Under identical Solutions Agreements governed by New York law, Blackbaud had agreed to maintain administrative, physical, and technical safeguards, keep commercially reasonable information security procedures and standards in place, have a breach response plan ready, and provide 72-hour notice of any breach. Instead, the insureds alleged, Blackbaud failed to conduct an adequate investigation and shifted the burden onto them, handing out a “Toolkit” with instructions to complete their own investigations.