1. Scope. Technical JSON-Schema-governed infrastructure layer: proposal.schema.json, commercial/authorization.schema.json (WorkAuthorization envelope), commercial/line-item.schema.json, report/section.schema.json, and findings/*.schema.json. Defines structure/validation contracts only — excludes report execution/rendering (separate Reporting Service terms), data collection/assessment delivery (vCISO Subscription terms), and artifact hosting/storage/transmission (separate Artifacts & Infrastructure terms). Authoritative runtime for authorization state is the production VantageArtifacts\Artifact class and AuthorizationService::authorize() method; this Schedule documents pre-/post-authorization data shapes only, with runtime behavior governed equally by production code and this Schedule.
2. Fees & Billing. No direct billing — "n/a (schema/infra layer)." Included as a bundled component of the active vCISO Subscription; no separate license/access/per-use fees. Access terminates with subscription termination per §3. Custom schema extensions/definitions are NOT included in the base subscription — subject to separate SOW/T&M/change order with mutually agreed written pricing.
3. Term & Termination. Coterminous with the active vCISO Subscription per applicable Service Order (12-month term per section-06 engagement terms, source-designated work-authorization). Auto-renews 12-month periods absent 60 days' non-renewal notice. Client convenience termination: 90 days' notice, subject to MSA early-termination penalties. Cause termination: 30-day uncured breach. Underlying-subscription termination auto-terminates this Schedule. Post-termination: access ceases immediately; Client must cease Schema-Suite use in new workflows within 30 days; existing reports/artifacts remain Client property but cannot be updated/re-authorized using the Schema Suite post-termination; no post-termination maintenance/support obligation.
4. Service Levels. Governed by incorporated 3VS SLA for schema-hosting/validation-endpoint availability. Versioning: quarterly typical release cadence (or critical security/compliance updates as needed); 12-month backward-compatibility window; breaking changes require 60 days' advance notice, with dual-version support during transition; deprecation flagged ≥90 days before removal. Validation-endpoint uptime: 99.5% monthly (per incorporated SLA), business-hours availability. Performance: ≤500ms validation response for payloads ≤10MB; schema-update deployment ≤24 hrs (≤2 hrs for critical security patches); documentation updates concurrent with schema releases. Support: schema-interpretation/validation-troubleshooting during standard hours; critical production-authorization-affecting issues escalated to engineering within 4 business hours. Explicitly excludes: custom/Client-authored extension support, semantic/data-quality validation beyond structure, Client-system integration, Client-side performance tuning, and JSON Schema training.
5. Client Responsibilities. Use the Schema Suite solely for generating/validating/authorizing Vantage reports and commercial artifacts within the active vCISO Subscription scope. Prohibited: redistribution/sublicensing without written consent, reverse-engineering/deriving proprietary logic, unauthorized modification/derivative works, competing-product use, out-of-subscription-scope use (e.g., independent resale of schema-validated reports). Ensure submitted data is accurate/complete/authentic; validate against the Schema Suite before production commitment; report validation errors/ambiguities with reproduction steps. Test in staging/pre-production before production authorization use. Compliance responsibility: applicable-law adherence (CCPA/GDPR/HIPAA as applicable) for any schema-validated artifact, including data-subject consent obtainment.
6. Data Handling. Schemas define structures for commercial data (proposals, line items, pricing, authorization metadata), security/compliance findings (vulnerabilities, remediation, evidence references), operational data (assessment dates/assessor IDs/scope), and Client-identifying information. PII fields (names, emails, phone, IP addresses of key personnel) may appear — Client bears consent/legal-basis responsibility and must notify Vendor if PII is inadvertently included in a payload that should not contain it. Schemas themselves are Vendor Confidential Information under NDA — Client must restrict access to need-to-know authorized personnel, no competitor/public/third-party disclosure without written consent. Client artifacts/proposals/reports remain Client property, subject to Master Services Agreement/Vantage Artifacts data-retention/deletion terms; Vendor retains audit logs/anonymized telemetry for operational/security purposes.
7. Third-Party Components. Built on the JSON Schema specification (targeting Draft 2020-12, backward-compatible with Draft 7), maintained by the JSON Schema Collaborative and subject to independent change. May use third-party validation libraries/metadata repositories/formatting tools under their own OSS/commercial licenses — Vendor not liable for defects/vulnerabilities/performance issues originating there, though Vendor keeps dependencies reasonably current with security patches; no direct third-party-library access provided to Client absent explicit grant. May reference external enumeration catalogs (NIST CSF identifiers, CVE references, cloud-provider service catalogs) — Vendor not responsible for accuracy/completeness/timeliness or changes/deprecations to those external sources, nor for Client's reliance on them for risk decisions. Design goal (not guarantee) of NIST CSF/CIS Controls/COSO/ISO 27001 alignment — Client must independently validate framework compliance.
8. Warranties. Limited warranty: accurate documented structure/validation-rule definition, standard JSON Schema validation-library/tool compatibility, no knowing third-party IP infringement. Disclaims all other warranties: no merchantability/fitness-for-purpose warranty, no uninterrupted/error-free-operation warranty, no warranty of suitability for Client's specific use case/business requirements, no warranty that schema validation will catch all data-quality/semantic/logical errors, and no warranty that schema-generated reports/artifacts will be legally sufficient, complete, or defensible in any regulatory/contractual context. Provided AS-IS/AS-AVAILABLE. No schema-stability warranty — evolution is anticipated and permitted; continued use constitutes acceptance of ongoing evolution. Client bears sole staging-environment testing responsibility before production reliance.
9. Liability & Indemnification. Liability cap: fees paid for the vCISO Subscription in trailing 12 months, or $1,000, whichever is greater (Schedule-specific floor per Master §7.2 — note this Schedule's cap is anchored to the vCISO Subscription's fees, not a separate schema-specific fee, since the Schema Suite is unbilled per §2). Excludes: direct/indirect/incidental/consequential/punitive damages from schema use or inability to use; data loss/corruption/business interruption from validation errors, schema evolution, or maintenance failure; inaccuracy/misinterpretation by Client or third parties; regulatory fines/penalties/compliance failures from Client's use; and claims arising from Client's failure to stage-test before production use. Exceptions (uncapped): gross negligence/willful misconduct/fraud, confidentiality/data-protection breach, indemnification obligations, and non-waivable-by-law claims. Vendor indemnifies for U.S. patent/copyright/trademark infringement and applicable-law violation claims arising from the Schema Suite itself, subject to standard notice/control/cooperation procedure. Client indemnifies for out-of-scope use, modification/adaptation/derivative use, infringing/law-violating submitted data/content, and §5 Acceptable Use violations.
10. Precedence. (1) Signed Exhibits/Client-specific SOWs > (2) this Schedule > (3) Service Order/Engagement Letter referencing the vCISO Subscription > (4) MSA (Dec 15 2025) > (5) NDA (Dec 15 2025) > (6) incorporated 3VS SLA (Dec 15 2025) > (7) Vantage Infrastructure/Artifacts/Reporting Terms (separate supporting schedules). This Schedule places itself above the MSA/SLA/NDA for schema-specific matters — flagged as inconsistent with Master §2's default ladder (MSA > Master Terms > SLA > NDA > Schedule); per Master §2's reconciliation, MSA/SLA/NDA control on conflict unless this represents a confirmed, deliberately negotiated exception limited strictly to schema-definition/validation matters (the source text explicitly states the MSA "shall prevail" on conflict — self-contradictory with its own listed hierarchy at item 4 above, and flagged for operator/legal reconciliation). Amendment: 30 days' notice for modifications (urgent security/bug-fix updates excepted, deployable without notice); continued use post-effective-date = acceptance. This is a foundational infrastructure component that enables commercial authorization workflows within the vCISO Subscription (section 06, work-authorization per source).
