1. Scope. Recurring add-on to base vCISO subscription: phishing simulation campaigns, interactive training modules (password hygiene, social engineering, data classification, incident reporting, compliance essentials, mobile security), compliance-training tracking (HIPAA/PCI-DSS/SOC 2/GDPR/state law), and employee security-score reporting (weekly/monthly/quarterly). Excludes custom content development, on-site delivery, and specialized role-based modules (available by separate engagement).
2. Fees & Billing. Recurring monthly, billed in advance on Activation anniversary, per Package 38 pricing. Auto-charged to payment method on file; three retries over five business days before suspension eligibility. Price changes: 30 days' notice, effective next billing cycle; Client may terminate within the notice window if it objects. Non-refundable except per Master §3.6.
3. Term & Termination. 12-month Initial Term, auto-renews for successive 12-month Renewal Terms (30 days' non-renewal notice). Client convenience termination: 30 days' notice, effective end of billing month, no refund for unused prepaid fees. Termination for cause (either party): 15-day cure period. Post-termination: access disabled within 5 business days; training records retained 90 days for export, then deletable.
4. Service Levels. 99.5% monthly uptime (max 4 hrs/month scheduled maintenance, 2 AM–6 AM ET typical). SLA credits: 99.0–99.4% = 5%; 98.5–98.9% = 10%; <98.5% = 25% of monthly fee (sole remedy, claimed within 30 days). Support: business-hours (M–F 9–5 ET) email/portal; Sev-2 4-business-hr response, Sev-3 1-business-day. 72 hrs' notice for scheduled maintenance affecting availability, except emergency patches. No outcome guarantee: no specific security-awareness score, click-through reduction, or compliance-audit result promised (consistent with Master §8.2).
5. Client Responsibilities. Provide accurate participant rosters; notify Vendor of personnel changes affecting access; safeguard portal credentials and report unauthorized access. Prohibited: reverse-engineering, unauthorized campaign targets, defamatory/illegal campaign content, PII collection beyond training necessity, resale/sublicense. Client responsible for compliance with employment, anti-discrimination, and privacy law when running phishing campaigns; Vendor's integration data-handling requirements apply to any SSO/HRIS/LMS integration Client configures.
6. Data Handling. Client retains ownership of participant rosters, campaign results, scores. Vendor is processor only; encryption TLS 1.2+/AES-256. Personal data (email, IP, assessment answers) processed under incorporated DPA; Client obtains participant consents. Post-termination retention: 90 days for backup/export, then secure deletion or anonymization (30-day expedited option). Confidential disclosure limited to need-to-know personnel, legal process, or annual compliance auditors (advance notice to Client except mandatory legal process). De-identified aggregate benchmarking permitted with Client opt-out.
7. Third-Party Components. SAT may integrate with external email providers, identity providers (Okta/Azure AD), LMS platforms, and analytics tools; those third-party outages/limitations are outside Vendor control and do not constitute Schedule breach. Client responsible for whitelisting sender addresses; undelivered campaigns due to Client's infrastructure are not auto-retried.
8. Warranties. Limited warranty: material conformance to description, non-infringement, authority to grant rights. Exclusive remedy for non-conformance: repair/re-perform, workaround, or pro-rata refund, claimed within 30 days. Disclaims all other warranties per Master §8.3; explicitly disclaims uninterrupted/error-free operation and fitness for Client's specific business requirements. Beta/experimental features excluded from warranty and support entirely.
9. Liability & Indemnification. Consequential-damages exclusion per Master §7.4. Liability cap: greater of (fees paid for SAT in trailing 12 months) or $1,000 (Schedule-specific floor per Master §7.2). Carve-outs (payment obligations, indemnification, IP infringement) uncapped per Master §7.3. Vendor indemnifies IP-infringement claims (subject to standard procedure — notice, sole control of defense, cooperation), with cure options of continued-use rights, non-infringing modification, or termination + pro-rata refund. Client indemnifies for Acceptable Use violations, harassment/discrimination claims arising from campaign administration, consent failures, and employee claims related to participation.
10. Precedence. Governed by Master Terms §2. This Schedule inherits from and is subordinate to MSA, SLA, NDA (Master §10(b) hierarchy: MSA > SLA > NDA > this Schedule). Amendment: 30 days' notice; Client's continued use = acceptance, non-acceptance triggers termination right under §3.
