1. Scope. Continuous multi-cloud (AWS/Azure/GCP) misconfiguration detection, compliance monitoring against CIS/PCI-DSS/HIPAA/SOC 2/ISO 27001, cost-optimization recommendations, automated remediation guidance, consolidated dashboard/API. Excludes endpoint monitoring (see Addon 15), penetration testing, hands-on remediation, IAM policy management beyond config audit, and 24/7 live SOC. Read-only API integration only (AWS IAM role / Azure service principal / GCP service account); no agent deployment.
2. Fees & Billing. Package 39 tier, monthly in advance from Activation Date (confirmed successful integration + read-only access to ≥1 account). Net 30. Price increases capped at 10% per annum, 60 days' notice (Schedule-specific cap per Master §3.5 carve-out). Cloud-provider API/data-transfer costs are Client's sole responsibility, not included in fee.
3. Term & Termination. 12-month Initial Term, auto-renews 12-month periods (30 days' non-renewal notice). Client termination for convenience: 60 days' notice (longer than typical, reflecting integration complexity) — non-refundable, no proration. Termination for breach: 15-business-day cure. Post-termination: dashboard/API access revoked immediately; monitoring ceases within 48 hours; scan/compliance data retained 60 days then purged absent export request.
4. Service Levels. 99.5% platform uptime per incorporated SLA, 4 hrs/month max scheduled maintenance excluded. Automated scans at least hourly per integrated account. Standard Support: business-hours (M–F 9–5 ET) email/portal, 8-business-hr initial response, quarterly business reviews; Premium Support (24/7, 1-hr response) available at additional fee. No hands-on remediation or architecture-review support included.
5. Client Responsibilities. Provision and maintain read-only IAM roles/service principals with minimum required permissions; keep credentials current; comply with cloud-provider ToS; notify Vendor of account changes within 5 business days of request. Prohibited: reverse-engineering scanning methodology, competitive benchmarking without consent, resale/sublicense, monitoring unauthorized accounts. Client bears responsibility for accuracy of underlying cloud metadata and for correcting detected misconfigurations; CSPM findings alone do not achieve regulatory compliance.
6. Data Handling. Scans metadata/config only (tags, policy documents, security-group rules, encryption settings) — explicitly does NOT intentionally collect application data, secrets, or PII stored in cloud resources. Scan results/posture snapshots retained 12 months; audit logs 6 months; early-deletion requests honored within 5 business days. Confidentiality per NDA. Data residency: US data centers, no cross-border transfer without consent. Breach notification: 48 hours (tighter than Master §6.3's 72-hour default — controls per Master §6.3's "never let Schedule cut off early" rule working in Client's favor here since it's tighter, not looser). SOC 2 Type II audit pending (target Q4 2026); HIPAA Business Associate Agreement available on request; separate BAA/DPA required before activation for regulated Clients.
7. Third-Party Components. Dependent on AWS/Azure/GCP API availability — Vendor not liable for provider outages/policy changes. Optional third-party integrations (Slack, ServiceNow, Splunk) are Client-configured and Client-responsible; Vendor not liable for third-party platform issues. Compliance benchmark mappings (CIS/NIST/PCI-DSS/ISO/HIPAA/SOC 2) updated quarterly; no warranty of completeness — Client must independently verify compliance status. SDK/API deprecation: 30 days' notice.
8. Warranties. Limited warranty: professional performance, functional conformance. AS-IS disclaimer explicit for third-party cloud platforms — no warranty of complete misconfiguration/vulnerability/compliance-gap detection, no warranty of Client data accuracy where Client-side misconfiguration or inconsistency is the cause. No warranty that recommendations achieve compliance, prevent incidents, or produce cost savings (aligned with Master §8.2). Disclaims all other warranties per Master §8.3.
9. Liability & Indemnification. Liability cap: fees paid in trailing 12 months (Master §7.1 default formula — no Schedule-specific dollar floor for this offering). Excluded damages per Master §7.4. Client indemnifies for unauthorized use, monitoring unowned accounts, cloud-provider ToS violations, unauthorized disclosure of findings. Vendor indemnifies IP-infringement/unlawful-use claims arising from CSPM as delivered.
10. Precedence. Governed by Master Terms §2 (MSA > Master Terms > SLA > NDA > this Schedule > technical documentation). This engagement sits under Section 06 (Resource Allocation & OpEx) of the FY25 Strategic Business Review per its source inheritsGreaterTerms — flagged per Master's Reviewer Flag #6 as part of the group of Schedules citing the literal order: 6 OpEx section rather than the work-authorization section; treated per Master's adopted normalization as referring to the commercial engagement/order-form layer generally, pending operator confirmation. Amendment: 30 days' notice; Client acceptance or continued use constitutes agreement, else termination right under §3.
