1. Scope. Four additional billable vCISO advisory hours per calendar month (Package 41), for strategic security planning, board-presentation support, incident investigation/response coordination and post-incident review, and other Vendor-approved advisory engagements. Non-cumulative: unused hours expire at month-end absent a purchased Hours Carryover Rider. Delivered via video, phone, or on-site (subject to Advisor scheduling/travel constraints).
2. Fees & Billing. Recurring monthly, Package 41 rate, invoiced in advance on first day of billing cycle, Net 30 (or MSA terms if more restrictive). No setup fee; activation within 24 hours of invoice or written vCISO-team confirmation. Billing disputes must be raised within 15 days of invoice date or are waived. No pro-rata refund on early termination.
3. Term & Termination. Effective on Addon Activation Date (invoice date); auto-renews annually absent 30 days' non-renewal notice. Terminates automatically with base vCISO subscription. Client may terminate this Addon alone (base subscription remaining active) on 30 days' notice, no penalty, but remains liable for accrued fees. Suspended automatically and without credit if base subscription is suspended for non-payment/breach. Unused hours forfeited on termination — no refund, credit, or conversion.
4. Service Levels. Scheduling governed by incorporated 3VS SLA; requests require 5 business days' advance notice except genuine security incidents (same-day/next-business-day best effort). Each hour = 50 minutes substantive engagement + 10 minutes transition; sessions >60 minutes require pre-approval and may consume multiple hours. Cancellation <48 hrs' notice = full hour charged; no-show = double hourly rate charged. Vendor may substitute qualified advisors for illness/emergency with prompt notice.
5. Client Responsibilities. Designate single scheduling/attendance point of contact; provide necessary system/documentation/personnel access subject to Client's own security policies; prepare relevant materials ≥3 business days before sessions; ensure session participants are authorized and briefed on confidentiality; complete requested follow-up action items within specified timeframes. Prohibited: recording/reproducing sessions without written consent, disclosing session substance to third parties (except as legally required, with advance Vendor notice where permitted), using advisory services in litigation against Vendor without consent, assigning advisory hours to unaffiliated third parties.
6. Data Handling. All session-disclosed information (vulnerabilities, incident details, business metrics, strategic plans) is Confidential Information under NDA. Session notes/recommendations/deliverables retained 36 months post-termination absent longer legal/Client-policy requirement. Client retains IP rights to its own proprietary data/systems/strategy discussed; Vendor retains rights to methodologies/frameworks/general (non-Client-specific) insights. Anonymized aggregate insights usable for quality improvement/industry research/marketing without Client identification. Recordings (if any) encrypted at rest with need-to-know access, per any executed Information Security Exhibit or, absent one, Vendor's default standard.
7. Third-Party Components. Sessions may use third-party conferencing/PM tools (Zoom, Google Meet, Teams, Slack, Jira, Asana) subject to those vendors' terms; Client responsible for its own licenses. Vendor not liable for third-party platform unavailability/performance/security. On-site engagement travel/accommodation/third-party support costs are Client's responsibility absent other written agreement. Advisor recommendations of third-party tools/frameworks/providers do not constitute endorsement or create reseller relationship; Client bears engagement risk with any recommended third party.
8. Warranties. Limited warranty: Advisor professional qualifications/certifications as profiled; professional/competent/timely performance consistent with vCISO industry standards. Explicitly disclaims: guaranteed elimination of security risk, guaranteed regulatory-compliance outcome, and guaranteed financial/operational/insurance-premium results — advisory is consultative, not warranted-outcome, aligned with Master §8.2. AS-IS delivery subject to availability/scheduling constraints per §4.
9. Liability & Indemnification. Liability cap: fees paid in trailing 12 months (or total fees to date if <12 months) — Master §7.1 default formula, no Schedule-specific floor. Excluded damages per Master §7.4. Client indemnifies for misuse/misrepresentation of recommendations, failure to implement recommended controls resulting in breach, third-party vendor/contractor implementation disputes, and unauthorized Confidential Information disclosure. Vendor indemnifies IP-infringement claims regarding its own methodologies/recommendations (excluding Client-modified or combined-with-non-Vendor-materials claims). Indemnification conditioned on prompt notice and reasonable cooperation.
10. Precedence. MSA > incorporated SLA > NDA > this Schedule > general Vantage ToS/AUP. Amendment: 30 days' notice; Client's continued use (or failure to terminate within the notice window) = acceptance; pricing amendments require express consent or take effect only at next renewal. Serves section-06 (Work Authorization / vCISO Subscription Agreement) of the FY25 Strategic Business Review engagement framework.
