1. Scope. OS and third-party-application patch deployment, patch-compliance monitoring/reporting, maintenance-window scheduling, and disruptive-patch approval workflow. SKU VTG-ADD-PATCH-DEV, billing unit = Managed Device, $299/device/month. Available under Packages 38–41 and standalone Package 13. Explicitly distinct from any future workload-level lifecycle SKU (VTG-ADD-LIFECYCLE-WKLD), media sanitization/decommissioning, software licensing, backup/DR, patch modification, or ransomware negotiation. Requires prerequisite enrollment in an active RMM/Jamf Pro/equivalent management platform with Vendor deployment permissions; unenrolled devices are neither billed nor serviced.
2. Fees & Billing. Monthly Fee = Billing Unit Count × $299/device, measured from the authoritative RMM/Jamf inventory source as of month-end (Platform data controls over Client's own count absent a demonstrated measurement error). Mid-month activation after the 15th bills the following month; deactivation on/before the 15th excludes that month, after the 15th bills full month (proration policy at Vendor discretion, per Order Form). Quantity dispute window: 30 days from invoice, one reopening per invoice. Net 15 invoicing, 1.5%/month late interest. Suspension trigger: [needs operator input — days-past-due left open in source], following written notice; reinstatement fee [needs operator input — amount left open].
3. Term & Termination. 12-month Initial Term from Activation Date (or month-to-month if unspecified), auto-renews 12-month periods absent 30-day non-renewal notice. Price adjustments: 90 days' notice, effective no earlier than next renewal, with cancellation right if Client rejects. Termination for breach: 30-day cure (or shorter per MSA); Vendor may terminate immediately without cure for imminent-risk conduct or legal requirement. Post-termination: new deployment ceases; report/dashboard access ends; outstanding fees due; devices revert to any retained base-management coverage.
4. Service Levels. Tiered deployment timing: Tier 1 Critical security patches within 7 calendar days of vendor release; Tier 2 Standard within 14 days; Tier 3 feature/non-critical within 30 days, during scheduled maintenance windows (custom windows accommodated where feasible). Explicit best-effort disclaimer: no guarantee a patch exists for every vulnerability, no guarantee patches are defect-free, no guarantee of universal deployment success given device/network/agent variables outside Vendor control. Monthly Portal status reports (deployment counts, failures/root causes, compliance %, known issues), retained through term + 90 days post-termination. Support: Standard 4 business hrs / Urgent (critical/large-scale) 1 business hr, M–F 8 AM–6 PM ET. Service credit available for Vendor-caused (not vendor-release-delay or Client-caused) Tier-1 timing failures, per incorporated Master §9's Service Level Credits framework; sole remedy, not a refund.
5. Client Responsibilities. Warrant consent/authority for agent deployment/management to Client devices (end-user consent, legal authority, no conflicting third-party leasing/license restrictions). Ensure devices are available/powered/networked during scheduled maintenance windows; devices offline during patch windows are reported non-compliant without Vendor liability. Designate a Patch Approver with response-window obligation (typically 5–10 business days) for disruptive-patch decisions; default-approve/default-defer election required, defaulting to deferral if unspecified. Prohibited: malware/unauthorized-modification deployment, unlawful surveillance use, agent circumvention, exploit-testing/attack use, resale/sublicense without consent. Client bears testing/validation responsibility for environment-specific compatibility beyond Vendor's representative-configuration testing.
6. Data Handling. Collects device inventory (names, hardware IDs, OS/kernel/firmware version, device type), patch deployment records (patch name/vendor/date/status/method), and compliance-status data (scores, gaps, audit logs). Used solely for Service delivery, compliance/billing reporting, troubleshooting, and improvement (aggregated/anonymized). DPA governs any embedded personal data — Client is controller, Vendor is processor. Confidentiality per NDA-equivalent standard. Post-termination: 90-day export window, then deletion absent a signed Data Retention Addendum.
7. Third-Party Components. Depends on Jamf Pro, Microsoft Intune/Configuration Manager, Kandji/Mosyle, and third-party RMM platforms — Vendor does not control or warrant their operation. Patches sourced from official OS/software/security vendors — Vendor has no control over release schedules or patch quality. Client's use of third-party management platforms subject to those platforms' own ToS; API/feature changes by third parties may impact Vendor's deployment capability without Vendor liability. Client responsible for granting/maintaining valid API access and notifying Vendor of access revocation.
8. Warranties. Limited warranty: deployment-timing commitment compliance (subject to vendor-availability/Client maintenance-window caveats), official-channel patch sourcing (unaltered/non-malicious), reasonable compatibility-testing skill and care. AS-IS/AS-AVAILABLE disclaimer per Master §8.3; explicit statement that patch management alone cannot guarantee compliance with PCI DSS/HIPAA/SOC 2 etc. — necessary but not sufficient condition (aligned to Master §8.2). Third-party-vendor-supplied patches carry their own separate warranties, if any.
9. Liability & Indemnification. Liability cap: total fees paid for this Addon in trailing 12 months (or total fees to date if <12 months) — Master §7.1 default formula, no Schedule-specific dollar floor. Excluded damages per Master §7.4. Carve-outs (indemnification, payment obligations, confidentiality, gross negligence/fraud, security/data-protection material breach) uncapped per Master §7.3. Client indemnifies for §5 breaches (unauthorized deployment/consent failures), AUP violations, Client Data IP/privacy infringement, and unlawful use. Vendor indemnifies IP-infringement claims via standard notice/control/cooperation procedure (30-day "prompt" threshold, reduced obligation if notice delayed beyond 90 days and Vendor is prejudiced).
10. Precedence. Most-specific-controls principle, then: signed MSA (Section-06 Engagement/Work Authorization) > incorporated SLA > DPA > this Schedule > Order Form/Service Delivery Agreement > general Platform ToS. Referenced master documents: MSA, SLA, DPA, NDA, AUP, and Cancellation/Refund Policy, all executed 2025-12-15 where applicable. Amendment: material renewal-term changes require 90 days' notice; non-material corrections/clarifications require as little as 30 days or retroactive notice in urgent cases; continued use = acceptance.
