Loading...
The URL can be used to link to this page
Your browser does not support the video tag.
Home
My WebLink
About
Finalist Follow Up Qs - Responses-HR-21052
City of San Luis Obispo - Recordkeeper Finalist RFP Follow-Up Questionnaire # Data Breach History 1 2 3 4 5 What Happens in the Case of a Breach 6 7 8 Safety Guarantee 9 10 Service Center Locations 11 12 13 14 Technology & Security Spend 15 16 17 18 19 20 California References — Oracle Fusion Cloud Payroll Integration (Payroll Change Purposes) 21 22 23 24 25 26 27 Blackout Period Guarantee 28 29 30 31 33 34 Conversion / Transition Support 35 36 37 38 Question Have you experienced any data breaches, security incidents, or unauthorized access events in the past 5–10 years (including at the parent company or subcontractor level)? For each incident, provide root cause, number of participants affected, and remediation timeline. Walk through your incident response protocol step by step: detection, containment, notification timelines (to plan sponsor, participants, and regulators), and forensic investigation process. What is your contractual notification window if a breach occurs (e.g., 24/48/72 hours)? Have you had any SOC 1 / SOC 2 Type II audit findings or exceptions related to security controls in the last three years? Do you conduct third-party penetration testing? How often, and will you share redacted results or attestations? Do you carry cyber liability insurance? What are the coverage limits, and does the plan sponsor/plan have any rights under that policy? Is there an indemnification clause specific to data breaches in your service agreement? What are its limits and exclusions? Do you offer credit monitoring, identity theft protection, or reimbursement for participants affected by a breach? For how long, and at whose cost? Is there an explicit fiduciary or contractual guarantee against losses due to cybersecurity failure? What exactly does it cover (e.g., unauthorized distributions, account takeover), and what does it exclude? Does the guarantee apply only when the participant/sponsor followed certain security practices (e.g., MFA enrollment)? What voids it? What are the physical locations of all call/service centers handling participant inquiries (domestic and offshore)? Are any functions — call center, data processing, plan administration — outsourced or performed by subcontractors, and where are those located? Describe your business continuity/disaster recovery plan. Are there redundant sites, and where are they located? If offshore locations are used, what data residency, access controls, and regulatory compliance (e.g., SOC 2, data localization laws) apply there? What is your total annual technology budget (firm-wide, and if possible, specific to the retirement services division)? What dollar amount or percentage is specifically allocated to cybersecurity/data protection? What has the trend in this spend been over the last 3–5 years — growing, flat, or shrinking relative to AUM/participant growth? What headcount is dedicated specifically to information security (not just general IT)? What certifications do you maintain (SOC 2 Type II, ISO 27001, NIST framework alignment)? What investment have you made in participant-facing security features (MFA, biometric login, behavioral fraud detection, transaction alerts)? Please provide the names of clients (ideally public sector, and in California) currently interfaced with Oracle Fusion Cloud for payroll data exchange, specifying whether each is a 180-degree (one-way feed — payroll-to-recordkeeper or recordkeeper-to-payroll only) or 360-degree (bi-directional — both systems can send and receive) integration. For each reference: How long has the integration been live? For each reference: What specific payroll data elements are exchanged (contribution changes, deferral elections, loan repayments, employee status/eligibility changes, etc.)? For each reference: How frequently does data sync (real-time, daily batch, weekly)? For each reference: Has the client experienced any data mismatches, sync failures, or reconciliation issues, and how were they resolved? Can the client speak directly with the plan administrator or HR/payroll lead about their experience? Yes, no, or we will check, is good for now. If you do NOT have a true 360-degree bi-directional capability with Oracle Fusion Cloud, what manual or semi-automated workarounds are required to keep payroll and recordkeeping data in sync? Do you offer a guaranteed maximum blackout period during conversion, provided all data and asset information is received clean (i.e., no data discrepancies, reconciliation issues, or missing information)? What is the guaranteed duration (e.g., one business day)? Is this guarantee documented in the service agreement, or is it a verbal/marketing representation only? If contractual, what is the specific language and where does it appear in the contract? What qualifies as 'clean' data for purposes of triggering the guarantee? Please define acceptable file formats, data elements, and reconciliation tolerances required to avoid a delay. What happens if the guarantee is missed — is there a financial penalty, fee credit, or make-whole provision to the plan or participants for each day beyond the guaranteed period? What is your historical track record of meeting this guarantee across recent plan conversions of similar size/complexity? Can you provide data on average actual blackout duration over the last 3–5 conversions? Does the guarantee cover both 457(b) and 401(a) assets being consolidated simultaneously, or does a multi-plan/multi-vendor conversion change the guaranteed timeline? Will a dedicated communications consultant be assigned specifically to support the transition, separate from the transition manager, and will this continue throughout the client relationship? What communication theme or campaign choices are available to the plan (e.g., pre-built templates vs. fully customized branding), and is there an additional cost for customization? Will communications be co-branded with the plan sponsor's name/logo, or are they delivered under the recordkeeper's brand only? What is provided post-conversion to confirm participants understand their new accounts (e.g., confirmation statements, follow-up campaigns)? Voya Response Voya's plan recordkeeping platform has never experienced a system-wide data breach resulting in the loss of or improper access to participant personal confidential information, nor have authorities had to be contacted. Like others in our industry, Voya is subject to cyber security incidents in the ordinary course of our business. Although we seek to limit our vulnerability to such events through technological and other means, it is not possible to anticipate or prevent all potential forms of cyberattack or to guarantee our ability to fully defend against all such attacks. Voya's Security Operations Center (SOC) detects and analyzes threats to information assets within the Voya enterprise, including communication and escalation of information security events to Voya's Security Incident Response team. Attacks are frequently detected and blocked by our various defense layers. In the event Voya falls victim to a cyber security attack, we comply with all notification obligations under applicable state and federal laws and regulations. Voya has insurance coverage for network security liability, privacy liability, crisis management & identity theft response, cyber extortion, network business interruption, and data asset protection. Voya’s Security Operations Center (SOC) detects and analyzes threats to information assets within the Voya enterprise, including communication and escalation of information security events to Voya's Security Incident Response team. Attacks are frequently detected and blocked by our various defense layers. In the event Voya falls victim to a cyber-security attack, we comply with all notification obligations under applicable state and federal laws and regulations. Some states publish these notices on their websites. For more information on the cyber security threats facing Voya, please refer to the most recent public filings (10-K or 10-Q) for Voya Financial, Inc. As providers of products and services that involve the collection and use of personal, and sometimes sensitive, information, protecting the confidentiality of that information has been, and will continue to be a top priority throughout the Voya family of companies. 1. Detection and Triage Voya maintains security event monitoring designed to detect security events in as close to real time as possible. Monitoring controls provide notifications related to potential loss of confidentiality, integrity, or availability of systems. Employees, contractors, and third parties are required to report security events, and suspicious activity is reviewed by the Security Incident Response Team (SIRT). The Detection and Response Team (DART) and SIRT perform initial triage, determine scope, assess severity, and initiate the appropriate response process. 2. Containment Voya's incident management process includes containment procedures as part of the incident lifecycle. Voya's Cybersecurity Playbook contains response guidance for a wide range of scenarios, including ransomware, unauthorized access, malware, phishing, cloud incidents, supplier/vendor risks, denial-of-service attacks, and disclosure of personal information. SIRT manages incident response activities, tracks progress, and monitors remediation status throughout the incident lifecycle. 3. Investigation and Forensics Voya's incident management process includes investigation, preservation of evidence, and documented communications throughout the incident lifecycle. Voya maintains forensic capabilities using trained personnel and specialized forensic tools, with support from external forensic partners when necessary. Chain-of-custody procedures are maintained for evidence collection and investigation. Supporting controls include: • Audit log retention for a minimum of three years. • Network traffic logging for forensic analysis. • Alternate event logging systems for resilience. • Formal escalation and reporting procedures. 4. Escalation Security incidents of significant magnitude are escalated to senior management. If an incident reaches a predefined materiality threshold, the Cybersecurity Incident Response Playbook is formally invoked. Legal, Compliance, business teams, and Information Security personnel participate as appropriate. 5. Notification If Voya confirms a security breach, it will notify the client within 72 hours (3 business days). Voya complies with all applicable state and federal notification laws and regulations. Voya will promptly investigate, take commercially reasonable steps to contain and remediate the incident, and provide relevant details and ongoing coordination as appropriate. If Voya confirms a security breach, it will notify the client within 72 hours (3 business days) and Voya will promptly investigate and take all commercially reasonable steps to remedy the breach. Voya complies with all applicable state and federal notification laws and regulations. Voya will provide relevant details and ongoing coordination as appropriate. Ernst & Young LLP, our external auditor, performs our SOC 1 Type II examination of our internal controls relevant to financial reporting. The resulting report provides assurance that our control environment is designed and operating effectively to meet the stated objectives. While the auditor noted certain exceptions in our most recent report, these were limited in scope and did not undermine the overall reliability of our control framework. We have implemented corrective measures to address these observations promptly, reinforcing our commitment to strong governance and continuous improvement. Voya has chosen the SOC 2 Type II report of the Security Principle and International Organization for Standardization certification. The most recent Service Organization Control 2 (SOC 2) report was performed in accordance with the Statement on Standards for Attestation Engagements No. 18. by Ernst & Young LLP, our external auditor. Voya’s most recent SOC 2 audit was issued on December 18, 2025. The auditor's opinion for our SOC 2 audits over the last three years is "Unqualified." Any exceptions found did not impact that opinion and have no material impact on our services. Any exceptions are remediated in a timely manner. Details of audit findings are described in the respective reports. Yes. Network penetration tests on Voya infrastructure are performed by Voya engineering staff monthly or after major changes, based on system classification. Externally facing applications undergo annual third-party testing. Additional tests are conducted after significant changes impacting security. Testing uses black-box, grey-box, and white-box methods, including password vulnerability exploitation where applicable. All findings are risk-ranked, documented, and tracked through remediation, which is also documented and communicated to relevant teams. Attachment: Coalfire-Voya-Wealth Solutions-Best-Practice-PenTest-Final. Coalfire was engaged during the period of June 12, 2025 through June 24, 2025 to perform third-party, independent security testing for Voya Inc (“Voya”). The engagement included assessment and testing against the defined client systems to proactively discover flaws, weaknesses, and vulnerabilities. Testing for this project was conducted in accordance with Information Security Best Practices. The objective of this service was to identify and safely exploit vulnerabilities that could lead to critical infrastructure service interruption, destruction of facilities, or compromise of sensitive systems and data. During this Penetration Test, the overall risk to this environment was determined to be Low. Yes. Voya maintains cyber liability insurance with financially sound and reputable insurers to support its obligations related to network security and information technology risks. This coverage is maintained and remains in effect during the term of the service agreement. The policy provides protection for network security (also referred to as Cyber/IT risk). Upon execution of the agreement, Voya will provide the client with a certificate of insurance, evidencing the existence of this coverage. Consistent with industry practice, specific policy limits and deductibles are confidential to Voya. Plan sponsor protections are generally provided through contractual provisions, including incident notification, cooperation, indemnification, and other obligations set forth in the applicable service agreement or Data Security Addendum. Voya’s data security agreement defines information security incident as any breach of security or cyber security incident impacting Voya that has a reasonable likelihood of (a) resulting in the loss or unauthorized access, use or disclosure of client personal information (PI); (b) materially affecting the normal operation of Voya; or (c) preventing Voya from complying with all of the privacy and security requirements set forth in this agreement. Voya will indemnify, defend and hold harmless the plan sponsor from and against any and all claims, suits, causes of action, liability, loss, costs and damages, including reasonable attorneys’ fees, arising out of or relating to any information security incident, which may include, without limitation: (i) expenses incurred to provide notice to affected persons* and to law-enforcement agencies, regulatory bodies or other third parties as required to comply with law; (ii) expenses related to any reasonably anticipated and commercially recognized consumer data breach mitigation efforts, including, but not limited to, costs associated with the offering of credit monitoring or a similar identify theft protection or mitigation product for a period of at least twelve (12) months or such longer time as is required by applicable laws or any other similar protective measures designed to mitigate any damages to the affected persons; and (iii) fines or penalties that the plan sponsor pays to any governmental or regulatory authority under legal or regulatory order as a result of the information security incident. If any assets are taken from a participant’s retirement plan account or Voya administered individual retirement account** due to unauthorized activity and after a full and thorough investigation it is determined that such unauthorized activity was committed through no fault of the participant or the employer, then Voya will restore the participant’s account value. The specifics regarding the coverage Voya provides under the S.A.F.E. Guarantee is outlined on our website. *Affected persons means client’s and its affiliate’s former and current employees whose PI may have been disclosed or compromised as a result of an information security incident. **The Voya S.A.F.E.® guarantee does not apply to any accounts that are “held away” by a third party (i.e., where Voya does not provide recordkeeping services and/or administrative services on our system). Yes. Voya covers expenses related to any expected and commercially recognized consumer data breach mitigation efforts, including, but not limited to, costs associated with the offering of credit monitoring or a similar identify theft protection or mitigation product for a period of at least twelve (12) months or such longer time as is required by applicable laws or any other similar protective measures designed to mitigate any damages to the Affected Persons. Yes. We take the safety and security of participant’s retirement benefit assets and personal information very seriously. This is an important part of how we serve you. To further stress our commitment to safeguarding your financial accounts and personal confidential information, Voya offers the S.A.F.E.® Guarantee Program: if any assets are taken from a participant’s workplace retirement plan account or Voya administered Individual Retirement Account* due to unauthorized activity and through no fault of the participant or participant’s employer, we will restore the value of participant’s account. The specifics regarding the coverage Voya provides under the S.A.F.E. Guarantee is outlined on our website. *The Voya S.A.F.E.® Guarantee does not apply to any accounts that are “held away” by a third party (i.e., where Voya does not provide recordkeeping services and/or administrative services on our system). No. The S.A.F.E.® (Secure Accounts for Everyone) Guarantee protects the participant retirement accounts or Individual Retirement Account (IRA) managed on Voya’s platform against fraud and unauthorized activity. If a participant experiences fraud and is not at fault, we will restore the account balance. Participants are not required to take any specific action in order to benefit from the S.A.F.E Guarantee. Participant initiated or participation in fraud would void the guarantee. Voya has built extensive call capacity and redundant contact centers to provide participants with uninterrupted service. Our customer service associates are located across the U.S. with larger concentrations around Windsor, CT; Atlanta, GA; Minneapolis, MN; and Scottsdale, AZ. In addition, our work from home associates, have identical hardware, software, and client applications. We can redirect incoming calls to any location during peak call times, or in case of emergency. Participants can speak to a CSA from 5 a.m. to 5 p.m. PT, Monday through Friday. Voya has offshore call center capabilities, but all call center support for the City of San Luis Obispo would be provided with onshore resources. No. Voya does not outsource or use subcontractors for call center, data processing or plan administration. We subcontract services for day-to-day operations in certain instances. For example: Fiserv Output Solutions - statement printing and mailing Voya maintains Business Continuity Plans and Disaster Recovery capabilities to support the resilience and recovery of critical business operations, systems, and data during disruptive events, including cyber-related incidents. These plans are governed through Voya’s operational risk management framework, include defined recovery strategies, recovery objectives, communication procedures, and assigned recovery roles, and are reviewed and tested at least annually. Voya’s continuity planning also addresses key process dependencies, personnel, applications, third parties, and restoration procedures to help maintain essential services and minimize disruption. Specific Business Continuity and Disaster Recovery plan documents are proprietary and are not generally shared externally. Voya operates fully redundant, physically separated, Tier III data centers in Shakopee, MN, and Sterling, VA, 1,123 miles apart to mitigate environmental risks. These colocation facilities, managed by specialized providers, use a warm standby mode for backup. Data is continuously replicated between the centers via dual 10 GB data lines, with nightly batch system replication. The infrastructure, housed in dedicated caged spaces, meets SOC1, SOC2 Type II (SSAE 16 & 18), and ISO 27001 certifications. Voya uses limited offshore resources for technology and support functions, primarily through Voya India, and select third-party partners. Client and participant-facing services are delivered onshore, and client confidential information is not stored outside the United States. Offshore access, where authorized, is governed by role-based access controls, least-privilege principles, multi-factor authentication, audit logging, segregation-of-duties controls, and Voya's information security and privacy programs. Voya maintains SOC 1, SOC 2, and ISO 27001 assurance programs and requires compliance with applicable legal, regulatory, contractual, and data protection requirements. Approximately 25% of Voya's Retirement operating expenses are budgeted to technology development and maintenance, including cybersecurity. In addition, of Voya’s overall technology investment, nearly 60% is earmarked for the Retirement lines of business. Voya requires the completion of a Non-Disclosure Agreement to disclose a dollar amount. Voya does not publicly disclose a standalone annual technology budget, so any assessment relative to AUM or participant growth is directional rather than based on a published technology-spend ratio. Over the past 3–5 years, Voya has maintained a strong commitment to technology investment, with spending trends generally increasing to support platform modernization, cloud and API capabilities, AI-enabled solutions, cybersecurity, automation, and enhanced participant and advisor experiences. Technology investment has grown alongside business expansion and remains a strategic differentiator for the firm. Voya's Information Security Organization consists of over 100 dedicated information security professionals whose breadth of experience is exemplified by over 100 security accreditations including CISSP, CISA, CISM, Ethical Hackers, and Business Continuity Professional and industry recognition for operational initiatives and team accomplishments. Our Security team regularly attends summits and conferences on information security and technology, while also monitoring information daily. Leading the team is Senior Vice President, Chief Information Security Officer, Marino Monti. Voya is proud that our Information Security Management System (ISMS) is certified and meets the requirements of the rigorous ISO/IEC 27001:2022 standard. Receiving this certification demonstrates Voya’s commitment to investing in our people, processes, and technology to protect customer data, and provides an independent, expert assessment of our data protection standards. While we have the above certification, Voya does not only align with one set of standards. Instead, Voya aligns our security protocols with a variety of industry standards. Voya submits its key operational and IT controls to comprehensive independent audits, specifically, the SSAE 18 Reporting Standard-SOC 1 and SOC 2 Type II Security Principle annual audit reports. In addition, Voya aligns our security protocols with a variety of industry standards including COSO framework, National Institute of Standards and Technology (NIST) and ISO 27001. We also perform a SOX 404 as well as internal audits to ensure proper controls are in place. Voya has invested in participant-facing security capabilities including MFA, step-up authentication for high-risk transactions, voice-biometric authentication (Voya Voice Print), machine learning-based fraud detection, behavioral analytics, geolocation analysis, transaction risk scoring, real-time fraud monitoring, participant alerts and confirmations, and specialized fraud investigation teams. These controls are supplemented by the Voya S.A.F.E.® Guarantee for eligible unauthorized account activity. Baptist Health - 360 integration Lakeview Health - 360 integration Baptist Health - January 1, 2023 Lakeview Health - January 1, 2023 1. Demographic data including full life events for: New Hire, Rehire, Termination, Payroll location change, change from eligible to ineligible and from ineligible to eligible. 2. Financial data including multiple EE and ER sources, loan payments and compensation data. Baptist Health - Voya can receive files daily from this client. Lakeview Health - Voya can receive files daily from this client. Baptist Health - No sync or data mismatch issues. Client experienced a minor issue where name changes submitted by the client on the demographic file were not being updated. A simple IT fix resolved the issue. Lakeview Health - No sync or data mismatch issues. Client experienced a minor issue with match eligibility flow based on hours worked. The flow was updated to incorporate the client's expectations. Yes. This is contingent upon our client agreeing to do so. We will inquire when the City is ready to have a discussion. Not applicable. Yes. Voya will commit to having the plan operational three days from the receipt of good data from the prior recordkeeper. Voya typically averages a three-day blackout period measured from receipt of good data from the prior recordkeeper. Voya will offer a $5,000 implementation guarantee which includes the agreed upon blackout period. Voya can include the commitment in our service agreement. We would work with the City to draft mutually acceptable language. The commitment can appear in the service agreement in the area that pertains to other service guarantees. For purposes of meeting timing commitments, data is considered acceptable when it is received in “Good Order,” meaning the instructions, data, and funds (if applicable) are complete, accurate, and in an acceptable format and received at the appropriate location so no research or discretionary judgment is required. Supported transmission and file approaches include sending files via FTP with PGP encryption, using a secure website where an investment provider retrieves files using a username and password and sending files via email in an encrypted format to plan-specified contacts. For conversion, examples of required or expected data elements include participant records such as allocations, balances, tracking financial data, loan data, and participant census information including full social security numbers such as vesting data, contribution and distribution activity, and other required historical data. As part of data quality and reconciliation controls, Voya applies edits and reconciles at both the plan and participant levels before processing data to the Voya Recordkeeping Platform. Voya would credit the plan for the amount of the financial penalty. The plan sponsor can elect to utilize the credit for any reasonable plan expense (e.g. offset other fees, distribute to participants, etc.). Voya has a strong historical track record of meeting this guarantee across recent plan conversions of similar size and complexity. We have not missed a scheduled go-live date, and our recent conversions have averaged a four-business-day go-live timeframe. The guarantee timing would apply to each plan independently. However, a conversion project plan would ideally have all plans consolidating under the same timing (go-live date). Yes. Voya has assigned Kiara Copeland to assist with creating meaningful communication pieces for both the transition and ongoing. Communication campaigns for The City can be customized extensively as part of the recordkeeping services and are supported by your dedicated Communications Consultant, Kiara Copeland, who takes a proactive, strategic, and consultative approach to participant engagement. Customization Included in Recordkeeping Fees As part of the recordkeeping services, The City will receive the following at no additional cost: • Custom‑branded communication materials incorporating The City company name, logo, colors, and imagery • An annual communications strategy aligned to plan objectives and workforce demographics • Targeted communication campaigns based on participant behaviors and life stages (e.g., enrollment, contribution increases, retirement readiness) • Standard enrollment and re‑enrollment education campaigns • Digital retirement education resources, including calculators, modeling tools, and generalized retirement guidance • Access to myOrangeMoney® and broader financial wellness tools • Ongoing strategic consultation during service reviews to evaluate communication effectiveness and recommend enhancements Kiara works closely with The City and internal service teams to recommend appropriate messaging, timing, and delivery channels, ensuring communications remain relevant, coordinated, and outcome‑focused. While the Communication Consultant promotes and supports the education meeting strategy, participant education meetings are delivered by a dedicated education team. All communication strategy, planning, and standard campaign execution are included in the recordkeeping fees. Meetings Participant education meetings (onsite or virtual) are conducted by a dedicated education delivery team. There are no additional fees for communications support related to meeting promotion or strategy. Fees apply only to the delivery of additional education meetings, as outlined below. Out‑of‑Scope Customization and Additional Fees Additional fees may apply when requests extend beyond the standard communication framework, including: • Personalization or customization beyond the standard offering (e.g., highly tailored content or non‑standard branding) • Translation services • Hard‑copy printing and mailing • Additional participant education meetings beyond the standard offering: • Onsite meetings: $1,250 per day (inclusive of travel) • Virtual meetings: $750 per session Yes. We know that experience matters when it comes to developing effective and compelling retirement plan communications and for years plan sponsors have relied on Voya to educate their employees about the importance of saving for retirement and the benefits of participating in the plan. We believe that branding communication materials can emphasize the value of the retirement plan benefit and help increase employee awareness, appreciation, and connection to the plan. That is why we customize materials with your company name and logo. Post-conversion, participants receive go-live communications for onboarding, and additional communications are provided after the transition based on the custom campaign strategy. On the live date (day 1), a Plan Live Account Access Email/Guide is issued and segmented for active and contributing participants, eligible non-participants, and termed/retired participants to explain applicable services, account access, beneficiary elections, and communication preferences. MissionSquare Response No. MissionSquare has not experienced any data breaches, security incidents, or unauthorized access events resulting in the compromise of participant data within the past 5-10 years. Additionally, MissionSquare's recordkeeping partner, SS&C, has not experienced any such incidents in connection with its services to MissionSquare since the partnership began. MissionSquare’s corporate policy is to provide notice consistent with all applicable state laws regarding the protection of personal information used or maintained by MissionSquare in the course of our business in support of our plan sponsors. MissionSquare leadership will coordinate prompt communication and updates as appropriate to our clients in the event of a breach after verification/approval from internal and external legal entities (e.g., law enforcement), as applicable. We have a defined Cybersecurity Incident Response Plan (CSIRP) and a designated Cybersecurity Incident Response Team that handles all operations related to incidents and the implementation of the CSIRP, including notifications to business partners of verified security or data privacy breaches. We provide communication regarding the initiation of our Business Continuity plans via public website announcements and direct contact with employers. We have an established Incident Management Team that is supported by a Communications Team at all meetings to provide timely updates to business partners, including participants and plan sponsors. 48 hours. MissionSquare has not had a qualified opinion or any material negative audit findings in any of our SOC reports in the past 5 years. SS&C received a qualified SOC I for the period October 1, 2022-September 30, 2023. They successfully remediated the control deficiencies resulting in an unqualified SOC I opinion for the period April 1, 2023-March 31, 2024, being issued by their external auditors, Ernst & Young, LLP, on May 16, 2024. Subsequent unqualified SOC 1 opinions for the periods October 1, 2023-September 30, 2024, and October 1, 2024-September 30, 2025, were issued by Ernst & Young on November 13, 2024, and on November 5, 2025. SS&C has received unqualified SOC 2 reports for the entire period since we started our relationship with them. Yes. MissionSquare contracts with a security vendor to complete enterprise penetration testing against the network on no less than an annual basis. This testing includes the following components: external networks and domains discovery, external penetration assessment, and internal penetration assessment. Application penetration tests are also performed on the web and mobile applications annually. Any findings are remediated. There were no findings in the most recent penetration test report that was delivered on October 22, 2025. Yes. MissionSquare maintains $25M of cyber liability insurance in addition to other types of insurance that may be responsive in the event of a system breach. The plan sponsor and applicable plans may be added as Additional Insureds under the cyber liability policy. As such, they may have liability coverage for certain covered claims subject to the policy's terms, conditions, exclusions, and coverage limits. Plan sponsor’s own cyber/computer systems are not covered. No. Yes. If an incident or breach of Personally Identifiable Information has occurred, we will make all reasonable efforts to help covered individuals establish protection against the risk of identity theft. Impacted participants will be offered credit and identity monitoring services at our expense. We will determine the appropriate period for the services to be provided. Credit monitoring is through Experian and generally offered for one year, with alternatives considered (either shorter or longer) depending on specific circumstances. Yes. All accounts administered by MissionSquare are covered under the MissionSquare Security Guarantee. Under this guarantee, MissionSquare will reimburse participants for all losses from their MissionSquare account(s) resulting from unauthorized activity through no fault of their own. If a participant has a claim, we will ask for their cooperation with our investigation and we may ask them to take certain actions such as filing a police report or providing an affidavit. The guarantee does not cover legal expenses, taxes, or lost opportunity costs. We stand by our Security Guarantee. It is best practice for participants to follow basic security practices such as making sure their information is current, monitoring their account activity, being cautious of certain communications, and securing their account and devices. Our security guarantee seeks to reimburse participants for losses from their MissionSquare account that are the result of unauthorized activity through no fault of their own, and each case is evaluated on its own merits. MissionSquare Plan Services contact center representatives are exclusively U.S.-based employees. The contact center operates primarily through representatives working remotely from locations across the United States, with a supplemental office in Braintree, MA that supports contact center operations. MissionSquare does not utilize offshore contact centers for participant inquiries. MissionSquare understands “outsource” in this context to mean working with or providing access to external companies that have expertise in certain areas and provide increased efficiency in servicing our clients. MissionSquare maintains relationships with various companies to: -Provide recordkeeping, contact center, and online services. -Act as an Independent Financial Expert for the investment advisory and planning services offered in our Guided Pathways® Advisory Services program. -Provide brokerage services, maintain records of holdings and activity in our brokerage program, and send brokerage statements to participants using the service. -Provide non-discretionary trustee services or custodial services at a plan sponsor's request, with MissionSquare providing plan administration and making investment options available. -Compile annual/quarterly service plans to employers and print and mail quarterly participant statements and annual 1099-Rs (MissionSquare maintains control of data extraction and validation). -Process health reimbursement claims for MissionSquare’s Retirement Health Savings offering. -Provide QDRO review and determination services. MissionSquare closely monitors these companies through reviews of key metrics, regular governance meetings, periodic audits, and other due diligence activities to ensure that agreed-upon services meet established quality standards. Terms of our contracts with these third-party companies vary based on business needs. The organizations that MissionSquare has partnered with are located throughout the United States. A comprehensive resiliency program is in place, documented in accordance with industry best practices and standards. Plans outline the procedures and protocols to be followed in an incident to ensure the swift recovery and resumption of critical business operations. Plans include detailed steps for people, technology, and vendors, and communication with stakeholders to minimize disruption and maintain business continuity. MissionSquare conducts disaster recovery and resilience exercises annually, aligned with industry’s best practices and validated through independent audits, including System and Organization Controls (SOC) reporting. Our hybrid architecture, spanning private and public cloud environments and SaaS platforms, leverages multi-zone and multi-region configurations to ensure high availability and rapid recovery. Rather than relying on legacy, single-site recovery models, we test at the application and component level, with intervals tailored to service criticality. Continuously available systems are validated through live failover and patching processes, while systems requiring manual recovery are exercised to confirm Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) are met. All exercises are followed by structured reviews to drive continuous improvement. Our vendor due diligence and architectural assessments further ensure that third-party services meet the same high standards. This distributed, risk-based approach ensures MissionSquare can meet or exceed the 24-hour RTO required by our clients, delivering resilient, dependable service under any conditions. Physical locations are not disclosed for security purposes. No off-shore locations are used. MissionSquare has a relationship with SS&C to provide recordkeeping and administrative services for the plans we administer. The investment in technology to support these services was 27% of total expense in 2025. Approximately 9% of our investment in technology is spent on cybersecurity. MissionSquare’s total spend related to technology and enhancements (including cybersecurity) has been consistently 25% - 30% of total expense. As of 12/31/2025 there are 104 employees dedicated to information security. This number includes our recordkeeping partners at SS&C. The cybersecurity programs of MissionSquare and SS&C are aligned with and incorporate the National Institute of Standards and Technology Special (NIST) Cyber Security Framework. Additionally, MissionSquare is aligned with the SPARK cybersecurity best practices, and SS&C’s data centers are ISO 27001 certified. Fraud mitigation enhancements, including fraud alerts and advanced bank verification. Participant website/mobile app: Multifactor authentication required during log in, in the form of a one-time security code or knowledge-based authentication questions. Biometric authentication implemented via IOS app and desktop. Biometrics for the Android app will be implemented in the near future. Integration with a third party to validate credentials when a participant logs in. If both user id and password are found on the dark web, the participant is required to change their password. Due to client confidentiality and privacy considerations, we are unable to share client names without the client's prior authorization. At this time, we do not have authorization from any Oracle Fusion Cloud clients to serve as references. MissionSquare has offered payroll integration services to clients for several years. MissionSquare's payroll integration framework supports the exchange of a broad range of payroll and participant data, including: Employee demographic information Employment status and eligibility changes Enrollment and contribution elections Pre-tax, Roth, and after-tax contribution data Contribution percentage and amount changes Catch-up contribution elections Loan repayment information Employer contribution data Payroll deduction and reconciliation information Final data requirements would be confirmed during implementation based on the City's business requirements and Oracle Cloud configuration. MissionSquare would support the frequency of data exchange based on a cadence that works best for the City's needs. MissionSquare understands the importance of accrate payroll processing we are committed to reach out via phone and/or email as soon as adminitratively possible should we discover a data mismatch, sync failure or other reconsilliation issue. At this time, we do not have authorization from any Oracle Fusion Cloud clients to serve as references. MissionSquare's integration strategy is designed to accommodate each employer's payroll and HR ecosystem rather than require a specific payroll platform. Although Oracle Fusion Cloud is not a payroll environment frequently encountered among our governmental plan clients, we routinely support bi-directional integration through standardized payroll data exchanges and client-preferred integration methods. For organizations utilizing Oracle Cloud-based environments, MissionSquare's flexible integration framework supports: • Structured file-based exchanges (based on MissionSquare’s standard payroll integration layouts), or • Direct connectivity where supported by the client’s middleware or integration layer This allows the client to leverage their existing Oracle cloud configuration while aligning to our validated processing framework. The blackout period for MissionSquare is typically 2 business days from receipt of records and assets in good order. This does not include the blackout period that your current provider may need. It is in the service agreement. The specific language is as follows, "Transition of assets to MissionSquare by agreed-upon deadline and with a blackout period of no more than 2 business days following receipt of reconciled assets and records in good order." It is located as an attached exhibit to our standard service agreement. During the transition planning phase, we will assess the data being provided by your current recordkeeper, and we will detail our findings and data needs as part of a joint business requirements development. Data is categorized as critical or non-critical during this analysis. We collect all data needed to independently administer the plan. This includes electronic copies of historical participant records to ensure proper ongoing administration (e.g., contribution and earnings detail on after-tax contributions, loan history, and distribution history). A full analysis will be conducted to determine the needs of your plan during the transition. Accurate conversion of historical data is confirmed during testing. Your transition team will conduct testing that includes a review of participant data, money source type mapping, investment mapping, and a full reconciliation of dollars and shares at the plan and participant level. Typically, historical data is only needed from the prior recordkeeper to confirm account balances as of a specific date for Qualified Domestic Relations Order calculations. It is common practice for recordkeepers to work with each other after the transition to supply this information as needed. Yes. $500 per client if delay caused by factors controllable by MissionSquare. MissionSquare has consistently met conversion deadlines across recent plan conversions and has not been required to pay any conversion-related guarantees in recent years. Our average actual blackout period over recent conversions has been approximately two (2) business days. This guarantee covers both 457(b) and 401(a) assets consolidated simulaneously. It does not change the guaranteed timeline. MissionSquare will provide the city with customizable materials related to the transition as appropriate for participants at each provider and for those both employed and separated from service. For ongoing communication needs your Relationship Manager, Mary Rorvic would be happy to work with the City to provide you with educational materials and marketing pieces to support the plans. We do offer multiple templated materials that can be customized to include the City’s name and/or logo. Many are currently available on the plan sponsor toolkit https://explore.missionsq.org/planspon sorcampaigntoolkit-2026/p/1 We are open to exploring solutions if none of our materials fulfill the clients' needs. Yes, we have the ability to co-brand multiple communications materials. Communication & Education Plan We will work with you to prepare an engaging communication plan to re-engage current employees and welcome new employees, including preparing communication materials and completing mailings on your behalf. Our recommended strategy includes communications to participants, retirees, and former employees: •Transition Letter – Includes a transition timeline, fund mapping strategy, dates and times for education sessions, and answers to frequently asked questions. •Plan Transition Site – Gives participants transition updates, additional information, and links to the plan's fund lineup, with the option to include links to your website. •Targeted Communications – Highlights messages crafted to specific participant needs. •Welcome Letter – Outlines enrollment and other key details. •Conversion Confirmation Letter – Announces completion of the transition, including details on how assets were reinvested based on fund mapping. Education & Support Nick Dalafu, your Retirement Plans Specialist, will be available for group and one-on-one meetings to educate employees on any changes being made, including the fund lineup and fee enhancements. Group seminars reinforce initial communications and give employees the opportunity to ask questions, and will include: •Introduction to MissionSquare and available participant support services. •Overview of web, mobile, and voice response tools, plus in-person education options. •Overview of the investment menu and how to leverage plan changes for continued retirement planning. •Review of the transition process and timeline. Nick will also conduct specialized sessions for retirees, terminated participants, and other separated employees, focused on: •Ease of using plan services and reasons to stay in the plan. •Plan benefits, including financial planning webinars led by our CERTIFIED FINANCIAL PLANNER® professionals and additional planning services. •The array of investment choices available, including brokerage. •The transition of benefit payments from the prior administrator to MissionSquare. Nationwide Response As a large financial services enterprise, Nationwide has experienced limited incidents, such as misdirected communications, that may be characterized as security breaches under certain legal, regulatory, or contractual definitions. Nationwide's Retirement Solutions division, however, has not experienced any incident involving unauthorized external access to or exfiltration of plan or participant data resulting from a compromise of its systems. To Nationwide's knowledge, while certain limited incidents may technically fall within some definitions of a breach, Retirement Solutions has not experienced a malicious system intrusion or data exfiltration event affecting plan or participant data. While no organization is entirely immune from attack, we monitor closely for threats and have protocols to guide our response and remediation in the event of this type of situation. How we respond, care for those impacted, and focus on prevention and detection remain our top priority. We take data security very seriously, employing industry standard practices to protect our systems and networks, such as described below: • Dedicated Teams: We have developed cyber defense strategies and solutions within our Cybersecurity Operations Center (CSOC). The CSOC employs a team of security professionals and automated response tools to proactively monitor and protect our external and internal network perimeter 24 x 7 x 365. This team receives threat intelligence from a variety of sources and leverages advanced technologies to identify and respond to suspicious activity. • Response Process: If the Security Command Center detects a security incident the team works cross-functionally with Nationwide’s Event Management Program (EMP), which investigates security incidents, substantiates facts, and conducts legal analysis according to state and/or federal statutes, and contractual obligations. As soon as administratively possible after verification of fraudulent activity, the Plan Sponsor is contacted via phone and/or email to alert them to the event. Nationwide’s Incident Management program is designed to identify, isolate, respond to, and remediate suspected or actual cybersecurity events. A holistic approach is taken to incident management to ensure triggers are monitored and incidents are uncovered. This involves log aggregation, security information, an incident response case management system, and end-user education. An Incident Response process is in place to systematically respond to any identified Nationwide Technology security incident that could threaten the confidentiality, integrity, or availability of an information resource. If a cybersecurity event is identified, Nationwide’s Cyber Security Operations Center (CSOC) works cross-functionally with the Event Management Program or ERT and Response Team to investigate the security event fully and take appropriate action to remediate if necessary. The CSOC’s primary functions are incident response, vulnerability management, and defensive optimization. Nationwide also has a mature Event Management Program, which investigates security incidents, substantiates facts, and conducts legal analysis according to state and/or federal statutes, and contractual obligations. The CSOC IR plan: • Provides a roadmap for implementing the incident response capability • Describes the structure and organization of the incident response process • Provides a high-level approach for how the CSOC Incident Response Process works in conjunction with the Nationwide Event Management Program • Defines reportable incidents The plan is owned and governed by the CSOC IR Team ; and reviewed/updated at least annually according to S&I documentation requirements. The incident response plan is continually updated based on Lessons Learned through incident handling and testing. The CSOC Incident Response Process is tested at least annually to determine its effectiveness. Testing methods may include, but not be limited to, one or more of the following methods: • Walk-Through or Tabletop Exercise • Simulation (parallel or full interrupt) • Checklist Approach Selected individuals from the CSOC IR Team are required to participate in testing events. The Incident Response IT Security Standard owner oversees the testing effort with participation by groups relevant to the testing scenario. Test results are documented and maintained for a period of 24 months. The results of testing are utilized to enhance the CSOC Incident Response Process. Nationwide follows state and/or federal statutes and contractual obligations when determining a reportable security breach (e.g. unauthorized access or disclosure to participant data, compromising confidentiality or security). As soon as administratively possible after verification of fraudulent activity, the Plan Sponsor is contacted via phone and/or email to alert them to the event. Yes. We did have 2 exceptions in 2023 SOC-2 and one in the 2023 SOC-1 that were addressed. We have included a link to our Nationwide Trust Center at https://trustcenter.nationwide.com/?product=retir ement-solutions where you can see our most recent SOC-1 and SOC-2 with no exceptions/findings along with other helpful information that reinforces Nationwide's commitment to data and cyber security. Yes. A formalized attack and penetration test is conducted against Nationwide externally facing systems on an annual basis. The testing is performed by an appropriately credentialed independent third party. All remediated vulnerabilities are validated via retesting methods prior to being officially closed. Validation is conducted by the independent third party who conducted the original test or by members of the Nationwide Attack and Penetration Team. We are including the most recently available redacted attestation with our response. Yes. Nationwide has a comprehensive cyber insurance policy through National Casualty Company to enhance protection for both Plan Sponsors and participants. The policy has a $10,000,000 aggregate limit. Yes. Nationwide’s insurance coverage extends to third-party liability and pays for damages we are legally liable for, including credit and theft monitoring services. Yes: Nationwide shall defend, indemnify, and hold harmless Plan Sponsor from and against any and all damages, losses, fines, penalties, costs, expenses, liabilities, and other fees (including reasonable attorneys’ fees) arising from or relating to any actual, alleged, or threatened claims, demands, investigations, or causes of action by third parties caused by the negligent, grossly negligent, or intentional acts or omissions of Nationwide, any breach of the Agreement by Nationwide, or any violations of Laws caused by the actions or omissions of Nationwide. Yes. The details are determined by the unique situation. This is provided at Nationwide's expense. Yes. Nationwide Account Pledge is our commitment to help protect participants if fraud occurs. To learn more about the specific terms and parameters of Nationwide Account Pledge and provisions that may impact availability of its coverage, please visit https://www.nationwide.com/financial-professionals/products/retirement-solutions/flexible-advantage/options/accountpledge. Yes. Nationwide Account Pledge and the restoration of the unrecoverable amount are subject to certain limitations and restrictions, including, but not limited to: • Participants are required to submit to Nationwide an Affidavit of Forgery and a copy of a filed police report and required to fully cooperate with Nationwide in assessing the fraud • The pledge does not cover losses that result from a participant's, their designee's, family member's or acquaintance's negligence or fraudulent acts and/or from the sharing of information or account credentials • The pledge does not cover legal fees, expenses or tax consequences, and/or indirect or non-monetary damages incurred by the participant • Losses will not be covered when caused by a failure of an authorized third party (e.g., the Plan Sponsor, a financial professional, an administrator, a consultant, etc.) with access to the account, but Nationwide will partner on a resolution All participant calls, recordkeeping, and administrative services will be handled in either our Corporate Headquarters in Columbus, Ohio or our Western Operations Center in Scottsdale, Arizona. No. The functions listed are provided by Nationwide. While Nationwide does not subcontract any of the services described in this response, we do partner with the following affiliates and third-party industry leading firms to enhance the participant experience. Nationwide ProAccount and My Investment Planner Nationwide ProAccount® is an optional managed account service offered by a Nationwide affiliate, Nationwide Investment Advisors, LLC (NIA). Nationwide ProAccount is a "do it for me" solution for participants who recognize the value of having their accounts managed by a professional money manager. It is made available by NIA, a wholly owned subsidiary of Nationwide Life Insurance Company. Nationwide makes investment advice available to participants through the online My Investment Planner© tool at no additional cost to participants or Plan Sponsors. NIA, the registered investment adviser for My Investment Planner, has retained Wilshire as an Independent Financial Expert (IFE) for My Investment Planner. My Investment Planner provides individualized investment advice using an investment process developed and maintained by Wilshire. Participants are asked to complete a six-part questionnaire (the Risk Tolerance Questionnaire) to assess their individual risk tolerance and investment time horizon. Using this information, Wilshire’s methodology identifies the appropriateness of one of five unique risk-based profiles for each participant. Participant Engagement Program To execute on our commitment to reach employees in the manner that is best for everyone through our Participant Engagement Program, we have partnered with Merkle, a nationally recognized Customer Relationship Marketing firm, since 2011. Merkle is a leading data-driven, technology-enabled, global performance marketing agency that specializes in the delivery of unique, personalized customer experiences across platforms and devices. Using certain participant data shared by Nationwide, the marketing firm helps us target the appropriate retirement plan messages to each participant based on the participant's characteristics, demographics, and behaviors while considering the participant's preferences for accessing information, electronically or otherwise. Our experience and results have shown that such strategic analytics enable greater improvements in participant saving behavior because they receive relevant messaging through impactful delivery. Nationwide's Participant Engagement Program actively reaches out to participants as their demographics change, such as approaching age 50+ catch-up eligibility. Schwab’s Self-Directed Account (SDBA) In collaboration with Charles Schwab, Nationwide offers participants access to SDBA option, the PCRA. We have developed an informational kit in conjunction with Schwab that provides all the forms required to enroll in the service and establish an account with Schwab. Our Retirement Specialists are trained on the Schwab PCRA service and can assist participants with questions and completing the forms. Nationwide firmly believes in the value of pre-planning for business interruptions. In our effort to serve both our internal and external customers, by providing continuous service operations, Nationwide has developed a comprehensive Continuity Management (Business Resiliency) program. Our program includes three disciplines: business recovery, system recovery and crisis management. The Continuity Management program resides in the Information Risk Governance organization, under Nationwide Technology. They are responsible for ensuring compliance activities are completed, as well as governance, continuity improvement and crisis management. Nationwide has a Crisis Management team in place to reduce enterprise-wide risk exposure by analyzing foreseeable risks and planning for potential events. Nationwide has an on-going relationship with federal, state, and local emergency management response organizations and regulatory agencies, many of which participate in our annual simulations. Our recovery strategy and plans address individual business process, applications, and systems architectures throughout the organization. Nationwide plans for loss of a facility, loss of a data center, loss of staff, loss of a critical vendor and impact from cyber-attacks. Business functions and system applications have pre-assigned recovery windows to ensure that resources are appropriately allocated. Recovery plans are reviewed, updated and exercised on a regular basis in accordance with our Contingency Planning Standard. To identify and prioritize processes and information systems that support Nationwide’s critical business processes. Nationwide conducts a Business Impact Analysis every four years or when a core business process changes in a way that impacts the criticality of the process. The Technology Risk Committee and the Enterprise Operational Risk Committee provide oversight over Nationwide Technology Resiliency and System Availability to minimize related business disruption and improve Nationwide Technology's resilience posture. Yes. Nationwide’s on premises systems are hosted in two data centers in Central Ohio that are physically independent including from potential natural or man-made events. The data centers are designated as 'primary’ and ‘secondary’ and operate independently, which allows data to be consistently and securely backed up/replicated offsite to mitigate against virus and ransomware threats. Not applicable. 2026 Nationwide Firm-wide spending: $1.32 billion 2026 Retirement Solutions spending: $138.6 million 2026 Nationwide Firm-wide spending: $61.4 million 2026 Retirement Solutions spending: $6.3 million Total firm-wide technology spending has grown over the last 5 years. Nationwide’s Security & Infrastructure (S&I) team is led by the Chief Information Security Officer and includes IT security professionals aligned across Business Continuity and Disaster Recovery, Security Operations Center, Compliance, and Governance and Risk Management. This organization includes 1,300+ associates. • SOC 2 Type II. • Nationwide’s information Security Policy which provides a comprehensive framework for adhering to sound information security practices is based on NIST CSF 2.0 Nationwide remains committed to protecting the security of our clients’ assets and data. We continue to invest in cybersecurity processes, teams and technologies that provide 24/7 protection against cyber threats. Our capabilities deliver early warning indications of fraud, apply advanced data and predictive analytics and include enhancements to participant-facing tools and fraud protections, giving Plan Sponsors additional confidence that participants’ assets are safeguarded. Several examples include: • GIACT – a service for distribution requests that allows our experienced team members to confirm bank account ownership and status in real-time before processing to detect potentially fraudulent activity. • Nationwide Account Lock – allows participants to prevent distributions from being taken from their retirement account until they unlock the account using a unique password by calling the Solutions Center. • MFA is deployed on the Retirement Plans participant and business partner facing websites. Nationwide partners with our MFA provider to obtain device specific information to identify and stop fraudulent devices from accessing our network. • Our Solutions Centers Representatives use a variety of sophisticated technologies and techniques to detect and deter unauthorized access to participant accounts and data. We use an award-winning call profiling technology that validates every phone call on more than 100 components. These components proactively score every call to prevent fraudulent activity. • Our mobile app enables account access with fingerprint or facial recognition. Nationwide has successfully completed and integrated with Oracle Fusion Cloud many times previously. A few examples of clients that have successfully setup a payroll integration between Nationwide and Oracle Fusion Cloud are: • Monterey County • City of Fort Myers • Fayetteville Public Works For these Oracle Fusion Cloud integrations, Nationwide's integration framework is designed to support both 180-degree and 360-degree connectivity, depending on the client's implementation scope, data exchange requirements, and final production design. This approach provides flexibility to align the solution with each plan sponsor's operational and payroll administration needs. Nationwide has an experienced team of dedicated payroll integration professionals with extensive expertise supporting a wide range of client types, payroll providers, and file models. Our team manages integrations across the Core, Government, and Institutional markets, bringing deep operational knowledge and proven implementation experience. For the San Luis Obispo implementation, Nationwide will assign a dedicated Payroll Integration Specialist who will serve as the primary point of coordination throughout the integration process. This specialist will oversee all activities necessary for a successful implementation, including requirements of intake and review, specification development and sharing with Oracle, file testing, validation, and overall payroll integration readiness. This breadth of experience enables Nationwide to support diverse vendor configurations and client operating models while helping ensure the solution aligns with the client's workflows, remains sustainable over time, and is backed by experienced resources. Additionally, the same dedicated Payroll Integration team that supports the initial onboarding and implementation will continue to support the client and Oracle after go-live, providing ongoing maintenance, troubleshooting, and operational support to help ensure long-term success. All integrations have been successfully established and operating in production for more than a year. Nationwide's Oracle Fusion Cloud integration model is designed to support the exchange of a broad set of payroll and census data elements, including: • Contribution data • Deferral election changes • Loan information and loan repayment data • Employee status updates • Eligibility changes • Other standard census elements required to support accurate plan administration and recordkeeping This flexible data structure is intended to support efficient, accurate processing across key payroll and retirement plan workflows. Nationwide supports flexible inbound file processing and can accept payroll files as frequently as provided by the client. Once a file is received and validated, it is processed through Nationwide's nightly update cycle, provided the file is complete and in good order. Outbound change files from Nationwide to Oracle are coordinated based on the client's payroll calendar and business requirements. These files are delivered according to an agreed-upon schedule in advance of each payroll date, ensuring participant and payroll-related updates are available in Oracle in time to support accurate processing for the applicable pay period. To Nationwide's knowledge, the referenced clients have not experienced any significant or recurring data mismatches, synchronization failures, or reconciliation issues associated with the payroll integration. This is largely attributable to Nationwide's structured implementation process, which includes comprehensive testing, validation, and reconciliation activities designed to identify and address formatting, mapping, and data integrity issues prior to production launch. As part of ongoing operations, standard file exceptions or processing errors may occasionally occur, as is typical with any file-based integration. Nationwide has established monitoring, notification, and support processes to quickly identify and resolve these routine issues. Plan sponsors receive confirmation when files are successfully received and validated for processing, as well as notifications if file errors or exceptions are detected. Any issues identified are actively managed by Nationwide's dedicated Payroll Integration team, which provides ongoing support throughout the life of the integration. Clients and their payroll providers have direct access to experienced integration specialists via email, phone, or scheduled working sessions to assist with troubleshooting, maintenance, reconciliation questions, and operational support. Through these established processes and dedicated resources, issues are resolved promptly, helping ensure accurate and timely data synchronization between payroll and recordkeeping systems. We will check reference availability and coordinate accordingly. Nationwide supports a true 360-degree bi-directional integration model with Oracle Fusion Cloud. However, in situations where a client or payroll provider elects not to implement bi-directional data exchange, or where the vendor is unable to consume outbound change files, Nationwide offers alternative processes that effectively maintain synchronization between payroll and recordkeeping data. Under this approach, Nationwide continues to receive and process inbound payroll data while providing plan sponsors with timely visibility into participant changes through standard reporting and workflow tools. Outbound changes that would otherwise be transmitted electronically are made available through the Nationwide Plan Sponsor website, where authorized users can access detailed change reports and review updates requiring payroll system action. In addition, Nationwide's Task Center provides a centralized workflow management tool that allows plan sponsors to view, track, and manage participant-related changes through notifications, status monitoring, and activity tracking. This functionality helps ensure that required updates are identified, communicated, and completed in a timely manner, even when a fully automated outbound integration is not in place. While a fully automated bi-directional integration remains the preferred model for Nationwide, these reporting, workflow, and support capabilities provide an effective and controlled alternative for maintaining data accuracy and operational continuity when a direct outbound file consumption is not available. The Nationwide component of the blackout is typically one business day, and all transactions are prohibited during that time. The total duration of the blackout period will be dependent on the requirements of the current providers as they finalize participant data and prepare files to send to us. Yes. We can include a guarantee that the the blackout period will be no more than one day in our Service Level Agreements as part of the contract with the Plan. The total duration of the blackout period will be dependent on the requirements of the current providers as they finalize participant data and prepare files to send to us. During the pre-transition phase, contact with the prior service provider is established and the parties begin discussing the agreed-upon file layouts for converting the data and the format for the control totals. Communication with the other provider is established to determine deadlines and processing responsibilities. Governing documents and contracts will be negotiated, finalized, and provided to the Plan for review and signatures. Any necessary new programs would be developed, tested and implemented and the investment lineup is finalized. The planning phase is where any parallel testing would be processed with the previous service provider to ensure a smooth transition once the transition to Nationwide has been completed. As part of the contract negotiation, Nationwide will work with the Plan Sponsor to determine an agreed-upon financial penalty if the guarantee period is missed. We have a 100% success rate of meeting the guarantee, across all plans of all sizes. Yes. However, the guarantee is based on the receipt of data files and assets, both/all balanced and in good order, by the required process cutoffs. If data and/funds are received good order at differing times, we will be unable to apply it at the same agreed-upon contractual time. No. Upon award of the contract, a Transition Manager will be assigned. The Transition Manager assigned to transition will have overall relationship management responsibilities throughout the process and will serve as your primary point of contact. Using our 50+ years of communications experience, we will draw on tested and proven methods and partner with you to create an initial plan communication strategy that works for the Plan. These pieces introduce active participants and retirees to the plan and its features and provide participants with insights into your decision to engage Nationwide as your exclusive provider and what we offer to help them as they plan for and live in retirement. Our current offer includes materials designed specifically for governmental plan sponsors, and our standard materials offer a wide variety of themes available. For an additional one half a basis point (0.005%), we can provide the City with a custom website that will include a vanity URL, highlight your plan name and logo, reflect your plan-specific investment information, the contact information for your assigned Retirement Specialists and a plan-specific forms page. This offer also includes custom branded participant statements. Communications delivered to participants by the local Retirement Specialist can be customized with the City's logo. We begin by creating an Annual Communication and Education plan tailored to your Plan and participant needs. Annually, we will meet with the City to determine the strategy and focus for the upcoming year. Your Relationship Manager, Amber Peters, will will kick-off the planning session with a discussion around your goals. To help inform this discussion, she will bring insights based on plan health, participant feedback and trends to the Plan. He or she will also share best practices and impactful results from similar plans across the country to inform the dialogue. Throughout the year, we continually monitor and measure the effectiveness of the Plan initiatives with a strategic view toward achieving the stated goals as well as reviewing and modifying the campaign tactics. Results are shared with you continuously, along with recommendations for adjustments based on the results. With decades of awards, our experienced marketing team makes delivery of effective and engaging materials that support your strategy easy. We also collaborate with you to design and deliver a service model that meets your employees where they are at times that are convenient for them - whether over the phone, online, or at their worksite with an experienced Retirement Specialist. All of our programs are designed to help your employees take the next best step in their unique financial wellness journey your employees will be well cared for through an integrated approach that includes personal interactions and education, proactive targeted outreach, an award-winning digital experience that help ensure their needs are met. To customize support for your employees we look at multiple factors: • What does financial wellness mean to them? • Where they are in their financial wellness journey? • What can we learn from recordkeeping data and behavioral intelligence on the steps they have already taken and what is the next best step for their individual situation? Personal interactions, support, and education We offer participant access to personal interactions in ways and times they work for them. Personal services may be accessed and/or delivered in 4 ways: • Your assigned Retirement Specialist • Solutions Center Representatives • Retirement Resources Group • Nationwide Retirement Institute In every interaction, Nationwide's culture of caring, understanding and empathy shines through. Consistent feedback from participants tells us that they enjoy the strong and trusted relationships that we cultivate and how we meet them on their level to serve their unique needs.