1. Scope. Zero-trust security scoring (continuous risk classification), Privileged Access Management (session recording/auditing, JIT provisioning), Access Review Campaigns (recertification, RBAC enforcement), Identity Lifecycle Management (provisioning/deprovisioning, attribute sync). Supported IdPs: Azure AD/Entra ID, Okta, Google Workspace (additional IdPs by separate professional-services engagement). Cloud-hosted SaaS only; no on-prem AD bridging included. Activation within 24 hours of credential/OAuth consent.
2. Fees & Billing. Tier A (Standard): $39/month per org, up to 500 identities, quarterly access reviews, ILM. Tier B (Professional): $13/month per managed identity up to 10,000, includes monthly reviews, PAM session recording, dedicated API quota. Overage: $13/identity/month prorated. Monthly invoicing, Net 30, consolidated under vCISO primary billing account if applicable. Non-refundable except per §3.5's mid-month proration rule.
3. Term & Termination. Effective on first-access date; minimum 12 months (or vCISO Subscription term, whichever governs). Auto-renews 12-month periods (30 days' non-renewal notice). Client convenience termination: 90 days' notice, or automatic upon vCISO Subscription termination (same effective date) — no refund for convenience termination. Termination for cause: 30-day cure. Post-termination: access disabled; 30-day data export window (CSV/JSON/API) before deletion.
4. Service Levels. 99.5% monthly Uptime Commitment per incorporated SLA; full remedy/credit mechanics stated in incorporated SLA. Vendor does not provide real-time proactive alerting/escalation beyond dashboard notification (available separately under managed security engagement). Support: Critical 2 business hrs / High 4 business hrs / Medium 1 business day / Low 2–3 business days, M–F 9–5 ET. Does not include Client's own IdP configuration changes, custom policy development, or incident response/forensics.
5. Client Responsibilities. Provide/protect read-only API credentials/OAuth tokens per integrated IdP; notify Vendor of compromise; revoke access on termination. Define/maintain zero-trust policies, access rules, lifecycle workflows compliant with applicable law; test in non-production before deployment; review and approve/reject access-review recommendations. Client owns and maintains source directories — Vendor consumes identity data and does not modify Client directories absent explicit Client-authorized action within the Service UI. Prohibited: reverse-engineering, attacking third-party systems, bypassing authentication, storing malware/illegal content/excess PII, credential sharing, resale/redistribution.
6. Data Handling. Client Data: identities (usernames/emails/roles/attributes), access logs/audit trails, policy configs/review decisions. Storage per incorporated SLA data-residency options; region election available (additional charge). Vendor is processor under incorporated DPA; Client is controller responsible for lawful basis, privacy notices, and data-subject-rights fulfillment. Confidentiality: no disclosure except legal process (advance notice where permitted), Client written authorization, service delivery necessity, or anonymized aggregate analytics (no individual identification). Post-termination: 30-day export window, then deletion; 90-day backup retention thereafter, then deletion/anonymization. Breach notification: 72 hours (matches Master §6.3 default).
7. Third-Party Components. Azure AD/Okta/Google Workspace governed by their own ToS/EULA; Vendor not liable for third-party outages/feature changes. API rate limits/quotas are provider-imposed; Vendor queues requests and notifies Client if limits approach. Third-party API/authentication-method changes: Vendor adapts using commercially reasonable efforts; if infeasible, Vendor may deprecate platform support or terminate with 60 days' notice and pro-rated refund of prepaid fees.
8. Warranties. Limited warranty: professional performance per industry best practices, Uptime Commitment compliance, authority to grant rights. Disclaims fitness for Client's specific requirements, error-free/seamless integration, and third-party platform reliability/security. No security-outcome guarantee — effectiveness depends on configuration, IdP security, and Client practices (aligned to Master §8.2).
9. Liability & Indemnification. Liability cap: fees paid under this Schedule in trailing 12 months (or total fees to date if <12 months) — Master §7.1 default formula, no Schedule-specific floor. Consequential-damages exclusion per Master §7.4. Vendor not liable for incidents resulting from Client's own credential/acceptable-use breach or third-party platform failures. Client indemnifies for Client Data claims, Acceptable Use violations, harmful policy configuration, credential-confidentiality failures. Vendor indemnifies IP-infringement claims (excluding Client Data/configurations) with standard cure options.
10. Precedence. This Schedule places itself as lowest-priority (MSA > SLA > NDA > vCISO Subscription Agreement > this Schedule > Platform AUP), consistent with the Master §2 default ladder except it inserts the vCISO Subscription Agreement between NDA and this Schedule, which is compatible with Master §2's treatment of Order Form-layer documents. Sits under the vCISO Subscription Agreement (work-authorization, section order 19 per source) — consistent with the "order 19" citation group flagged in Master Reviewer Flag #6. Amendment: rate changes effective at renewal only; material scope reduction gives Client 30-day termination right without the standard 90-day notice; required/legal changes may be immediate.
