1. Scope. Continuous security-posture assessment/gap-remediation roadmap, Tier 1 Critical vulnerability remediation activation upon go-live, security-policy/governance-framework consultation, quarterly leadership security reviews, vendor security assessment/third-party risk management, incident-response coordination/post-incident review (non-24/7), compliance-roadmap oversight (SOC 2/ISO 27001/HIPAA/PCI-DSS as applicable), monthly tactical reports and metrics-dashboard access. Excludes 24/7 SOC/hotline response (outside M–F 8 AM–6 PM ET), on-site assessments, penetration testing/red-team (separate SOW), MDR/EDR licensing, and implementation beyond advisory scope.
2. Fees & Billing. Base fee $2,090.00/month. Minimum annual commitment $25,000 for the initial 12-month term. Tiered prepayment discounts: Quarterly (3 months) 10% ($5,643/quarter); Semiannual (6 months) 30% ($8,794/half-year); Annual (12 months) 35% ($16,302/annum). Election made in writing at execution or renewal; month-to-month (no discount) is the default absent election. Invoiced 1st of month, Net 30. Late payment: 1.5%/month (18% APR). Taxes exclusive absent exemption certificate.
3. Term & Termination. 12-month Initial Term (no early termination without cause during this period, except §3.3), auto-renews 12-month Renewal Terms absent 30-day non-renewal notice; renewal-pricing adjustment by mutual agreement, else most-recent pricing continues. Vendor cause termination: 15-business-day uncured breach, 15-business-day uncured non-payment, or insolvency. Client convenience termination: written notice at any time; if during Initial Term, termination fee = lesser of (remaining monthly fees for Initial-Term balance) or 3 months' current fee; if during Renewal Term, termination fee = 1 month's current fee (waived if the Renewal Term was prepaid). Post-termination: services cease end of notice-received calendar month (or earlier by agreement); accrued fees/expenses remain due; Confidential Information/work product returned or deleted within 10 business days; dashboard access removed within 48 hours.
4. Service Levels. Governed by the incorporated 3VS Service Level Agreement, which by execution of this Schedule Client acknowledges and accepts. Tier 1 Critical remediation: 7-day initial response, 30-day remediation target, activated at no additional cost upon go-live (Tier 1 = CVSS 9.0+, unpatched RCE, default credentials on internet-facing systems, and similar imminent-risk findings). Support: email (general/non-urgent), Slack integration (Professional tier, real-time collaboration), monthly video briefings, business-hours emergency incident coordination (M–F 8 AM–6 PM ET). Dashboard/reporting-infrastructure availability: 99.5% monthly, excluding announced maintenance; if Vendor-negligence-caused shortfall, Client may request 1 day's fee credit per full 1% of downtime below threshold, capped at 5 days' fees/month. 1-business-day acknowledgment of all inquiries; escalation to CSO/VP Client Operations available in writing for unresolved matters.
5. Client Responsibilities. Designate a Project Lead with operational decision authority; provide timely access to systems/network diagrams/asset inventories/documentation necessary for assessment; authorize scanning/log-collection/configuration-review activities per Vendor methodology; assign adequate internal IT resources for remediation execution within agreed timelines. Provide system inventory/topology, existing policies/procedures/compliance documentation, critical-application/data-classification lists, current insurance/compliance certifications, employee/contractor access lists. Prohibited: law/IP-right violation, reverse-engineering/hacking Vendor tools, public/competitor sharing of Vendor reports without consent, unauthorized assignment/sublicense. Immediate incident/breach-discovery notification and investigation cooperation. Explicit remediation-execution disclaimer: Client bears execution responsibility; Vendor advises, does not implement, absent separate contract.
6. Data Handling. Governed by incorporated NDA. Confidential Information disclosed only to need-to-know bound personnel/subcontractors, or legal/regulatory authorities as required (advance notice unless prohibited). Post-termination: return/secure deletion within 30 days on request, except anonymized/aggregated benchmarking data (no identifiers) and legally-mandated-retention records. Third-party data processors (cloud infrastructure, secure storage, vulnerability databases) held to equivalent data-protection agreements; current processor list available on request. Breach-of-Confidential-Information notification: 24 hours, with investigation, documentation, and incident-response/regulatory-notification cooperation.
7. Third-Party Components. Leverages third-party vulnerability scanners (Qualys/Rapid7/Nessus), SIEM integrations, and threat-intel feeds — Client responsible for procuring/maintaining licenses for recommended tools (Vendor does not procure on Client's behalf) and providing API credentials/read-only access. Vendor not liable for service delays from Client infrastructure/connectivity outages beyond its reasonable control. No OSS license granted to Client via Vendor's own methodology tools. 60 days' advance notice for material third-party-integration/framework changes affecting Client access/reporting.
8. Warranties. Limited warranty: professional/workmanlike performance per vCISO industry standards, malware-free dashboard/reporting infrastructure, engagement authority. Explicit no-outcome-guarantee: no warranty of complete vulnerability identification, attack/compromise/data-loss immunity, regulatory-approval/certification/audit success from following recommendations, or incident prevention — security is continuous, this is advisory guidance and roadmap development, not an immunity guarantee (aligned with Master §8.2). AS-IS/AS-AVAILABLE basis subject to the incorporated SLA; Client assumes data-loss/system-failure/security-incident risk for assessed systems. No third-party-beneficiary rights created. Explicit acknowledgment that posture improvement depends on Client's remediation commitment, no specific-regulation compliance guarantee absent separate compliance-audit engagement, and recommendation quality depends on Client-provided information completeness.
9. Liability & Indemnification. Governed primarily by the MSA per this Schedule's own subordination clause — MSA controls on any conflict regarding liability caps/indemnification. Consequential-damages exclusion per Master §7.4 mirrored here (carve-outs: confidentiality breach, indemnification, gross negligence/willful misconduct). Cumulative liability cap: total fees paid or payable in the trailing 12 months (Master §7.1 default formula, no Schedule-specific dollar floor; if within first 12 months of Initial Term, cap = fees paid to date + next 3 months' fees). Vendor indemnifies for alleged patent/copyright/trade-secret infringement, material Schedule/MSA breach, and negligent performance/willful misconduct. Client indemnifies for unauthorized use of Vendor recommendations/reports, failure to implement recommended controls resulting in breach, and NDA breach/unauthorized Confidential Information disclosure. Standard notice/control/cooperation procedure, no settlement without indemnifying-party consent.
10. Precedence. (1) MSA > (2) NDA > (3) incorporated 3VS SLA > (4) this Schedule > (5) additional SOWs/purchase orders/written amendments — fully consistent with Master §2's default ladder. This Schedule is explicitly subordinate; where silent on a matter (indemnification, liability, dispute resolution, governing law), the MSA controls. Amendment: written and signed only; email confirmation from both designated contacts with subject line "SCHEDULE AMENDMENT" suffices for minor scheduling clarifications; material fee/term/scope/SLA changes require formal amendment. Serves section 06 (work-authorization) engagement terms per source.
