1. Scope. Enterprise vCISO advisory/strategic guidance, security monitoring/threat detection/incident-response coordination, compliance assessment/remediation planning, security reporting/metrics dashboards, vulnerability management/prioritization, and security-intelligence-platform access. Delivered in subscription tiers with defined coverage/response times/deliverables via portal, email, and scheduled meetings; Client-specific customization is out-of-scope absent separate SOW.
2. Fees & Billing. Professional tier: $2,090/month, all-inclusive. Billed in advance on Activation Date and each anniversary, unless Client elects monthly billing (5% surcharge). Taxes excluded absent exemption certificate. 1.5%/month (18% annual) late interest, Net 30. Suspension eligible at 45+ days past due, without further notice. Annual price increase up to 10%, 90 days' notice, with termination right if not accepted (subject to §3's notice/wind-down process).
3. Term & Termination. 12-month Initial Term, auto-renews annually absent 30 days' non-renewal notice. Client termination for convenience: end of Term only, 30 days' notice. Termination for material breach: uncured 30-day period; examples include 45+ days' non-payment or 5+ consecutive business days' Service-Level failure. Post-termination: Client remains liable for accrued fees; Vendor exports Client Data in standard format within 15 business days; 30-day post-termination Client Data retention, then secure deletion; Client retains rights to all generated reports/analysis/recommendations, subject to confidentiality.
4. Service Levels. 99.5% monthly platform availability, excluding scheduled maintenance (max 2 hrs/month, off-hours where practicable). Response times: Critical Security Incidents 1 business hr (incident coordinator + escalation activation); High-Priority Alerts 4 business hrs; Standard Requests 1 business day (M–F 8 AM–6 PM ET). SLA credit: 5% of monthly fee per 0.5% availability shortfall below 99.5%, capped at 30% of one month's fee, claimed within 30 days (sole remedy, exclusive of §§8/9). Support via ticketing/email/monthly advisory calls (Professional tier: 1 included/month, additional at $500/hr); emergency phone escalation during business hours. 48-hour advance notice for scheduled maintenance; emergency maintenance permitted with minimal notice for critical vulnerabilities/failures.
5. Client Responsibilities. Grant authorized (read-only where applicable) access to systems/networks/logs per onboarding scope; provide timely accurate infrastructure/incident/business-context information; maintain current contact/personnel information; designate primary security contact/escalation channel; implement recommendations in a timely manner (Vendor not liable for Client's non-implementation); maintain independent regulatory-compliance and third-party-contractual obligations. Prohibited: unauthorized security assessment of non-Client-owned systems, unauthorized third-party sharing of access/vulnerability data/threat intel, reverse-engineering, law violations, rate-limit/access-control/billing circumvention, public disclosure of methodology/pricing without consent. Breach of these terms: immediate suspension without refund, 30-day cure for unintentional/remediable violations.
6. Data Handling. Client retains ownership of all Client Data; Vendor treats it as Confidential Information under NDA. Vendor may disclose only for law/legal-process compliance (with notice where permitted), need-to-know personnel/contractors, listed subprocessors under the DPA, or de-identified aggregate research/threat-intel sharing (no Client attribution). Storage: encrypted (AES-256/TLS 1.2+), US data centers by default (alternate region available for a fee). Post-termination: 30-day retention for export/wind-down, then cryptographic erasure/physical destruction with written confirmation. Client responsible for end-user privacy notices and consent under CCPA/GDPR/HIPAA; Vendor cooperates with data-subject-rights fulfillment within 15 business days. Subprocessors bound to equivalent confidentiality/data-protection standards, current list in the DPA.
7. Third-Party Components. May integrate/rely on vulnerability databases (NVD/CVE), threat-intel feeds, EDR platforms, SIEM systems, and cloud-provider APIs, governed by those third parties' own terms — Vendor not responsible for their outages/accuracy/security or liable for their conduct. OSS components disclosed on request; used under respective licenses, no separate license granted to Client. If a critical third-party service becomes unavailable/discontinued, Vendor uses commercially reasonable efforts to provide an alternative within 30 days; absent an alternative, Client may terminate the affected portion with pro-rata refund of unused fees.
8. Warranties. Limited warranty: professional/workmanlike performance, relevant expertise/certifications (CISO/CISSP/CCSK or equivalent), platform conformance to documented specifications, non-infringement. Explicit no-security-outcome guarantee: no warranty that the Service prevents all breaches/malware/data loss/attacks — Service reduces risk and improves detection/response, it does not provide absolute protection (aligned with Master §8.2). Recommendations/guidance are advisory; implementation is Client's discretion/risk; no compliance/certification-outcome warranty. Client Data integrity/accuracy not warranted absent Vendor negligence in its own data-security obligations. Disclaims all other warranties per Master §8.3.
9. Liability & Indemnification. Consequential-damages exclusion per Master §7.4, subject to Master §7.3 carve-outs (confidentiality, indemnification, IP infringement). Cap: total fees paid in the preceding 12 months for any given 12-month claim period — Master §7.1 default formula, no Schedule-specific dollar floor. Client indemnifies for AUP violations, infringing Client Data, unauthorized Confidential Information disclosure, and failure to implement reasonable security hygiene/Vendor guidance. Vendor indemnifies IP-infringement claims for the platform as delivered/used, with cure options (continued-use rights, non-infringing modification, alternative service, or termination + prorated refund). Standard notice/control/cooperation procedure. No liability for security incidents absent proven gross negligence/willful misconduct/material data-security breach — sophisticated attacks/zero-days may occur despite reasonable efforts.
10. Precedence. MSA > NDA > incorporated SLA > this Schedule > applicable SOW/Order Form (professional-services out-of-scope work) > Vantage Platform ToS/AUP > applicable DPA/Privacy addendum. Consistent with Master §2's default ladder, with the SOW correctly positioned below both this Schedule and the SLA/NDA. Where this Schedule is silent, the incorporated master documents govern. Amendment: 30 days' notice, material-adverse-change rejection right (termination without penalty within the notice window), continued use post-notice = acceptance. Serves the section-06 engagement (work-authorization, Professional tier) per its source designation.
