Dear Customers,

To address token import issues reported by a limited number of users after newly installing the SecurID 3.0.0 app on their devices, RSA has released the SecurID 3.0.1 app for iOS in the Apple App Store. Because of the small number of Android users impacted, this update is limited only to iOS users at this time.

RSA is not planning to release a new version of the SecurID app this week. RSA will issue a pre- advisory notification before updating the SecurID app for all customers.

Please see the list of frequently asked questions below for more details.

Why did RSA do a partial release?

RSA released the SecurID 3.0.1 app in the Apple App Store in response to a limited number of users that had issues after newly installing the application on their device. We are not releasing the SecurID 3.0.1 app for Android.

Summary of Possible User Actions Needed:

iOS:

• Users who downloaded 3.0.0 (fresh install or upgrade from 2.x) and did not have token import problems can continue to use 3.0.0 and should not download 3.0.1. If they download 3.0.1, they will have to re-import the tokens added after the install of 3.0.0.
• Users who downloaded 3.0.0 (fresh install or upgrade) and have token import problems will have to download and update to 3.0.1, and then import new tokens.

Android:

• Users who downloaded 3.0.0 (fresh install or upgrade) and have token import problems will have to uninstall 3.0.0, download/install 2.8 from the store, and then import all tokens.
• No action is required from Android Users who downloaded (fresh install or upgrade) 3.0.0 and did not have token import issues.

What does it look like in the App Stores?

iOS:

• Users will see 3.0.1 (red logo) in the store. This is a repackage of 2.8 (red logo) and replaces 3.0.0 (blue logo).
• Please read all FAQs related to iOS.

Android:

There are two versions on the Android store. Most of the users will see 2.8 and a very small percent of users will see 3.0.0 as explained below:

• 99% of users will see 2.8 (red logo). It is the only application currently available:
  • While users may see screenshots from 3.0.0 (blue logo), 2.8 will download.
• 1% of users may have seen 3.0.0 (blue logo) as it was available for a minimal amount of time:
  • Users should be advised not to download the app if only 3.0.0 is available to them.
• Please read all FAQs related to Android.

Will my SecurID app automatically update?

We have currently paused the auto update feature for the SecurID app for both iOS and Android users.

During the initial rollout of 3.0.1, a small fraction of iOS users with automatic updates turned on may have been upgraded to 3.0.1 (red logo). If this is the case, new tokens added or replaced in 3.0.0 (blue logo) will be lost, and users must import new tokens. Tokens that existed prior to the upgrade will continue to work.

Third-party software, such as Enterprise Mobility Management (EMM), can auto-update the SecurID app on company-managed devices. For iOS users, we recommend that you disable auto- updates until this issue is resolved. Only push the 3.0.1 update to new users or users who have reported issues with 3.0.0.

For iOS, why is the version 3.0.1 and not 2.x?

• The app stores for iOS require the release number to increase. This release is a repackage of the 2.8 app (red logo).

What are the expected behaviors with this release?

iOS:

• For Users currently on 2.x (red logo):
  • Users should not upgrade to 3.0.1.
  • No impact expected.
• New Users who downloaded 3.0.0 and failed to import tokens, or experienced other issues:
  • Upgrade to 3.0.1.
  • Users should re-import the tokens they added after the install of 3.0.0.
• For Users currently on 3.0.0 (blue logo), who did not add any new tokens, and the application is working:
  • Users should not upgrade to 3.0.1.
  • No impact expected.
• For Users currently on 3.0.0 (blue logo) who added or replaced a token in 3.0.0, and upgraded to 3.0.1 (red logo):
  • New tokens added in 3.0.0 (blue logo) will be lost. Users must import new tokens again.
  • Tokens that existed prior to the 3.0.0 upgrade will continue to work.
• Users who downloaded 3.0.0 (blue logo) as a new application on the device, added tokens, and then upgraded to 3.0.1 (red logo):
  • Token(s) will be lost. Users will have to import new token(s).
• New Users who have not downloaded the application:
  • Users should install 3.0.1 from the app store.
  • No impact expected.

Android:

• Users currently on 2.x (red logo):
  • No impact expected.
• Users currently on 3.0.0 (blue logo) and the application is working:
  • No impact expected.
• Users currently on 3.0.0 (blue logo) and the application is not working:
  • Uninstall 3.0.0 and install 2.8.0 from Google Play.
  • After installing 2.8.0, users should import all tokens.

If you have additional questions, contact RSA Customer Support.