1. Scope. Adds capacity for up to 100 additional monitored assets (servers/VMs, endpoints, network infrastructure, storage/NAS, cloud-native resources, IoT/OT) under the Platform's current asset taxonomy. Non-independent: requires an active vCISO Primary Subscription; terminates automatically if Primary Subscription lapses. Feature set/support SLA follows the Primary Subscription's tier. Assets must be declared and validated at activation and annually at renewal per the Asset Monitoring Handbook (v2.1+). Excludes supplementary integrations/custom connectors/professional services absent separate Work Order.
2. Fees & Billing. Recurring fee by tier: Professional $249/month (annual $2,628, 12% discount); Premium $349/month (annual $3,684, 12% discount); Enterprise custom. Overage per additional asset beyond 100: Professional $2.49/asset/month; Premium $3.49/asset/month; Enterprise per rate card — assessed in arrears, overage report within 10 business days, Net 30. Billing aligned to Primary Subscription's cycle date; itemized separately referencing Packages 40/41. Non-refundable for partial-month terminations, subject to consumer-protection-law exceptions.
3. Term & Termination. Co-terminous with Primary Subscription. Addon Effective Date = written activation acknowledgment + Asset Inventory validation; monitoring begins within 5 business days; no fees charged until fully activated. Auto-renews matching Primary Subscription renewal term (60 days' non-renewal notice, effective only at renewal anniversary — not mid-term). Client voluntary termination effective only at renewal anniversary (60 days' notice) with updated Asset Inventory confirming decommission within 30 days. Primary Subscription termination auto-terminates this Addon (no proration). Vendor cause termination: 30-day cure for material breach; immediate for sustained 50%+ unpaid overage across 2+ billing periods; 90-day notice for product-line discontinuation. Post-termination: monitoring ceases within 5 business days; alerting discontinued; 30-day read-only historical-data access, then deletion.
4. Service Levels. Same 99.5% Platform uptime SLA as Primary Subscription (no independent SLA — disputes governed by Primary Subscription's Attachment B). Telemetry ingestion latency 60–300 seconds typical; critical alerts within 5 minutes of ingestion (best-effort, third-party notification providers permitting). Quarterly scheduled maintenance (Saturdays 2–6 AM UTC), 14 days' advance notice for windows >30 min. Support tier matches Primary Subscription: Critical 4/2/1 hrs, High 8/4/2 hrs, Medium 24/12/4 hrs, Low 48/24/12 hrs across Professional/Premium/Enterprise. Asset add/remove/modify changes implemented within 1 business day; overages apply immediately upon detection.
5. Client Responsibilities. Maintain accurate Asset Inventory (type, hostname, owner, location); submit annually by June 30 or within 30 days of material change. For agent-based monitoring: install agents within 5 days of Addon Effective Date, maintain connectivity, allow monthly auto-updates, don't disable agent function, maintain adequate system resources. For agentless: provide/maintain valid API credentials. Prohibited: reselling monitoring data, competitive benchmarking/reverse-engineering, false/synthetic data injection, spoofing identifiers to evade overage billing, attacking Vendor infrastructure, malware introduction targeting monitoring agents, unauthorized/illegal monitoring. Incident notification within 24 hours; audit cooperation within 10 business days of request.
6. Data Handling. Collects system metrics, event logs, endpoint telemetry, cloud metadata, device inventory, network flow data (opt-in DPI), user/auth logs (if IdP-integrated). Data residency: us-east-1 AWS default or Client-elected alternate region; TLS 1.2+ in transit, AES-256 at rest. Retention: Addon term + 30 days post-termination standard; up to 90 days backup-only extension available. Expedited deletion available within 5 business days on request. Confidentiality per NDA, with subprocessor disclosure to cloud/analytics/security-contractor vendors under written DPAs. GDPR/CCPA/LGPD: Client is controller, Vendor is processor; Vendor honors SAR/deletion/portability requests within 30 days or legal deadline. Breach notification: 24 hours with preliminary incident report within 5 business days (tighter than Master §6.3 default — controls).
7. Third-Party Components. Vendor's proprietary agent + third-party cloud APIs (AWS CloudWatch, Azure Monitor, GCP Monitoring) + open-source components (MIT/Apache 2.0/BSD) + optional commercial log-aggregation integrations. No warranty of third-party availability; Vendor implements workarounds where practical. SBOM/licensing attribution available on request; 30-day objection window for objectionable OSS licenses, with alternative-component or exemption remedy, or termination without penalty.
8. Warranties. Vendor warrants title/non-infringement (with cure options: continued-use rights, non-infringing modification, or pro-rated termination) and material conformance to Handbook/Feature Guide documentation — not a guarantee of complete threat/compliance-anomaly detection. AS-IS disclaimer per Master §8.3, plus explicit acknowledgment that monitoring is "one layer of defense-in-depth," latency may prevent real-time detection, and accuracy depends on Client-provided inventory/agent connectivity. 30-day warranty-claim window from Addon Effective Date; Addon deemed accepted thereafter.
9. Liability & Indemnification. Liability cap: fees paid in trailing 12 months (or total fees to date if shorter) — Master §7.1 default formula, no Schedule-specific dollar floor. Consequential/special damages excluded per Master §7.4, with explicit carve-out preservation for jurisdictions barring such exclusion (cap remains in effect regardless). Vendor indemnifies IP-infringement claims via standard notice/control/cooperation procedure, with cure options. Client indemnifies for Client Data infringement, Acceptable Use violations, unlicensed/malicious content on monitored assets, and Section 5 breaches. $5,000,000 minimum commercial general liability/cyber insurance maintained by Vendor. Sole remedy for uncured Addon failure (60 days): termination + daily-prorated refund — no other damages, including consequential, may be claimed.
10. Precedence. MSA > SLA > NDA > vCISO Subscription Agreement (section 06, work-authorization per source) > this Schedule. Amendment: 60 days' notice; material amendments (>10% fee increase, core-feature elimination, service-level degradation) trigger 30-day Client termination right with prorated refund; routine enhancements do not. Assignment restricted absent consent, except Vendor successor-in-interest assignment with 30 days' notice.
