1. Scope. Continuous posture evaluation, CIS/NIST compliance-baseline assessment, drift detection/alerting, identity-aware device risk scoring, and posture reporting/analytics for RMM-Managed Assets. Excludes actual remediation execution (advisory only), EDR/threat-hunting/forensics/incident response, unenrolled-endpoint support, and detection/prevention guarantees. Requires active RMM enrollment (Vendor or third-party with published API integration) — Vendor does not furnish/maintain the underlying RMM platform itself.
2. Fees & Billing. Package 13 pricing tier, monthly in arrears based on active-endpoint count during the billing period (an endpoint reporting posture data ≥1 calendar day counts as active). Per-endpoint Base Service Fee per Exhibit A (Pricing Schedule). Minimum endpoint commitment per Order Form — shortfalls billed at minimum-term pricing. Net 30. Price increases annually upon renewal, 60 days' notice, Client termination right without penalty if not accepted.
3. Term & Termination. 12-month Initial Term from Activation Date, service commencing within 24 hours (or as agreed) of activation. Auto-renews 12-month periods absent 30 days' non-renewal notice. Client convenience termination: at Term end only, 30 days' notice — no mid-term convenience termination absent cause. Termination for cause: 15-day cure. Post-termination: data collection/dashboard access ceases within 5 business days; §§5, 6, 8, 9, 10 survive. Client may suspend specific endpoints without billing during suspension.
4. Service Levels. Incorporated 3VS SLA governs platform-level availability/support/incident classification. Posture-specific commitments: data freshness within 2 hours of endpoint reporting (subject to RMM/network conditions outside Vendor's control); critical alert delivery within 30 minutes of detection (or per purchased SLA tier); 99.5% monthly dashboard uptime (2-hr/month max scheduled maintenance, weekends when possible). Support scope: enrollment/configuration, connectivity/data-collection troubleshooting, results/risk-score explanation, API guidance — excludes remediation execution, RMM platform support, endpoint-level OS troubleshooting, third-party support. >2-hour Vendor-side outages trigger SLA service credits.
5. Client Responsibilities. Enroll RMM-managed endpoints, provide accurate inventory, maintain active RMM connectivity throughout Service term. Provide network access/API credentials/permissions for data collection; comply with authentication requirements (VPN, certificates, credential rotation). Notify Vendor of material environment changes. Eligible endpoints: Windows 10/11 Pro+ or Server 2016+; macOS 10.15+; RHEL/CentOS 7+, Ubuntu 18.04+, and other systemd/glibc Linux distros — non-eligible endpoint types (phones, IoT, network appliances) may be monitored but excluded from full features and SLA. Prohibited: reverse-engineering algorithms/scoring models, use beyond Client's own environment, resale, agent tampering, competitive benchmarking, unauthorized third-party access attempts. 24-hour incident-notification obligation.
6. Data Handling. Categories: endpoint inventory (hostname, hardware ID, OS/kernel/firmware, device type), configuration data (patches, security-software status, service/app inventory, baseline deviations), compliance/risk data (CIS/NIST scores, pass/fail, risk scores, remediation recommendations), and metadata (timestamps, API/audit logs). Processed solely for Service delivery/reporting/improvement, encrypted at rest and in transit (TLS 1.2+), stored per MSA/Order Form-specified region (default US). No sale/disclosure absent consent, except legal process, bound subcontractors, or anonymized aggregate benchmarking. Confidentiality: strict need-to-know limitation. Retention: term + 12 months during-Service; 30 days post-termination deletion with written certification available, subject to 90-day backup-only DR retention. Personal-data handling per NDA/DPA. Breach notification: 48 hours.
7. Third-Party Components. Integrations with Vantage RMM or third-party RMM (NinjaOne, ConnectWise, Datto RMM, etc.) via published API — no warranty of third-party availability/performance/security. CIS Benchmarks (Center for Internet Security, licensed) and NIST standards (public domain) updated on their own cadence; Vendor targets baseline updates within 90 days of major framework revisions, no real-time-alignment guarantee. Lightweight data-collection agents rely on OS APIs/network/RMM availability. No liability for third-party platform failures/breaches — Client's exclusive remedy is against the third-party vendor directly. OSS bill-of-materials/license attributions available on request.
8. Warranties. Limited warranty: professional performance by qualified personnel, conformance to Service Description/documentation, applicable-law compliance. Warranty breach remedy: correction within 15 business days or, if infeasible, penalty-free termination + pro-rata refund. Explicit disclaimer of detection/prevention completeness, data 100%-accuracy, and compliance-outcome guarantees — Client must independently validate assessments and engage qualified professionals for regulatory-compliance decisions (Master §8.2). Recommendations are advisory, not legal/regulatory/professional security advice.
9. Liability & Indemnification. Cap: lesser of (fees paid in trailing 12 months) or $10,000 (Schedule-specific flat cap per Master §7.2 — the single flat-dollar-only cap among the Addons, i.e., not a "greater of" formula). Excludes claims for indemnification, confidentiality obligations, IP-infringement indemnification, and data-breach/unauthorized-disclosure liability, which remain uncapped. Consequential-damages exclusion per Master §7.4 (lost profits/revenue/data/business opportunity/reputational harm). Vendor indemnifies IP-infringement claims via standard notice/control/cooperation procedure, with cure options (continued-use rights, non-infringing modification, or termination + pro-rata refund). Client indemnifies for §5 breaches, unlawful use, Client Data/business-practice IP or privacy infringement, and consent-failure claims.
10. Precedence. MSA > NDA (overrides conflicting confidentiality language) > incorporated SLA (overrides conflicting §4 SLA language) > this Schedule > Order Form/Service Enablement Request. Consistent with Master §2's default ladder. Amendment: written-instrument-only, signed by both parties; unilateral Vendor amendments (pricing, material scope reduction) require 60 days' notice and a penalty-free Client termination right if not accepted. This addon operates as an ancillary service under the vCISO Subscription Agreement (Work Authorization, section 19 per source, consistent with the "order 19" citation group).
