifiable Information” or (“PII”) means any information that could be used
to uniquely identify, locate, or contact a single person (or potentially be
exploited to steal the identity of an individual, commit fraud or perpetuate
other crimes). Examples of PII include personal telephone 


 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


1

















 


numbers, social security
numbers, national, state or province, issued identification number, drivers
license number, date of birth, bank account numbers, credit card numbers and
expiration dates, and other credit related information, PINs, passwords,
passcodes, password hint answers, Protected Health Information as defined by
the Health Insurance Portability and Accountability Act (HIPAA), biometric
data, digitized signatures, and 
background check details.


 


In accordance with the foregoing, Supplier shall:


 


System
Security


 


	
  1.

  	
   

  	
  Actively monitor industry resources (e.g. www.cert.org, pertinent
  software vendor mailing lists & websites) for timely notification of
  all applicable security alerts pertaining to Supplier networks and computers.

  
	
  2.

  	
   

  	
  Scan its externally-facing systems with applicable industry standard
  security vulnerability scanning software (including, but not limited to,
  network, server, & application scanning tools) at a minimum monthly.

  
	
  3.

  	
   

  	
  Scan its internal systems with applicable industry standard security
  vulnerability scanning software (including, but not limited to, network,
  server, application & database scanning tools) at a minimum monthly.

  
	
  4.

  	
   

  	
  Upon AT&T’s request, furnish to AT&T its most current
  scanning results for those resources used to support AT&T.

  
	
  5.

  	
   

  	
  Deploy an Intrusion Detection System(s) (IDS) in an active mode
  of operation.

  
	
  6.

  	
   

  	
  Remediate security vulnerabilities, including, but not limited to,
  those discovered through industry publications, vulnerability scanning, virus
  scanning, and the review of security logs, and apply applicable security
  patches in a timely manner, according to the following minimal guidelines:
  If:

  
	
   

  	
   

  	
  ·

  	
  A vulnerability exists and attack is underway: Supplier shall work on
  remediating/patching 24x7

  
	
   

  	
   

  	
  ·

  	
  A vulnerability exists and attack is determined to be imminent:
  Supplier shall remediate/patch within seven (7) days

  
	
   

  	
   

  	
  ·

  	
  A vulnerability exists and attack is determined to not be imminent:
  Supplier shall remediate/patch within thirty (30) days

  
	
  All other security patches shall be applied within ninety (90) days.

  
	
  7.

  	
   

  	
  Assign security administration responsibilities for configuring host
  operating systems to specific individuals.

  
	
  8.

  	
   

  	
  Ensure its security staff has reasonable and necessary experience in
  information/network security.

  
	
  9.

  	
   

  	
  Ensure all Supplier’s systems are and remain ‘hardened’ including,
  but not limited to, removing or disabling unused network services (e.g.
  finger, rlogin, ftp, simple tcp/ip services) and installing a system
  firewall, TCP Wrappers or similar technology.

  
	
  10.

  	
   

  	
  Change all default account names and/or default passwords in
  accordance with password requirements as set forth within requirement number
  35, below.

  
	
  11.

  	
   

  	
  Limit system administrator/root access to host operating systems only
  to individuals requiring high-level access in the performance of their jobs.

  
	
  12.

  	
   

  	
  Require system administrators to restrict access by users to only the
  commands, data and systems necessary to perform authorized functions.

  
	
   

  Physical Security

   

  
	
  13.

  	
   

  	
  Ensure all Supplier’s networks and computers are located in secure
  physical facilities with limited and restricted access by authorized
  individuals only.

  



 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


2

















 


	
  14.

  	
   

  	
  Monitor and record, for audit purposes, access to the physical
  facilities containing networks and computers used in connection with
  Supplier’s performance of its obligations under this Agreement.

  
	
   

  	
   

  	
   

  
	
  Network Security

  
	
   

  
	
  15.

  	
   

  	
  Separate
  AT&T’s data from the Internet and the destination web servers with
  a perimeter security gateway (e.g. firewall). For additional clarification of
  this requirement, see diagram, however, the written requirements shall
  control with respect to the interpretation of this provision.

  
	
   

  	
   

  	
   

  
	
  

  
	
   

  
	
  16.

  	
   

  	
  Upon AT&T’s request, provide to AT&T a logical network
  diagram detailing the Information Resources (including, but not limited to
  firewalls, servers, etc) that will support AT&T.

  
	
  17.

  	
   

  	
  Have a process and controls in place to detect and handle
  unauthorized attempts to access AT&T data.

  
	
  18.

  	
   

  	
  Utilize strong encryption technologies (minimum 256-bit encryption)
  for the transfer of AT&T Information outside AT&T controlled
  facilities and network. This also applies to electronically transmitted email
  communications containing proprietary AT&T data or Information.

  
	
  19.

  	
   

  	
  Utilize strong authentication (e.g. two factor token or digital
  certificates) for remote access.

  



 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


3

















 


	
  Information Security

  
	
   

  
	
  20.

  	
   

  	
  Not co-locate AT&T’s application/data on the same
  physical servers with other customers’ or Supplier’s own application/data
  unless approved in advance in writing by AT&T. If physical separation
  does not exist, documented controls must be in place and approved by AT&T
  to ensure separation of data and security of Information between customer,
  supplier, and AT&T applications.

  
	
   

  	
   

  	
  eWFM is a scheduling application that managed the agent
  schedules.  Verint is Supplier’s call recording system, and there are on
  separate servers, by client.  EDW, is Supplier’s data warehouse.  Supplier has
  logical controls around database access with specific group memberships
  permitting access only to StarTek’s DBAs.  EDW is in SOX scope requiring
  regular reviews and is also governed by Change Control for any changes that
  need to be made or transactions that would need to be run at the database
  level.  The process that surrounds the EDW is as follows.  Only
  technical (IT) people “who require such database access” can gain access to
  the EDW.  This access has to be approved by Supplier’s VP of Technology
  Operations prior to access being granted.  Once approved, the individual
  is assigned specific access based on the necessary requirements to perform
  their jobs.

  
	
  21.

  	
   

  	
  Have a procedure approved in advance in writing by AT&T for the
  backup, secure transport and storage of AT&T Information.

  
	
  22.

  	
   

  	
  Maintain and furnish to AT&T a business continuity plan that
  ensures Supplier can meet its contractual obligations under the Agreement,
  including the requirements of any applicable Statement of Work or Service
  Level Agreement.

  
	
  23.

  	
   

  	
  Store sensitive AT&T data elements utilizing strong encryption
  technologies (minimum 256-bit encryption). Sensitive data elements include,
  but are not limited to, the following: social security number, national,
  state or province, issued identification number, drivers license number, date
  of birth, bank account number, credit card number and expiration date, and
  other credit related information, PINs, passwords, passcodes, password hint
  answers, Protected Health Information as defined by the Health Insurance
  Portability and Accountability Act, HIPAA, biometric data, digitized
  signature, and background check details.

  
	
  24.

  	
   

  	
  Limit access to AT&T Information, including paper hard copies,
  only to persons or systems authorized by AT&T under written agreement.

  
	
  25.

  	
   

  	
  Be compliant with any applicable government and industry mandated
  information security requirements including, but not limited to the Payment
  Card Industry- Data Security Standards (PCI) and HIPAA.

  
	
  26.

  	
   

  	
  Retain records according to and in compliance with any applicable
  federal, state, local and foreign laws, ordinances, regulations and/or codes,
  and as otherwise directed by AT&T, for a period of no less than three
  (3) years, or longer as may be set forth herein or as may be required
  pursuant to a court order or civil or regulatory proceeding.

  
	
  27.

  	
   

  	
  Return all AT&T Information, including electronic and hard copies
  within thirty (30) days upon the sooner of: (a) expiration or
  termination of the Agreement; (b) AT&T’s request for the return of
  Information; or (c) when Supplier (or its suppliers or representatives)
  no longer need the Information. In the event AT&T approves the
  destruction as an alternative to returning the Information, then Supplier
  shall certify the destruction (e.g., degaussing, overwriting, performing a
  secure erase, performing a chip erase, shredding, cutting, punching holes,
  breaking) in a manner approved in advance in writing by AT&T.

  



 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


4

















 


	
  28.

  	
   

  	
  Unless otherwise instructed by AT&T, when collecting, generating
  or creating Information for, through or on behalf of AT&T or the AT&T
  brand, Supplier shall utilize the following AT&T proprietary marking:

  
	
   

  	
   

  	
   

  
	
  “AT&T Proprietary
  Information (Internal Use Only)

   

  Not for use or disclosure
  outside the AT&T companies

   

  except under written
  agreement”

  
	
   

  	
   

  	
   

  
	
  Identification and
  Authentication

  
	
   

  
	
  29.

  	
   

  	
  Assign unique userids to individual users.

  
	
  30.

  	
   

  	
  Have and utilize a documented Userid Lifecycle Management process
  including procedures for approved account creation, timely account removal,
  and account modification (e.g. changes to privileges, span of access,
  functions/roles) for all applications and across all environments
  (production, test, development, etc).

  
	
  31.

  	
   

  	
  Enforce the rule of least privilege (i.e. limiting access to only the commands and Information necessary
  to perform authorized functions according to one’s job function).

  
	
  32.

  	
   

  	
  Limit failed login attempts to no more than six successive attempts
  and lock the user account upon reaching that limit. Access to the user
  account can subsequently be reactivated through a manual process requiring
  verification of the user’s identity or, where such capability exists, can be
  automatically reactivated after at least three minutes from the last failed
  login attempt.

  
	
  33.

  	
   

  	
  Terminate interactive sessions that have been inactive for a
  designated period of time, not to exceed fifteen (15) minutes.

  
	
  34.

  	
   

  	
  Require password expiration at regular intervals not to exceed ninety
  (90) days unless approved in advance and in writing by AT&T.

  
	
  35.

  	
   

  	
  Use an AT&T-approved authentication method based on sensitivity
  of Information. When passwords are used, they must meet these requirements:

  
	
   

  	
   

  	
  ·

  	
  Passwords must be a minimum of six
  (6) characters in length.

  
	
   

  	
   

  	
  ·

  	
  Passwords must contain characters from at least
  two (2) of these groupings: alpha, numeric, and special characters.

  
	
   

  	
   

  	
  ·

  	
  Password construction must be complex and not
  contain names, dictionary words, combinations of words, or words with
  substitutions of numbers for letters, e.g., s3cur1ty.

  
	
   

  	
   

  	
  ·

  	
  Passwords must not contain repeating or sequential
  characters or numbers.

  
	
   

  	
   

  	
  ·

  	
  Passwords must not contain sequences of three
  (3) or more characters from the USERID or system name.

  
	
   

  	
   

  	
  ·

  	
  The new password must not contain sequences of
  three (3) or more characters from any of the previous four (4) passwords.

  
	
   

  	
   

  	
  ·

  	
  Passwords must not contain a sequence of two
  (2) or more characters more than once, e.g., a12x12.

  
	
   

  	
   

  	
  Note: (Applications housing Restricted
  Proprietary Information may require an authentication mechanism stronger than
  passwords and the authentication mechanism must be approved by AT&T in
  advance in writing. Examples of stronger authentication methods include
  tokens, digital certificates, passphrase, and biometrics.)

  
	
  36.

  	
   

  	
  Use a secure method for the conveyance of authentication credentials
  (e.g. passwords) and authentication mechanisms (e.g. tokens or smart cards).

  



 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


5

















 


	
  Warning Banner

  
	
   

  
	
  37.

  	
   

  	
  Display a warning or “no-trespassing” banner on applicable login
  screens or pages when in Supplier’s environment and not an AT&T
  Branded product or service.

  
	
   

  	
   

  	
   

  
	
   

  	
   

  	
  (example long version):

  
	
   

  	
   

  	
   

  
	
   

  	
   

  	
  This is an <company name> system, restricted to authorized
  individuals. This system is subject to monitoring. Unauthorized users,
  access, and/or modification will be prosecuted.

  
	
   

  	
   

  	
   

  
	
   

  	
   

  	
  (example short version):

  
	
   

  	
   

  	
   

  
	
   

  	
   

  	
  <company name> authorized use ONLY, subject to monitoring. All other
  use prohibited.

  
	
   

  	
   

  	
   

  
	
   

  	
   

  	
  For AT&T Branded products or services or for software developed
  for AT&T, the Supplier shall display a warning banner on login screens or
  pages as provided by AT&T.

  
	
   

  	
   

  	
   

  
	
  Software and Data Integrity

  
	
   

  
	
  38.

  	
   

  	
  Scan for and promptly remove viruses.

  
	
  39.

  	
   

  	
  Separate non-production systems and data from production systems and
  data.

  
	
  40.

  	
   

  	
  Have a documented software change control process including back out
  procedures.

  
	
  41.

  	
   

  	
  Have database transaction logging features enabled and retain database
  transaction logs for a minimum of six (6) months.

  
	
   

  	
   

  	
  eWFM is not in scope for SOX therefore no database logging is
  required.  Supplier has logical controls around database access with
  specific group memberships permitting access only to StarTek’s DBAs. 
  EDW is in SOX scope requiring regular reviews and is also governed by Change
  Control for any changes that need to be made or transactions that would need
  to be run at the database level.  The process that surrounds the EDW is
  as follows.  Only technical (IT) people “who require such database
  access” can gain access to the EDW.  This access has to be approved by
  Supplier’s VP of Technology Operations prior to access being granted. 
  Once approved, the individual is assigned specific access based on the necessary
  requirements to perform their jobs.  While eWFM provides workforce
  information, it is strictly a workforce management tool used for scheduling
  agents.  EDW provides the metric and call data that is then used for
  invoicing and billing back to the Client.

  
	
  42.

  	
   

  	
  Regarding software developed, used or furnished and/or supported
  under this Agreement, review code for which Supplier has or is permitted
  access, to find and remediate security vulnerabilities.

  
	
  43.

  	
   

  	
  Perform quality assurance testing for the application functionality
  and security components (e.g. testing of authentication, authorization, and
  accounting functions, as well as any other activity designed to validate the
  security architecture).

  
	
   

  	
   

  	
   

  
	
  Privacy Issues

  
	
   

  
	
  44.

  	
   

  	
  NOT publicly disclose, sell, rent, lend, trade or
  lease any AT&T Information (including, Information obtained on AT&T’s
  behalf).

  
	
  45.

  	
   

  	
  Restrict access to any Personally Identifiable Information to
  authorized individuals.

  
	
   

  	
   

  	
   

  
	
  Monitoring and Auditing
  Controls

  
	
   

  
	
  46.

  	
   

  	
  Restrict access to security logs to authorized individuals.

  
	
  47.

  	
   

  	
  Regularly review security logs for anomalies and document and resolve
  all logged security problems in a timely manner.

  
	
  48.

  	
   

  	
  Keep security logs for a minimum of six (6) months.

  



 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


6

















 


	
  49. 

  	
   

  	
  Provide, and hereby provides to AT&T audit rights to verify
  Supplier’s compliance with its contractual obligations in connection with
  these AT&T Supplier Information Security Requirements. Upon AT&T’s
  request for audit, Supplier shall schedule an audit to commence within thirty
  (30) days from such request. In the event AT&T, in its sole
  discretion, deems a security breach has occurred, Supplier shall schedule the
  audit to commence within one (1) day of AT&T’s notice requiring
  an audit. This provision shall not be deemed to, and shall not limit any more
  stringent audit obligations permitting the examination of Supplier’s records
  contained in this Agreement.

  
	
  50.

  	
   

  	
  Provide AT&T within thirty (30) days from the publication of the
  audit report identifying any noncompliance with the contractual security
  requirements, a written report of completed or proposed corrective actions
  and implementation timeframes unless otherwise stipulated herein, as soon as
  possible, but not to exceed ninety (90) days addressing each noncompliance
  found within the audit. Supplier shall provide periodic, at least monthly,
  updates to AT&T on the implementation of the corrective action plan in
  order to track the work to completion.

  
	
   

  	
   

  	
   

  
	
  Reporting Violations

  
	
   

  
	
  51.

  	
   

  	
  Have and utilize a documented procedure to follow when an
  unauthorized intrusion or other security violation, including but not limited
  to, a physical security or computer security incident (e.g. hacker or
  attempted hacker activity or the introduction or attempted introduction of a
  virus or malicious code), is suspected which includes immediate notification
  to the AT&T Computer Security Incident Response Team (ACSIRT).

  
	
   

  	
   

  	
  ACSIRT 24 hour contact
  information:

  
	
   

  	
   

  	
  ·  Phone:
  1 866 466-2288, prompt 8 (U.S.)

  
	
   

  	
   

  	
  ·  Phone:
  1 908 234-3327 (International)

  
	
  52.

  	
   

  	
  In addition to providing AT&T with immediate notice of any
  security incident, provide AT&T with regular status updates including but
  not limited to actions taken to resolve such incident, at four-hour intervals
  (or at other mutually agreed intervals or times) for the duration of the
  incident, and within five days of the closure of the incident, a written
  report describing the incident, actions taken by the Supplier during its
  response and the Supplier’s plans for future actions to prevent a similar
  incident from occurring in the future.

  
	
   

  	
   

  	
   

  
	
  Software Development and
  Implementation

  
	
   

  
	
  53.

  	
   

  	
  Ensure, prior to furnishing or development of software that such
  software incorporates applicable AT&T security requirements.

  
	
   

  
	
  Interconnectivity

  
	
   

  
	
  54.

  	
   

  	
  Use only the AT&T Chief Security Office (CSO) approved facilities
  and connection methodologies to interconnect AT&T’s data facilities with
  Supplier’s data facilities and to provide access to the data for each
  connection.

  
	
  55.

  	
   

  	
  NOT establish interconnection to endpoint resources other than in the
  United States. Interconnections to endpoint resources other than in the
  United States require the express prior written consent of AT&T.

  
	
  56.

  	
   

  	
  Permit limited access to Information Resources and the transmission
  of Information only to those individuals necessary to carry out the intent
  and purpose of the Agreement.

  
	
  57.

  	
   

  	
  Maintain logs of user sessions (including application to application
  sessions) involving access to AT&T. These logs must include: login
  identification, user request records, system configuration, and timestamps
  and/or duration of access. These logs must be retained for six
  (6) months.

  
	
  58.

  	
   

  	
  Provide AT&T access to any Supplier facilities during normal
  business hours for the maintenance and support of any AT&T equipment
  (e.g. router) used for the transmission of Information under this Agreement.

  



 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


7

















 


	
  59.

  	
   

  	
  Use any AT&T equipment provided under this Agreement only for the
  furnishing of those services explicitly defined in this Agreement.

  
	
  60.

  	
   

  	
  Consent and hereby consents to AT&T’s gathering of information
  relating to Supplier’s access to AT&T networks, processing systems and
  applications. This information may be collected, retained and analyzed by AT&T
  to identify potential security risks without further notice. This information
  may include trace files, statistics, network addresses, and the actual data
  or screens accessed or transferred.

  
	
  61.

  	
   

  	
  Ensure that all Supplier interconnections to AT&T pass through
  the designated AT&T perimeter security gateway (e.g. firewall).

  
	
  62.

  	
   

  	
  Ensure that Supplier interconnections to AT&T must terminate at a
  perimeter security gateway (e.g. firewall) at the Supplier end of the
  connection.

  
	
  63.

  	
   

  	
  Consent and hereby provides advance consent to AT&T’s immediately
  suspending or terminating any interconnection if AT&T, in its sole
  discretion, believes there has been a breach of security or unauthorized
  access to or misuse of AT&T data facilities or Information. (Notwithstanding
  the foregoing, AT&T does not require Supplier’s consent to terminate in
  whole or in part any connection if AT&T believes, in its sole discretion,
  that disconnection is warranted.)

  
	
   

  	
   

  	
   

  
	
  Security Policies and
  Procedures

  
	
   

  
	
  64.

  	
   

  	
  Ensure that all personnel, subcontractors or representatives
  performing work on any AT&T resources or the resources used to
  interconnect to AT&T resources or the resources used to house AT&T or
  AT&T Branded Information under this Agreement are in compliance with these
  Information Security Requirements.

  
	
  65.

  	
   

  	
  Notify AT&T of any policy changes that could impact the security
  controls put in place to secure AT&T’s data.

  
	
  66.

  	
   

  	
  Periodically review these Information Security Requirements to ensure
  that Supplier is in compliance with the requirements.

  
	
  67.

  	
   

  	
  Return all AT&T owned or provided access devices (including
  SecurID tokens, information storage devices, software, and/or computer
  equipment, as soon as practicable, but in no event more than fifteen (15)
  business days after AT&T provides Supplier with specific, written
  instructions for the return thereof (including without limitation the
  destination for such return) following the sooner of: (a) expiration or
  termination of the Agreement; (b) AT&T’s request for the return of
  such property; or (c) when Supplier (or its suppliers or
  representatives) no longer need such property. If AT&T fails to provide
  such instructions within fifteen (15) business days after Supplier’s request
  for such instructions, then all such tokens, devices, software, and equipment
  shall be returned to the current AT&T Business Unit contact at the
  location on file with Startek.

  



 


Proprietary
and Confidential


This
Agreement and information contained therein is not for use or disclosure
outside of AT&T, its Affiliates,
and third party representatives, and Supplier except under written
agreement by the contracting Parties.


 


8