Amendment

20100106.054.A.008

Between

Mobile Iron, Inc.

And

AT&T Services, Inc.

Amendment 8

to

AT&T-Mobile Iron Resale Agreement

This Amendment (this “Amend.”), effective on the date when signed by the last of the two Parties to so sign, and amending Resale Agreement No. 20100106.054.C effective April 22, 2010 (the “Agreement”), is between Mobile Iron, Inc., a Delaware corporation (“Supplier”), and AT&T Services, Inc., a Delaware corporation (“AT&T”) (each, a “Party” and together, the “Parties”).  In the event of a conflict between the terms of this Amend. and the terms of the Agreement, the terms of this Amend. will control.  Capitalized terms used but not otherwise defined in this Amend. shall have the meanings assigned to them in the Agreement.

*       *       *

Supplier and AT&T are Parties to the Agreement under which Supplier authorizes AT&T to resell Supplier’s material and services to AT&T Customers.

In consideration of the premises and the covenants hereinafter contained, the Parties agree:

1.   Section 4.28, AT&T Supplier Information Security Requirements (SISR), is added to the Agreement as follows:

4.28. AT&T Supplier Information Security Requirements (SISR)

Supplier agrees to comply with the AT&T Supplier Information Security Requirements (SISR) set forth in Appendix O attached hereto and incorporated by reference herein. Supplier agrees to provide such additional documentation as AT&T may reasonably request to demonstrate that Software and/or computer systems Supplier develops, designs, supports and/or uses under this Agreement that are subject to SISR comply with the standards and requirements set forth in SISR. [* * *]

2.   Appendix O, “Supplier Information Security Requirements (SISR)”, is added to the Agreement as it is attached to this Amend.

3.   Section 3.20, Invoicing and Payment, is deleted in its entirety and replaced as follows:

3.20 Invoicing and Payment

AT&T will provide to Supplier, Partner Reconciliation Management (PRM) settlement reports (for Material and Services other than AT&T MDM Solution) that will identify total accrued payments for the Material and Services within [* * *] days after the end of each month. The PRM reports will identify what the beginning and end dates are for each settlement period.

Supplier has up to [* * *] days from receipt of the PRM settlement reports (“Dispute Period”) to notify AT&T in writing of any discrepancy between Supplier’s records and the PRM settlement report. [* * *]

Supplier and AT&T will work together in good faith to resolve any discrepancies [* * *].   Supplier will invoice AT&T based on a final reconciliation between Supplier records and PRM settlement reports.  AT&T shall have up to [* * *] days after receipt of the invoice to pay Supplier. [* * *]

For NRC transactions, Supplier will invoice AT&T based on the Supplier’s record of actual Orders fulfilled on or before the last day of the applicable month. The invoice will include sufficient line item detail including AT&T order number, product codes, order date, ship date, unit cost, extended cost and other appropriate data to allow for validation against AT&T order activity inventory and billing records. [* * *] AT&T shall have [* * *] after receipt of a validated invoice to pay Supplier.

AT&T will also withhold for submission to the appropriate taxing authority any taxes that are charged in connection with the MRC in accordance with Section 3.36, Taxes.

If an Order or an Appendix specifies that Supplier may submit invoices for progress payments prior to Acceptance, Supplier is permitted to submit invoices at the end of each month and AT&T shall make progress payments to Supplier [* * *] days after receipt of such invoices.  Such progress payments are not to exceed [* * *] of the price of satisfactorily completed Work at the time of billing, as determined by AT&T.  Supplier shall earmark and apply such progress payments to expenses incurred for Services or Material used in performance of the Order for AT&T.

*       *       *

The terms and conditions of the Amendment in all other respects remain unchanged and in full force and effect.

Original signature transmitted and received via facsimile or other electronic transmission of a scanned document (e.g., .pdf or similar format) are true and valid signatures for all purposes hereunder and shall bind the Parties to the same extent as that of an original signature on an original document.  This Amend. may be executed in multiple counterparts, each of which shall be deemed to constitute an original but all of which together shall constitute only one document.

IN WITNESS WHEREOF, each Party has caused this Amend. to signed by its duly authorized representative.

Appendix O — AT&T Supplier Information Security Requirements (SISR)

(AT&T Supplier Information Security Requirements (SISR) — v5.2, November, 2013)

The following AT&T Supplier Information Security Requirements (“Security Requirements”) apply to Supplier, its affiliates, its subcontractors, and each of their employees and/or temporary workers, contractors, vendors and/or agents who perform any Services for, on behalf of, and/or through AT&T and/or other obligations (for the purpose of this Appendix, each or all “Supplier”) that include any of the following (such Services, the “Applicable Services”):

1.   The collection, storage, handling, or disposal of AT&T’s Information;

2.   Providing or supporting AT&T branded services using non-AT&T Information Resources (as defined below);

3.   Connectivity to AT&T’s Nonpublic Information Resources (as defined below);

4.   Incidental and/or AT&T-paid-for development of any software to the extent produced or developed by or on behalf of Supplier, or forming part of any software, pursuant to the Agreement to which these Security Requirements are attached (including under any statement of work, exhibit, order or other document under, subordinate to, or referencing this Agreement) for the development of which AT&T has been charged monies; or

5.   Website hosting and development for AT&T and/or AT&T’s customers.

Supplier represents and warrants that during the term of the Agreement that applies to the Applicable Services and thereafter (as applicable with respect to Supplier’s obligations under the Survival of Obligations clause with respect to the Applicable Services) Supplier is, and shall continue to be, in compliance with its obligations as set forth herein. [* * *] The provisions of this Appendix shall not be deemed to, and shall not, limit any more stringent security or other obligations of the Agreement. Section and paragraph headings contained in parentheses that follow the requirements below are for reference purposes only and are not to affect the meaning or interpretation of these Security Requirements.

AT&T reserves the right to update or modify its Security Requirements from time to time. Upon notification by AT&T of its need to modify the Security Requirements, Supplier agrees to promptly negotiate in good faith an amendment to the Agreement to incorporate any such modification. Supplier acknowledges that AT&T may require modifications to Security Requirements:

1.   Upon extension or renewal of the Agreement;

2.   Upon any change in work scope or other substantive modification of the Agreement; or

3.   At such time that AT&T deems reasonably necessary.

Definitions:

Unless otherwise set forth or expanded herein, defined terms shall have the same meaning as set forth in the main body of the Agreement.

“Customer Facing System(s)” means an Information Resource(s) accessible from public networks, intended for use by AT&T and/or its customers, which resides in a Demilitarized Zone (DMZ), as defined below, and where that DMZ:

a.   Is protected by firewalls located between the Internet and the DMZ, between that DMZ and all other DMZs, and between the DMZ and the AT&T intranet,

b.   Prohibits incoming TELNET connections from public networks, and

c.   Prohibits incoming File Transfer Protocol (FTP) connections from public networks except to specific   systems known as “FTP drop boxes”.

Note: A Customer Facing System which also is used by AT&T employees, contractors, vendors or suppliers to perform work on behalf of AT&T is not considered a Customer Facing System when performing such work.

“CPNI” (Customer Proprietary Network Information) as that term is defined in the Telecommunications Act of 1996, 47 U.S.C. §222 (h)(1).

“Demilitarized Zone” or “DMZ” is a physical or virtual network or sub-network that sits between a trusted internal network, such as a corporate private Local Area Network (LAN), and an untrusted external network, such as the public Internet. A DMZ helps prevent outside users from gaining direct access to internal Information Resources. Inbound packets from the untrusted external network must terminate within the DMZ and must not be allowed to flow directly through to the trusted internal network. All inbound packets which flow to the trusted internal network must only originate within the DMZ.

The DMZ must be separated from the untrusted external network by use of a Security Gateway and must be separated from the trusted internal network by use of either:

a.   another Security Gateway, or

b.   the same Security Gateway used to separate the DMZ from the untrusted external network, in which case the Security Gateway must ensure that packets received from the untrusted external network are either immediately deleted or if not deleted are routed only to the DMZ with no other processing of such inbound packets performed other than possibly writing the packets to a log.

The following must only be located within the trusted internal network:

a.   Any of AT&T’s Sensitive Personal Information (SPI) stored without the use of Strong Encryption,

b.   The official record copy of information to be accessed from requests originating from the untrusted external network,

c.   The official record copy of information to be modified as the result of requests originating from the untrusted external network,

d.   Database servers,

e.   All exported logs, and

f.   Development environments and source code.

The following must not be located within the DMZ:

a.   Authentication credentials not protected by the use of Strong Encryption.

“Incident Management Process” is a Supplier-developed documented procedure to be followed in the event of an actual or suspected attack upon, intrusion upon, unauthorized access to, loss of, or other breach involving AT&T’s Information Resources.

“Information Resource(s)” means systems, applications, networks, network elements, and other computing and information storage devices, including smart phones, tablets, and USB memory sticks, and such other resources used to store, transmit, or process AT&T Information  and/or used by Supplier in fulfillment of its obligations to provide Applicable Services under the Agreement.

“Location Based Information” or “LBI” means information that identifies the current or past location of a specific individual’s mobile device. LBI contains two factors both of which must be present and able to be associated with each other. These two factors are: (1) a mobile device’s physical location (e.g. a map address, or latitude and longitude together with altitude where known) derived from the mobile device through activities such as GPS (Global Positioning System ) or network connectivity rather than as a result of user action (e.g. revealing location in the content of an email or SMS text message), and (2) an individual’s identity derived from a unique identifier assigned to that mobile device such as customer name, MSISDN (Mobile Subscriber Integrated Services Digital Network-Number), IMSI (International Mobile Subscriber Identity), IMEI (International Mobile Station Equipment Identity) or ICCID (Integrated Circuit Card Identifier).

“Mobile and Portable Devices” means mobile and/or portable computers, devices, media and systems capable of being easily carried, moved, transported or conveyed that are used by Supplier in connection with providing Applicable Services under the Agreement. Examples of such devices include laptop computers, tablets,  USB hard drives, USB memory sticks, Personal Digital Assistants (PDAs), and wireless phones, such as smartphones.

“Nonpublic Information Resources” means those Information Resources used by Supplier to provide Applicable Services under the Agreement to which access is restricted and cannot be gained without proper authorization and identification.

“Sensitive Personal Information” or “SPI” means any information provided to Supplier by AT&T or AT&T’s Customer in connection with Supplier’s performance of the Applicable Services under the Agreement that: (a) requires a high degree of protection by law and where loss or unauthorized disclosure would require notification by AT&T to government agencies, individuals or law enforcement, and (b) any information that, if made public, could expose individuals to a risk of physical harm, fraud, or identity theft. Examples of SPI include, but are not limited to, social security numbers, national government issued identification numbers, such as passport and visa numbers, state- or province-issued identification numbers, drivers license numbers, dates of birth, bank account numbers, credit card numbers, customer authentication credentials, Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA) and Location Based Information (LBI) (as defined above). Note: Authentication credentials, encryption keys, and

encryption passwords used to protect Sensitive Personal Information are themselves classified as Sensitive Personal Information.

“Security Gateway” means a set of control mechanisms between two or more networks having different trust levels which filter and log traffic passing, or attempting to pass, between networks, and the associated administrative and management servers. Examples of Security Gateways include firewalls, firewall management servers, hop boxes, session border controllers, proxy servers, and intrusion prevention devices.

“Strong Authentication” means the use of authentication mechanisms and authentication methodologies stronger than the passwords required by Security Requirement 34 herein. Examples of Strong Authentication mechanisms and methodologies include digital certificates, two-factor authentication, and one-time passwords.

“Strong Encryption” means the use of encryption technologies with minimum key lengths of 128-bits for symmetric encryption and 1024-bits for asymmetric encryption whose strength provides reasonable assurance that it will protect the encrypted information from unauthorized access and is adequate to protect the confidentiality and privacy of the encrypted information, and which incorporates a documented policy for the management of the encryption keys and associated processes adequate to protect the confidentiality and privacy of the keys and passwords used as inputs to the encryption algorithm.

In accordance with the foregoing, Supplier shall:

System Security

1.   Actively monitor industry resources (e.g., www.cert.org and pertinent software vendor mailing lists and websites) for timely notification of all applicable security alerts pertaining to Supplier’s Information Resources. (Security Alerts)

2.   At least quarterly,  , and in addition immediately following all significant changes and upgrades, scan externally-facing Information Resources, including, but not limited to, networks, servers, and applications, with applicable industry-standard security vulnerability scanning software to uncover security vulnerabilities. (Externally-facing System Scanning)

3.   At least quarterly, and in addition immediately following all significant changes and upgrades,  scan internal Information Resources, including, but not limited to, networks, servers, applications and databases, with applicable industry-standard security vulnerability scanning software to uncover security vulnerabilities, ensure that such Information Resources are properly hardened as documented in Security Requirement 9 below, and identify any unauthorized wireless networks. (Internal System Scanning)

4.   RESERVED

5.   In environments where such technology is commercially available and to the extent practicable, deploy one or more Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), or Intrusion Detection and Prevention Systems (IDP) in an active mode of operation that monitors all traffic entering and leaving Information Resources in conjunction with the Agreement. (Intrusion Detection/Prevention Systems)

6.   Have and use a documented process to remediate security vulnerabilities in the Information Resources, including, but not limited to, those discovered through industry publications, vulnerability scanning, virus scanning, and the review of security logs, and apply appropriate security patches promptly with respect to the probability that such vulnerability can be or is in the process of being exploited. (Remediating/Patching Service Vulnerabilities)

7.   Assign security administration responsibilities for configuring host operating systems to specific individuals. (Security Administration Responsibilities)

8.   Require that its technology personnel performing the Applicable Services have reasonable and necessary experience in information and network security. (Necessary Staff Experience)

9.   Ensure that all of Supplier’s Information Resources are and remain ‘hardened’ including, but not limited to, removing or disabling unused network and other services (e.g., finger, rlogin, ftp, and simple Transmission Control Protocol/Internet Protocol (TCP/IP) services) and installing a system firewall, Transmission Control Protocol (TCP) wrappers or similar technology. (Hardened Systems)

10. Change all default account names and/or default passwords. (Changing Default Account Names and Passwords)

11. Limit system administrator (also known as root, privileged, or super user) access to operating systems intended for use by multiple users only to individuals requiring such high-level access in the performance of their jobs. (Limit Super User Privileges)

12. Require application, database, network and system administrators to restrict access by users to only the commands, data and Information Resources necessary for them to perform authorized functions. (Administrators to Restrict User Access)

Physical Security

13. Ensure that all of Supplier’s Information Resources intended for use by multiple users are located in secure physical facilities with access limited and restricted to authorized individuals only. (Information Resources in Secure Facilities)

14. Monitor and record, for audit purposes, access to the physical facilities containing Information Resources intended for use by multiple users used in connection with Supplier’s performance of its obligations under the Agreement. (Monitoring and Recording Access)

Network Security

15. When providing Internet-based services to AT&T, protect AT&T’s Information by the implementation of a network DMZ. Web servers providing service to AT&T shall reside in the DMZ. Information Resources storing AT&T’s Information (such as application and database servers) shall reside in a trusted internal network. (Internet Services Must Use DMZ)

16. Within thirty (30) days following AT&T’s written request, provide to AT&T a logical network diagram documenting the Information Resources (including, but not limited to, Security Gateways, servers, etc.) that will support the Applicable Services being provided to AT&T. (Provision of Logical Network Diagram)

17. Have  a documented process and controls in place to detect and handle unauthorized attempts to access AT&T’s Information. (Detection and Handling of Unauthorized Access)

18. a.   Use Strong Encryption for the transfer of AT&T’s Information outside of AT&T-controlled or Supplier-controlled networks or when transmitting AT&T’s Information over any untrusted network.

b.   Additionally, by no later than July 1, 2014, always use Strong Encryption to AT&T’s SPI when transmitted over any AT&T- or Supplier-controlled network.

(Note: This also applies to AT&T Information contained in email, or the attachments embedded within the email, as the case may be. For greater clarity, if, for example, the text in an email does not contain AT&T’s Information, but the embedded attachments within that email do contain AT&T’s Information, then the embedded attachments, but not the email, need to be encrypted.) (Encryption of Information in Transit)

19. Require Strong Authentication for any remote access use of Nonpublic Information Resources. (Remote Access Authentication)

Information Security

20. Isolate AT&T’s applications and AT&T’s Information from any other customer’s or Supplier’s own applications and information either by using physically separate servers or alternatively by using logical access controls where physical separation of servers is not implemented. (Separate AT&T’s Information from non-AT&T information)

21. Have documented procedures for the secure backup and recovery of AT&T’s Information which shall include, at a minimum, procedures for the transport, storage, and disposal of the backup copies of AT&T’s Information and, within thirty (30) days following AT&T’s written request, provide such documented procedures to AT&T. (Secure Backup, Transport, Storage and Disposal of AT&T’s Information)

22. Maintain and, upon AT&T’s request, furnish to AT&T a high level, documented disaster recovery plan that is designed to ensure that Supplier can meet its contractual obligations to perform the Applicable Services under the Agreement, including the requirements of any applicable Statement of Work or Service Level Agreement. Such plan shall include the requirement that the included selected procedures be regularly tested at least annually. Supplier shall promptly review such plan to address additional threat scenarios. . (Disaster Recovery Plan)

23. Use Strong Encryption to protect AT&T’s SPI when stored. (Encryption of SPI at Rest/Storage)

24. Limit access to AT&T’s Information, including, but not limited to, paper hard copies, only to authorized persons or systems. (Limit Access to AT&T’s Information Regardless of Form)

25. Be compliant with any applicable government- and industry-mandated information security standards. (Examples of such standards include, but are not limited to, the Payment Card Industry-Data Security Standards (PCI-DSS), National Automated Clearing House Associates (NACHA) Rules, and Electronic Data Interchange (EDI) standards, and the

information security requirements documented within laws, such as HIPAA.) (Compliance with Industry and Government Requirements)

26. To the extent permitted under applicable law and/or the relevant agreement under which Customer Information was obtained by Supplier in performing Services under this agreement  (if applicable), at no additional charge to AT&T:

a.   Upon AT&T’s request, provide copies of any of AT&T’s Information to AT&T within thirty (30) days of such request.

b.   Return, or, at AT&T’s option, destroy all of AT&T’s Information, including electronic and hard copies, within thirty (30) days after the sooner of:

i.   expiration or Termination of the Agreement;

ii.   AT&T’s request for the return of AT&T’s Information; or

iii.   the date when Supplier no longer needs AT&T’s Information to perform Services under the Agreement.

c.   In the event that AT&T approves destruction as an alternative to returning AT&T’s Information, then certify in writing the destruction (e.g., degaussing, overwriting, performing a secure erase, performing a chip erase, shredding, cutting, punching holes, breaking, etc.) as rendering AT&T’s Information non-retrievable.

d.   In the event that Supplier needs to retain copies of AT&T’s Information more than thirty (30) days past either the expiration or Termination of the Agreement, or AT&T’s request for the return or destruction of AT&T’s Information, Supplier shall be allowed to retain such copies when elsewhere agreed to in writing with AT&T. Exception: Copies of AT&T’s Information retained as part of a backup-and-recovery, business continuity or disaster recovery process may be retained for more than thirty (30) days past the expiration or Termination of the Agreement without obtaining agreement in writing from AT&T allowing such retention provided that all such copies are destroyed within no more than three (3) years of the date of creation. (Return of AT&T’s Information)

27. Unless otherwise instructed by AT&T in writing,  all Information collected generated or  processed by Supplier for, through or on behalf of AT&T in connection with performing the Applicable Services or otherwise under the AT&T brand shall be deemed to be AT&T Information. , Supplier shall treat all such Information as AT&T Information and whenever practicable, label such Information of AT&T as “AT&T Proprietary Information” or at a minimum, label AT&T’s Information as “Confidential” or “Proprietary”. Supplier acknowledges that AT&T’s Information shall remain AT&T-owned Information irrespective of labeling or the absence thereof. (Confidential or Proprietary Markings)

Identification and Authentication

28. Assign unique UserIDs to individual users. (Unique UserIDs)

29. Have and use a documented UserID lifecycle management process including, but not limited to, procedures for approved account creation, timely account removal, and account modification (e.g., changes to privileges, span of access, functions/roles) for all Information Resources and across all environments (e.g., production, test, development, etc.). Such

process shall include review of access privileges and account validity to be performed at least annually. (UserID Life Cycle Management)

30. Enforce the rule of least privilege (i.e., limiting access to only the commands and Information Resources necessary to perform authorized functions according to one’s job function). (Rule of Least Privilege)

31. Where multi-factor user/device authentication is not employed, limit failed login attempts to no more than six (6) successive attempts and lock the user account upon reaching that limit. Access to the user account can be reactivated subsequently through a manual process requiring verification of the user’s identity or, where such capability exists, can be automatically reactivated after at least three (3) minutes from the last failed login attempt. Exception: Where elsewhere authorized in writing by AT&T, AT&T customer usage of Customer Facing Systems may be exempted from this requirement. (Limit Failed Logins)

32. Where multi-factor user/device authentication is not employed, terminate interactive sessions, or activate a secure, locking screensaver requiring authentication, after a period of inactivity not to exceed fifteen (15) minutes. Exception: Where elsewhere authorized in writing by AT&T, AT&T customer usage of Customer Facing Systems may be exempted from this requirement. (Terminate Inactive Interactive Sessions)

33. Require password expiration at regular intervals not to exceed one hundred eighty (180) days. Exception: Where elsewhere authorized in writing by AT&T, AT&T customer usage of Customer Facing Systems may be exempted from this requirement. (Expire Passwords)

34. a.   Use an authentication method based on the sensitivity of AT&T’s Information. Whenever authentication credentials are stored, Supplier shall protect them using Strong Encryption.

b.   When passwords are used, they shall be complex and shall at least meet the following password construction requirements:

   Be a minimum of six (6) characters in length.

   Contain characters from at least two (2) of these groupings: alphabetic, numeric, and special characters.

   Not be the same as the UserID with which they are associated.

   To the extent possible under the applicable software or hardware, not contain repeating or sequential characters or numbers.

Exception: Where elsewhere authorized in writing by AT&T, AT&T customer usage of Customer Facing Systems may be exempted from the password construction requirements.

c.   Applications housing more sensitive copies of AT&T’s Information, as identified in writing by AT&T, may require an authentication mechanism stronger than passwords. In such case the authentication mechanism shall be mutually agreed to in advance in writing. Examples of stronger authentication methods include Strong Authentication, passphrases, and biometrics. (Passwords and Construction Rules)

35. Use a secure method for the conveyance of authentication credentials (e.g., passwords) and authentication mechanisms (e.g., tokens or smart cards) for Supplier personnel who are authorized to have access to Supplier’s production systems that process AT&T’s Information. (Use Secure Method to Convey UserIDs and Passwords)

Warning Banner

36. For AT&T branded products or services or for software developed for AT&T, display a warning banner on login screens or pages as specified in writing by AT&T. (Display Warning Banners)

Software and Data Integrity

37. In environments where antivirus software is commercially available and to the extent practicable, (it being acknowledged that it is not practicable or required where a server merely hosts data for storage or retrieval but, itself, does not have access to such data), have current antivirus software installed and running to scan for and promptly remove or quarantine viruses and other malware.   (Note: For the avoidance of doubt, this requirement also applies to Mobile and Portable Devices where antivirus software is commercially available.) Supplier fully complies with this requirement for laptop devices but other portable devices do not employ antivirus software due to usage of compensating control by using containerized software that limits access to the Information .(Scan and Remove Viruses)

38. Separate non-production Information Resources from production Information Resources. (Separate Production and Non-Production Information Resources)

39. Have a documented change control process including back-out procedures for all production environments. (Software Change Control Process)

40. For applications which utilize a database that allows modifications to AT&T’s Information, have database transaction logging features enabled and retain database transaction logs for a minimum of six (6) months. (Utilize Database Transaction Logging)

41. a.   For all software developed under a statement of work under  this Agreement, review such software to find and remediate security vulnerabilities during initial implementation and upon any modifications and updates.

b.   Where technically feasible, for all software used, furnished and/or supported in connection with providing such Services under the Agreement, review such software to find and remediate security vulnerabilities during initial implementation and upon any modifications and updates. (Review Code for Vulnerabilities)

42. Perform quality assurance testing for the security components (e.g., testing of identification, authentication and authorization functions), as well as any other activity designed to validate the security architecture, during initial implementation and upon any modifications and updates. (Quality Assurance Test Security Components)

Privacy Issues

43. Restrict access to any of AT&T’s CPNI and AT&T’s SPI to authorized individuals. (Restrict Access to AT&T CPNI and SPI)

44. e Not store  AT&T’s CPNI and AT&T’s SPI on removable media (e.g., USB flash drives, thumb drives, memory sticks, tapes, CDs, or external hard drives) except: (a) for backup, business continuity, disaster recovery, and data interchange purposes as allowed and required under contract, and (b) using Strong Encryption. Exception: Where elsewhere authorized in writing by AT&T, AT&T’s CPNI stored for distribution to AT&T’s customers may be exempted from this requirement. (Control AT&T CPNI and SPI on Removable Media)

Monitoring and Auditing Controls

45. Restrict access to security logs to authorized individuals, and protect security logs from unauthorized modification. (Restrict Access to Security Logs)

46. Maintain an automated security log alert function and, when alerted,  review the applicable security and security-related audit logs for anomalies and document and resolve all logged security problems in a timely manner. (Review Security Logs and Resolve Security Problems)

). Retain complete and accurate records relating to its performance of its obligations arising out of these Security Requirements that require a record to be kept or be able to demonstrate Supplier’s compliance herewith in a format that will permit assessment or audit for a period of no less than one (1) year, or longer as may be required pursuant to a court order or civil or regulatory proceeding. Notwithstanding the foregoing, Supplier shall only be required to maintain security logs for a minimum of six (6) months. (Retain Records)

AT&T to conduct an assessment or audit to verify Supplier’s compliance with its contractual obligations in connection with these AT&T Supplier Information Security Requirements. Upon AT&T’s request for audit, Supplier shall schedule a security audit to commence within thirty (30) days from such request. In the event that AT&T,  and Supplier mutually agree  a security breach has occurred, which has not been promptly reported to AT&T in compliance with the Supplier’s Incident Management Process, Supplier shall schedule the audit to commence within  five (5)  days of AT&T’s notice requiring an audit. This provision shall not be deemed to, and shall not, limit any more stringent audit obligations permitting the examination of Supplier’s records contained in the Agreement. (Audit Rights)

49. Within thirty (30) days of receipt of the assessment or audit report, provide AT&T a written report outlining the corrective actions that Supplier has implemented or proposes to implement with the schedule and current status of each corrective action. Supplier shall update this report to AT&T every thirty (30) days reporting the status of all corrective actions through the date of implementation. Supplier shall implement all corrective actions within ninety (90) days of Supplier’s receipt of the assessment or audit report. (Remediate Audit Findings)

Reporting Violations

50. Have and use an Incident Management Process and promptly notify AT&T whenever there is an attack upon, intrusion upon, unauthorized access to, loss of, or other breach of AT&T’s Information Resources at:

a.   Asset Protection by telephone at 800-807-4205 from within the US and at 1-908-658-0380 from elsewhere, and

b.   Supplier’s contact within AT&T for Service-related issues.

(Maintain and Use Incident Response Procedures)

51. After notifying AT&T whenever there is a known attack upon, intrusion upon, unauthorized access to, loss of, or other breach of AT&T’s Information Resources that are under Supplier’s control, provide AT&T with regular status updates, including, but not limited to, actions taken to resolve such incident, at mutually agreed intervals or times for the duration of the incident and, within five (5) business days of the closure of the incident, provide AT&T with a written report describing the incident, actions taken by the Supplier during its response and Supplier’s plans for future actions to prevent a similar incident from occurring. (Provide AT&T Incident Response Status and Final Resolution)

Software Development

52. RESERVED

Security Policies and Procedures

53. Require that all personnel, subcontractors or representatives performing Applicable Services under this Agreement are in compliance with these Security Requirements. (All Work to Be In Compliance with SISR)

54. RESERVED

55. Return all AT&T-owned or -provided access devices (including, but not limited to, SecurID® tokens and/or software) as soon as practicable, but in no event more than fifteen (15) days after the sooner of: (a) expiration or Termination of the Agreement; (b) AT&T’s request for the return of such property; or (c) the date when Supplier no longer needs such devices. (Return all AT&T Owned or Provided Access Devices)

Mobile and Portable Devices

56 Use Strong Encryption to protect all of AT&T’s Information stored on Mobile and Portable Devices

57 Use Strong Encryption to protect all of AT&T’s Information transmitted using or remotely accessed by network-aware Mobile and Portable Devices.

58 a.   When using network aware Mobile and Portable Devices that are not laptop computers to access and/or store AT&T’s Information, such devices must be capable of deleting all stored copies of AT&T’s Information upon receipt over the network of a properly authenticated command. (Note: Such capability is often referred to as a “remote wipe” capability.)

b.   Have documented policies, procedures and standards in place to ensure that the authorized individual who should be in physical control of a network-aware Mobile and Portable Device that is not a laptop computer and that is storing AT&T’s Information.  Authorized user must  promptly notify Supplier when such individual becomes aware that the device has been lost or stolen so that Supplier can initiate the remote wipe of all AT&T’s Information when the device becomes lost or stolen.

c.   Have documented policies, procedures and standards in place to ensure that Mobile and Portable Devices that are not laptop computers and are not network aware are prohibited from storing AT&T’s Information.

59. Have documented policies, procedures and standards in place which ensure that any Mobile and Portable Devices used to access and/or store AT&T’s Information:

a.   Are in the physical possession of authorized individuals;

b.   Are physically secured when not in the physical possession of authorized individuals; or

c.   Have their data storage promptly and securely deleted when not in the physical possession of authorized individuals nor physically secured.

60. Prior to allowing access to AT&T’s Information stored on or through the use of Supplier administered or managed Mobile and Portable Devices, Supplier shall have and use a process to ensure that:

a.   The user is authorized for such access; and

b.   The identity of the user has been authenticated.

61. Implement a policy that prohibits the use of any Mobile and Portable Devices that are not administered and/or managed by Supplier or AT&T to access and/or store AT&T’s Information.

62. Review, at least annually, the policies governing the use of, and controls for, all Supplier-administered or -managed Mobile and Portable Devices that access or store AT&T’s Information to confirm that such policies are appropriately designed to ensure that such  Mobile and Portable Devices can meet the applicable Security Requirements.

Security Gateways

63. Require Strong Authentication for administrative and/or management access to Security Gateways, including, but not limited to, any access for the purpose of reviewing log files.

64. Have and use documented controls, policies, processes and procedures to ensure that unauthorized users do not have administrative and/or management access to Security Gateways, and that user authorization levels to administer and manage Security Gateways are appropriate.

At least once every six (6) months, take reasonable measures designed to ensure that Security Gateway configurations are hardened by selecting a sample of Security Gateways and verifying that each default rule set and set of configuration parameters is configured to provide the expected result against a sample risk or threat using some of the following:

a.   Internet Protocol (IP) source routing is disabled,

b.   The loopback address is prohibited from entering the internal network,

c.   Anti-spoofing filters are implemented,

d.   Broadcast packets are disallowed from entering the network,

e.   Internet Control Message Protocol (ICMP) redirects are disabled,

f.   All rule sets end with a “DENY ALL” statement, and

g.   Each rule is traceable to a specific business request.

66. Ensure that monitoring tools are used to validate that all aspects of Security Gateways (e.g., hardware, firmware, and software) are continuously operational.

67. Ensure that all Security Gateways are configured and implemented such that all non-operational Security Gateways shall deny all access.

Wireless Networking

68. When using radio frequency (RF) based wireless networking technologies to perform or support Services for AT&T, ensure that all of AT&T’s Information transmitted is protected by the use of appropriate encryption technologies sufficient to protect the confidentiality of AT&T’s Information; provided, however, that in any event such encryption shall use no less than key lengths of 256-bits for symmetric encryption and 256-bits for asymmetric encryption. Exception: The use of RF-based wireless headsets, keyboards, microphones, and pointing devices, such as mice, touch pads, and digital drawing tablets, is excluded from this requirement.

Connectivity Requirements

Connectivity requirements are not applicable to services being provided under this
agreement. Supplier is prohibited from any form of connectivity into AT&T’s non-public
network to provide services under this agreement

69. In the event that a data connection agreement, such as a “Master Data Connection Agreement,” “Data Connection Agreement,” and/or “Connection Supplement” (“DCA”) exists between the Parties, and incorporates the Agreement by reference, or is otherwise integrated with, or used to govern the Parties’ connectivity obligations under, this Agreement, agree that any information security requirements incorporated within such DCA are hereby superseded by the terms of these Security Requirements, effective as of the date these Security Requirements become effective under the Agreement, and the terms of such DCA are amended to require that the Security Requirements and not the information security requirements incorporated within the DCA are controlling in the Agreement (as well as any agreements subordinate to the Agreement). Notwithstanding the foregoing, the DCA remains in full force and effect for all other agreements between the Parties to which it applies.

70. In the event that Supplier has, or will be provided, connectivity to AT&T’s or AT&T’s customers’ Nonpublic Information Resources in conjunction with this Agreement, then in addition to the foregoing:

a.   Use only the mutually agreed upon facilities and connection methodologies to interconnect AT&T’s and AT&T’s customers’ Nonpublic Information Resources with Supplier’s Information Resources.

b.   NOT establish interconnection to AT&T’s and AT&T’s customers’ Nonpublic Information Resources without the prior consent of AT&T.

c.   Provide AT&T access to any applicable Supplier facilities during normal business hours for the maintenance and support of any equipment (e.g., router) provided by AT&T under

the Agreement for connectivity to AT&T’s and AT&T’s customers’ Nonpublic Information Resources.

d.   Use any equipment provided by AT&T under this Agreement for connectivity to AT&T’s and AT&T’s customers’ Nonpublic Information Resources only for the furnishing of those Services or functions explicitly authorized in the Agreement.

e.   If the agreed upon connectivity methodology requires that Supplier implement a Security Gateway, maintain logs of all sessions using such Security Gateway. These session logs must include sufficiently detailed information to identify the end user or application, origination IP address, destination IP address, ports/service protocols used and duration of access. These session logs must be retained for a minimum of six (6) months.

71. In the event that Supplier has, or will be provided, connectivity to AT&T’s or AT&T’s customers’ Nonpublic Information Resources in conjunction with this Agreement, in addition to other rights set forth herein, permit AT&T to:

a.   Gather information relating to access, including Supplier’s access, to AT&T’s and AT&T’s customers’ Nonpublic Information Resources. This information may be collected, retained and analyzed by AT&T to identify potential security risks without further notice. This information may include trace files, statistics, network addresses, and the actual data or screens accessed or transferred.

b.   Immediately suspend or terminate any interconnection to AT&T’s and AT&T’s customers’ Nonpublic Information Resources if AT&T, in its sole discretion, believes there has been a breach of security or unauthorized access to or misuse of AT&T data facilities or AT&T Information Resources.

BLANK PAGE

Amendment

No. 20100106.054.A.009

Between

MobileIron, Inc.

And

AT&T Services, Inc.

Amendment NO. 9

TO

AGREEMENT NO. 20100106.054.C

After all Parties have signed, this Supplement is made effective as of the last date signed by a Party (“Effective Date”) and is between MobileIron, Inc., a Delaware corporation (“Supplier”), and AT&T Services, Inc., a Delaware corporation (“AT&T”), each of which may be referred to in the singular as a “Party” or in the plural as the “Parties.”

WITNESSETH

WHEREAS, Supplier and AT&T entered into Agreement No. 20100106.054.C on April 22, 2010, (the “Agreement”), as previously amended; and

WHEREAS, Supplier and AT&T desire to supplement the Agreement, solely with respect to the Services provided by Supplier in relation to educational institutions, as described below, as hereinafter set forth.

NOW, THEREFORE, in consideration of the premises and the covenants hereinafter contained, the Parties hereto agree as follows:

1.   The following definition of Student Information is added to Section 2.11, Customer Information:

“Student Information” means Customer Information that is  Personally Identifiable Information identified in 34 C.F.R. § 99.3 that is provided by AT&T, its Affiliates or AT&T’s Customer to Supplier or is otherwise obtained by Supplier in connection with providing services to educational institutions under this Agreement.

2.   Section 3.17., b.5.,  Information, is hereby deleted in its entirety and replaced with the following:

“ 5. upon the disclosing Party’s request, promptly return, or destroy all or any requested portion of the Information, including but not limited to Customer Information relating to a particular individual that is used, accessed or stored by Supplier in its provision of the Service, including tangible and electronic copies, notes, summaries, extracts, mail or other communications, and upon written request provide written certification within 15 business days to the disclosing Party that such Information has been returned or destroyed, provided

that, except for Student Information, with respect to archival or back-up copies of Information that reside on the receiving Party’s systems, the receiving Party shall be deemed to have complied with its obligations under this clause  if it makes reasonable efforts to expunge from such systems, or to permanently render irretrievable, such copies.”

3.   Section 4.5, Customer-Information, of the Agreement is hereby amended by adding subsection m. as follows:

“m. Before providing any individual, including but not limited to Supplier’s officers, employees, agents or contractors, with access to Student Information, Supplier shall provide training to all such individuals covering the obligations of Supplier, including its officers, employees, agents and contractors, regarding the use, protection and safeguarding of Student Information in accordance with this Agreement and applicable law.”

4.   Section 4.5, Customer-Information, of the Agreement is hereby amended by adding the following to subsection n. as follows:

“n. Supplier must encrypt Student Information that is transmitted, processed, or stored by Supplier on MobileIron Cloud or other future similar Supplier hosted services as defined in Amendment no. 17 to Supplement no. 1 to the Agreement, while in motion or in its custody from unauthorized disclosure using a technology specified by the U.S. Department of Health and Human Services in guidance issued under Section 13402(H)(2) of Public Law 111-5.”

5.   Section 4.5, Customer-Information, of the Agreement is hereby amended by adding subsection o. as follows:

“o. In no event may Supplier use Customer Information for any targeted marketing or advertising.”

6.   Section 4.5, Customer-Information, of the Agreement is hereby amended by adding subsection p. as follows:

“p. At AT&T’s request, Supplier shall provide to AT&T a copy of all Student Information pertaining to specific individual(s) that is used, accessed or stored by Supplier in its provision of Services, and shall correct any erroneous personally-identifiable information pertaining to Users who are pre-K-12 students, provided that AT&T or Customer informs Supplier of the nature of the erroneous information.”

7.   Section 4.5, Customer-Information, of the Agreement is hereby amended by adding subsection q. as follows:

“q. For purposes of providing Services pursuant to this Amendment, Supplier shall comply with all requirements under laws applicable to the Supplier as a subcontractor to AT&T regarding the use of, and access to, information of Users who are minor children, pupils, students and their parents and guardians.”

The terms and conditions of the Agreement in all other respects remain unmodified and in full force and effect.

Original signatures transmitted and received via facsimile or other electronic transmission of a scanned document, (e.g., .pdf or similar format) are true and valid signatures for all purposes hereunder and shall bind the Parties to the same extent as that of an original signature.  This Amendment may be executed in multiple counterparts, each of which shall be deemed to constitute an original but all of which together shall constitute only one document.

IN WITNESS WHEREOF, the Parties have caused this Amendment to the Agreement to be executed, as of the Effective Date.

BLANK PAGE

Amendment

No. 20100106.054.A.010

between

AT&T Services, Inc.

and

MobileIron, Inc.

AMENDMENT NO. 10
TO
AGREEMENT NO. 20100106.054.C

After all Parties have signed, this Amendment is made effective as of the last date signed by a Party (“Effective Date”) and is between MobileIron, Inc., a Delaware corporation (“Supplier”), and AT&T Services, Inc., a Delaware corporation (“AT&T”), each of which may be referred to in the singular as a “Party” or in the plural as the “Parties”.

WITNESSETH

WHEREAS, Supplier and AT&T entered into Agreement No. 20100106.054.C on April 22, 2010 (the “Agreement”), as previously amended; and

WHEREAS, Supplier and AT&T desire to amend the Agreement as hereinafter set forth.

NOW, THEREFORE, in consideration of the premises and the covenants hereinafter contained, the Parties hereto agree as follows:

1.   Appendix B, Supplier’s Price (s): Delete existing Appendix B, Supplier’s Price (s) and replace with the attached Appendix B, Supplier’s Price (s).

The terms and conditions of the Agreement in all other respects remain unmodified and in full force and effect.

Original signatures transmitted and received via facsimile or other electronic transmission of a scanned document, (e.g., .pdf or similar format) are true and valid signatures for all purposes hereunder and shall bind the Parties to the same extent as that of an original signature.  This Amendment may be executed in multiple counterparts, each of which shall be deemed to constitute an original but all of which together shall constitute only one document.

IN WITNESS WHEREOF, the Parties have caused this Amendment to the Agreement to be executed, as of the Effective Date.

Appendix B, Supplier’s Price(s)

Price List-New Seats

Price List Upgrades