1. Scope. Security Assessments (vulnerability assessment, penetration testing, architecture review, compliance gap analysis, risk quantification), SOC Monitoring (24/7/365 log aggregation, alert triage, threat hunting, anomaly detection, event investigation per incorporated SLA), Incident Response (detection/containment/remediation, forensics, root-cause analysis, evidence preservation, breach-notification coordination, post-incident review), and PCI DSS Compliance Support (gap assessment, remediation planning, evidence collection, compensating controls, audit support, attestation prep). Delivered per individual SOW.
2. Fees & Billing. Recurring monthly subscription (Professional Tier $2,090.00, invoiced 1st of month, Net 30): includes 24/7 monitoring, alert management, threat detection, incident-response coordination. Volume discounts: quarterly commitment 10%, semi-annual 30%, annual 35%. Project assessments: fixed project rate per SOW (typically $5,000–$25,000), Net 30, 50% deposit at SOW execution, balance on completion. PCI DSS: fixed-fee or T&M ($250/hr specialist rate), Net 30, milestone payments for multi-month engagements. Incident Response Retainers: monthly $1,500–$5,000 per commitment/response-time level, includes allocated IR hours, overage $350/hr, non-refundable, no carryforward. Pass-through third-party costs reimbursed at cost, no markup, requiring pre-approval above $500. USD, ACH/wire/check; 1.5%/month (18% annum) late interest, suspension eligible at 30+ days overdue. Annual price adjustment up to 3%, 30 days' notice.
3. Term & Termination. Effective on execution or per SOW date. Auto-renewal: 60 days' non-renewal notice, applies only to recurring subscription services (project assessments do not auto-renew absent separate SOW). Renewal-term changes: 90 days' notice, Client may decline without renewal penalty. Cause termination: 30-day cure, or immediate for insolvency/bankruptcy. Client convenience termination: 60 days' notice; mid-term termination of a recurring subscription during Initial/Renewal Term incurs accrued fees through billing-period end plus a 30-day-fee termination penalty. Post-termination: cessation of delivery, outstanding-deliverable completion within 5 business days, all confidential-information handling per NDA/MSA, 30-day continued SOC-monitoring transition support for terminated monitoring services. Suspension permitted for 30+ days' non-payment, insufficient cooperation, or AUP violation (without relieving payment obligations).
4. Service Levels. 99.5% monthly uptime for SOC monitoring/alert-delivery systems, excluding announced maintenance (Sundays 2–6 AM EST, 72 hrs' notice; emergency maintenance as-practicable notice). Incident response: P1 within 1 business hr, P2 within 4 business hrs, P3 within 1 business day, P4 within 3 business days. Report delivery: 10 business days of engagement completion (or per SOW). Vulnerability-remediation guidance: within 2 business days of discovery. SLA credits: 95.0–<99.5% uptime = 10% credit; <95.0% = 25% credit; <99.0% for 2 consecutive months = penalty-free termination right (sole remedy, claimed within 30 days of affected month-end). Support tiers: Tier 1 (included, 9–5 EST M–F, 4-business-hr response), Tier 2 (additional fee or IR-Retainer-included, 24/7, 1-hr P1 response), Emergency (P1, on-call hotline). Excludes Client-caused issues, force majeure, third-party failures, and announced maintenance.
5. Client Responsibilities. Timely system/network/application/data access; designated point of contact; accurate architecture/data-flow documentation; notice of infrastructure changes affecting monitoring/assessment; administrative access/credentials as needed; audit-trail maintenance for granted access. Prohibited: unauthorized third-party testing, monitoring/reporting circumvention, credential sharing, reverse-engineering monitoring tools, service interference, illegal use. Testing scope strictly limited to SOW-listed systems; Client bears responsibility for obtaining third-party/system-owner authorization; Vendor conducts no out-of-scope testing without written approval from both Client and the affected system owner. Data-handling responsibilities: pre-transmission encryption of sensitive data, access management for assessment reports, timely remediation implementation. Assessment-window cooperation: scheduling, stakeholder notice, emergency contacts, rollback/incident plan availability. 4-hour breach-notification obligation to Vendor. Client warrants engagement authority, non-violation of third-party rights/regulatory requirements, and necessary employee/stakeholder consents. Vendor holds audit rights over Client's AUP compliance.
6. Data Handling. Processes security event logs, vulnerability-scan results/config data, incident forensics/evidence, network traffic metadata, PII/payment cardholder data (if present), email metadata/phishing samples, assessment reports. Governed by incorporated NDA/MSA plus NIST CSF, ISO 27001, CIS Controls, and applicable privacy law (GDPR/CCPA/PCI DSS). Encryption: TLS 1.2+ in transit, encrypted storage with access controls, separate/annually-rotated encryption keys, optional Client-managed keys. Access limited to need-to-know analysts/IR personnel/compliance-audit staff, logged and periodically reviewed; access-control matrix available on request. Retention: assessment reports engagement-term + 1 year; event logs 90 days searchable + 1 year archived; secure deletion within 30 days of termination (certification provided), earlier deletion within 15 days on request. Subprocessors: DPAs matching or exceeding this Schedule's standard; current subprocessor list on request; 30 days' notice for changes. Regulatory support: PCI DSS/HIPAA BAA/SOX/GLB compliance documentation, audit-log maintenance, SOC 2 Type II audit pending (target Q4 2026). Breach notification: 72 hours, with cost of notification/credit-monitoring/remediation borne by Vendor for Vendor-caused breaches. Client bears endpoint/credential/pre-transmission-encryption security responsibility for data at the source. Confidentiality markings and distribution limitation required on all reports.
7. Third-Party Components. Delivered via Elastic Cloud, AWS, Google Workspace, Jamf Pro, specialized vulnerability scanners (Qualys/Nessus/Rapid7), forensic tools (EnCase/FTK), and third-party threat-intel feeds (CrowdStrike/Mandiant). Vendor not liable for third-party outages beyond its control (though it will notify Client, implement contingencies where available, and work with the vendor to restore service) — such outages are excluded from the SLA. OSS-component list available on request, provided AS-IS under respective licenses. Scanning-tool licensing: Client may need direct vendor license or Vendor-provided tool license, advised before engagement start — Client bears license-compliance responsibility. API-integration availability depends on third-party API stability/credential validity; 60 days' notice for primary-tool/infrastructure changes, with penalty-free termination right on objection.
8. Warranties. Limited warranty: professional/workmanlike performance by qualified personnel, material Schedule/MSA compliance, service-delivery rights and non-infringement, appropriate insurance coverage. SLA warranty per §4 (subject to exclusions). Deliverable-quality warranty: thoroughness, accuracy, evidence-supported findings, professional-format documentation. Explicit no-guarantee-of-complete-discovery: assessments are point-in-time (new vulnerabilities may exist undetected); SOC monitoring cannot guarantee detection of sophisticated/evasive attacks; recommended remediation is not a prevention guarantee; security posture may change between assessments. No warranty for third-party components — provided AS-IS by their vendors, Vendor not liable for vendor-caused defects. Disclaims all other warranties per Master §8.3. Sole remedy for warranty breach: SLA credit, re-performance of affected assessment, or reasonable third-party-tool workaround/substitution — claim within 30 days of discovery. Client warrants engagement authority, non-violation of third-party/legal rights, necessary consents, and accuracy of provided scope/architecture information. Explicit no-legal/regulatory-advice disclaimer — Client must consult qualified counsel/tax/compliance advisors independently.
9. Liability & Indemnification. Consequential-damages exclusion per Master §7.4, explicitly covering undetected-vulnerability/missed-incident damages, remediation/forensics/breach-notification costs (absent Vendor security-obligation breach), and Client's non-implementation of recommendations. Exceptions: gross negligence/willful misconduct, data-protection-obligation breach causing unauthorized disclosure, indemnification obligations, and MSA-level indemnification obligations remain uncapped/unexcluded. Liability cap: total amount paid in trailing 12 months (Master §7.1 default formula; if unenforceable, floor of greater of trailing-12-month payment or $50,000) — the only Schedule combining the default formula with an explicit unenforceability-fallback dollar floor. Vendor indemnifies for its own IP infringement, applicable-law breach, unauthorized data access/disclosure (§6 breach), and gross negligence/willful misconduct. Client indemnifies for AUP violations, unauthorized testing/assessment use, third-party IP-infringement claims regarding Client's systems/data, non-implementation-attributed incidents Client claims are Vendor's fault, and Client-introduced malicious code. Standard notice/control/cooperation procedure. Vendor maintains $2,000,000 per-occurrence professional liability insurance, certificate available on request.
10. Precedence. (1) MSA (Dec 15 2025) > (2) NDA (Dec 15 2025) > (3) incorporated 3VS SLA (Dec 15 2025) > (4) this Schedule (Product-Group-2-specific terms) > (5) SOW — consistent with Master §2's default ladder, subject to the standard higher-precedence-controls rule. If MSA/NDA/SLA and this Schedule are irreconcilable, MSA/NDA/SLA (in that order) prevail unless this Schedule explicitly states otherwise. All Cybersecurity Services inherit engagement governance from the vCISO Subscription Agreement (Work Order WO-2026-001), which provides the SOC-monitoring infrastructure supporting incident-response coordination and 24/7 monitoring for this product group. Amendment: written change order or formal amendment only, no verbal/email/course-of-conduct modifications; 30 days' notice for pricing changes with Client cancellation right; 30 days' notice for material scope/delivery/support changes, with Vendor's right to terminate if Client refuses security/operationally-necessary changes.
