1. Scope. Operational documentation/runbooks/process guides, searchable KB access, monthly-minimum documentation-refresh cadence, delivered via secure portal/shared-drive access to authorized personnel only. Excludes custom documentation development beyond standard templates, video/multimedia production, third-party documentation licensing, and real-time training/hands-on workshops (available separately).
2. Fees & Billing. Included at no additional charge when bundled within the vCISO Professional subscription ($2,090/month all-inclusive). Standalone pricing (if ordered outside vCISO): $290/month (includes 4 hrs/month updates); additional documentation development $150/hr; quarterly runbook refresh $400/quarter. Billed monthly in arrears on the 1st business day; Net 30. Mid-period scope/user changes prorated to next invoice. Pass-through third-party licensing/hosting costs at cost, 0% markup.
3. Term & Termination. Bundled: follows the vCISO 12-month term. Standalone: 1-month initial term with auto-renewal monthly. Auto-renews absent 60 days' non-renewal notice. Bundled termination governed by MSA §8 (60 days' notice for the entire vCISO subscription, including this component); standalone termination requires 30 days' notice, pro-rated final billing. Cause termination: 15-business-day cure, or immediate for insolvency. Post-termination: access disabled; final documentation export (.pdf/.docx) provided free within 5 business days.
4. Service Levels. 99.0% monthly uptime (a lower target than several sibling Schedules' 99.5% — offering-specific, reflecting the lower-criticality nature of documentation access), 4 hrs/month max scheduled maintenance, 7 days' advance notice. Access-issue response: P1 (total unavailability) 1 hr / P2 (partial) 4 hrs. New-documentation requests: 2 business days; routine updates: 5 business days; urgent operational-runbook updates (e.g., incident-escalation changes): 24 business hours. Support via Service Desk ticket/email; unresolved escalations route to the vCISO lead. SLA credits: 99.0–98.0% = 5%; 98.0–97.0% = 10%; <97.0% = 25% of monthly fee (sole remedy). KB search performance target: <2-second results for query sets under 100 articles.
5. Client Responsibilities. Restrict access to authorized personnel bound by Client's standard confidentiality agreement. Prohibited: downloading/reproducing content for third-party distribution without written consent, republishing on public sites/wikis/commercial platforms, credential sharing outside authorized personnel (material breach). Prohibited use: automated scraping/bulk downloading, competing-product development, runbook reverse-engineering for resale, removal of confidentiality/copyright notices. User-account management: Client's own responsibility, including credential-compromise notification and terminated-employee removal within 5 business days. Feedback provided by Client may be used by Vendor to improve KB at no cost and without attribution obligation; Client retains no ownership interest in resulting Feedback.
6. Data Handling. All KB content (runbooks, infrastructure details, security procedures, incident playbooks) is Vendor/licensor-proprietary confidential information — Client acknowledges its competitive sensitivity. Usage-log collection (accessed articles, search frequency, session duration/timing, IP-based location, device/browser) retained 12 months for KB optimization purposes (non-PII). Personal-data references within Client-specific documentation subject to Client's own privacy policies/applicable law; Client bears consent-obtaining responsibility for referenced individuals. Governed by NDA (executed 2025-12-15). Hosting via third-party infrastructure disclosed on request, sub-processor DPAs applied where vendor permits. Post-termination: 90-day backup retention for recovery requests, then permanent deletion; Client responsible for its own export/backup beyond that window.
7. Third-Party Components. Delivered via third-party wiki/documentation platforms (Confluence/Notion/GitHub Wikis or similar), disclosed prior to provisioning. Vendor dependent on but not warranting third-party infrastructure uptime/performance/policies. If platform limitations materially degrade Service, Vendor may migrate with 60 days' notice and maintained access/export during transition. Third-party-referenced materials (vendor excerpts, OSS guides) provided AS-IS under original license terms — Client bears compliance responsibility. Vendor-side platform discontinuation triggers migration to a supported alternative; first 16 hours of migration work included, additional at $150/hr.
8. Warranties. Limited warranty: professional/timely delivery, IP/licensing rights to deliver Service, at-least-monthly content-accuracy review/update. Explicit AS-IS accuracy disclaimer: no warranty of KB completeness/error-freedom, applicability to all third-party software versions, environmental compatibility without modification, or comprehensive scenario coverage. Client bears responsibility for pre-production testing of documented runbooks; Vendor provides documentation/guidance, Client executes IT operations. No fitness-for-Client's-specific-requirements warranty; no business-outcome (cost savings, operational improvement, incident prevention) guarantee. Disclaims all other implied warranties per Master §8.3.
9. Liability & Indemnification. Consequential-damages exclusion per Master §7.4. Liability cap: total fees paid in trailing 12 months (Master §7.1 default formula, no Schedule-specific floor; if standalone, cap limited to standalone-product fees only). Carve-outs per Master §7.3 (indemnification, confidentiality, gross negligence/willful misconduct, IP infringement). Vendor indemnifies IP-infringement claims regarding Documentation content excluding Client-provided materials, Client's unauthorized modification, non-Vendor-material combination, or unauthorized use. Client indemnifies for unauthorized reproduction/redistribution (§5(b)), AUP violations, Client-provided content/infrastructure details, and Client's operation of documented systems/procedures.
10. Precedence. MSA (Dec 15 2025) > NDA (Dec 15 2025) > incorporated 3VS SLA (Dec 15 2025) > this Schedule > SOWs/Change Orders — consistent with Master §2's default ladder; where this Schedule conflicts with MSA/SLA, MSA/SLA control; where SLA conflicts with this Schedule on uptime/support, the more-favorable-to-Client standard applies. Amendment: 30 days' notice, continued use post-notice = acceptance (else termination right per §3); no material fee increase during initial 12-month vCISO term or first 6 months of standalone service. Content updates may occur without prior notice; substantive procedural/policy changes flagged in KB search and monthly reporting. Directed by the vCISO work authorization (Section 19, work-authorization per source, consistent with the "order 19" citation group) and the Strategic Business Review findings.
