Managed Service Agreement

1. Term and Termination

1.1 Commitment Term

The minimum term for which You agree to use the Services (“Commitment Term”), including the specific start date and end date, is stated in the Proposal. The Commitment Term begins on the first day of the calendar month following Your acceptance of the Proposal unless a different start date is specified in the Proposal.

At the end of the Commitment Term, this Agreement will automatically renew for successive terms equal in length to the original Commitment Term (“Renewal Term”) unless either party provides at least sixty (60) days’ prior written notice of non-renewal.

Unless otherwise stated in the Proposal, fees for any Renewal Term will be based on Our then-current pricing. Any incentives or discounts tied to the original Commitment Term apply only to that term and do not automatically apply to any Renewal Term.

The Proposal, this Agreement, and its Appendices collectively form the complete scope, pricing, and service definition for each Commitment Term.

1.2 Termination by Client (Early Termination)

If You terminate this Agreement before the end of the Commitment Term for any reason other than Our material breach not cured within the applicable cure period, You agree to pay a termination fee (“Termination Fee”) and any applicable Discount Reclamation amounts.

(a) Termination Fee

The Termination Fee is calculated as:

• the monthly Plan Fee in effect at the time of termination,
• multiplied by the number of full calendar months remaining in the Commitment Term,
• minus any amounts already invoiced and paid for those months.

If pricing adjustments were made during the Commitment Term, the Plan Fee used will be the latter of the original Proposal or any subsequent written pricing adjustment issued by Us.

(b) Incentive and Discount Reclamation

If Your pricing includes any incentive, discount, credit, or reduced rate tied to the length of the Commitment Term—including but not limited to multi-year incentives, partnership pricing, legacy pricing, or growth incentives—then upon early termination:

• all such incentives and discounted rates are withdrawn;
• You must repay the total value of all incentives or discounts received from the start of the Commitment Term through the termination effective date, calculated as the difference between standard catalog pricing and the discounted pricing billed; and
• this repayment is in addition to the Termination Fee.

(c) Termination Process

All termination requests must be submitted in writing to [email protected] or your assigned account manager.

Termination becomes effective on the last day of the month in which We receive valid written notice unless We confirm a later date in writing.

All outstanding fees, including the Termination Fee and Discount Reclamation amounts, are due according to the payment terms in this Agreement.

1.3 Termination by Braided Technologies

We may terminate this Agreement with ninety (90) days’ written notice for any reason. We may also suspend or terminate Services immediately if You materially breach this Agreement and fail to cure the breach within the time stated in Our notice.

1.4 Transition Assistance

Upon expiry or termination of this Agreement for any reason, We will provide reasonable cooperation to transition the Services to You or to another provider (“Transition Assistance”). Transition Assistance includes:

1. removal of Our tools and administrative access from Your environment;
2. export of configuration documentation or inventory information that We reasonably maintain in the ordinary course of business; and
3. coordination with You or Your new provider to ensure a smooth transition.

Transition Assistance must be scheduled in advance and will be performed during standard business hours unless otherwise agreed in writing. We are not responsible for delays caused by You, Your users, or any third party, including a successor provider.

Unless expressly included in a separate paid onboarding/offboarding package, all Transition Assistance is billed at Our then-current hourly rates. Reconstruction of historical data, ticket notes, logs, or documentation that We do not reasonably maintain in our systems is outside the scope of Transition Assistance and may require a separate Statement of Work.

We may retain copies of information necessary to comply with Our legal, regulatory, insurance, or security obligations. All outstanding fees—including any Termination Fee and any Discount Reclamation amounts—must be paid before Transition Assistance begins. Removal of Our tools and administrative accounts will occur only after the effective termination date and after all outstanding fees have been resolved.

Data Retention and Purging After Termination

Upon termination or expiration of this Agreement, and after completion of any Transition Assistance:

1. We will securely delete or destroy all backup copies, system images, configuration backups, and copies of Your data within thirty (30) days of the effective termination date, except as specified in subsection (c) below;
2. You acknowledge that once data is purged, it cannot be recovered, and You are solely responsible for ensuring You have obtained all necessary data, backups, and configurations before the purging deadline;
3. We may retain copies of information only to the extent legally required for compliance with applicable laws, regulations, legal holds, insurance requirements, or regulatory obligations, or as necessary to defend against potential claims related to the Services provided. Such retained information will remain subject to the confidentiality obligations in Section 2.2;
4. If You request an extension of the data retention period beyond thirty (30) days, We may agree to retain data for a specified additional period at Our then-current storage rates, subject to a separate written agreement.

The thirty (30) day retention period begins on the effective termination date, not on the date payment is received. However, We will not provide access to data or begin Transition Assistance until all outstanding fees are paid in full.

2. Our Responsibilities

2.1 General Responsibilities

We will provide the Services with reasonable skill, care, and diligence, consistent with industry best practices for managed IT service providers operating in security- and compliance-sensitive environments. The Services will be delivered primarily through remote support unless onsite work is specifically included in Your plan or agreed upon in writing.

Our ability to deliver the Services depends on Your compliance with this Agreement, including meeting the Technology Standards, maintaining required licensing, and providing timely access, information, and cooperation. We are not responsible for delays, failures, or service limitations caused by factors outside Our reasonable control, including third-party providers, vendors, utilities, internet service providers, or issues originating from unsupported systems. This includes, without limitation, acts of God, natural disasters, terrorism, labor disputes, vendor failures, internet outages, utility failures, pandemics, or governmental actions as further described in Section 18 of Our Terms & Conditions, which is incorporated by reference.

We do not guarantee uninterrupted or error-free operation of any system or service, nor do We assume responsibility for the performance, availability, or reliability of systems or services outside of those expressly included in this Agreement.

2.2 Confidentiality and Data Protection

(a) Confidentiality

We will maintain the confidentiality of all non-public information We access in connection with the Services (“Confidential Information”). We will not disclose Confidential Information to any third party except:

• Our employees, contractors, and service providers who require access to perform the Services and who are bound by confidentiality obligations no less protective than those in this Agreement;
• as required by law, regulation, subpoena, or court order; or
• with Your prior written consent.

Confidentiality obligations do not apply to information that:

1. becomes publicly available without breach of this Agreement;
2. was already lawfully known to Us without confidentiality restrictions;
3. is independently developed by Us without reference to Your information; or
4. is rightfully obtained from a third party without restriction.

(b) Use of Client Data

We may collect, access, store, or process system, configuration, security, log, usage, diagnostic, and telemetry data as reasonably necessary to deliver, maintain, secure, and improve the Services; monitor compliance with the Technology Standards; and fulfill Our legal, regulatory, or insurance obligations.

We will use Client Data only to provide the Services and will not sell, license, disclose, or use Client Data for any other purpose.

(c) Data Handling and Security

We will implement commercially reasonable administrative, technical, and physical safeguards designed to protect Client Data against unauthorized access, loss, or disclosure. You acknowledge that no method of data transmission or storage is entirely secure and that We do not guarantee the absolute security of any system or data.

(d) Data Retention and Return

Upon termination and upon Your written request, and subject to payment of all outstanding fees, We will provide You with available copies of Your data that We reasonably maintain in a commonly used format.

After a reasonable retention period, We may securely delete or anonymize Client Data unless We are legally required to retain it.

We are not responsible for reconstructing historical data, logs, or information We did not maintain in the ordinary course of business.

(e) No Assumption of Data Controller Responsibilities

Unless expressly stated in a separate written agreement (such as a Business Associate Agreement or Data Processing Agreement), We do not act as a data controller or data processor under any data protection law. You retain all responsibility for determining the legal basis and compliance requirements for processing any personal or regulated information within Your environment.

2.3 Regulatory and Compliance Support

We may provide guidance, recommendations, and support relating to regulatory or industry frameworks, including but not limited to HIPAA, GDPR, ISO 27001, NIST, PCI, and similar standards (“Compliance Frameworks”). Such support is advisory in nature and is intended to help You understand and implement technical and administrative controls within Your environment.

You acknowledge and agree that:

1. We do not act as Your compliance officer, privacy officer, data protection officer, or legal counsel;
2. You retain full responsibility for understanding, interpreting, and complying with all legal, regulatory, contractual, and industry requirements applicable to Your organization;
3. You are solely responsible for implementing, managing, and enforcing all administrative, physical, and organizational measures required by any Compliance Framework; and
4. nothing in this Agreement guarantees that You will pass an audit, achieve certification, avoid regulatory scrutiny, or maintain continuous compliance.

Compliance support provided under this Agreement is limited to the scope expressly defined in the Proposal or any applicable Statement of Work. Additional compliance consulting, documentation, audit preparation, assessments, or gap remediation may require a separate engagement.

Client acknowledges that compliance frameworks may require Client to maintain cybersecurity insurance, errors & omissions coverage, or other risk transfer mechanisms. We recommend Client consult with insurance and legal professionals to determine appropriate coverage levels for their risk profile and regulatory obligations.

2.4 Cybersecurity Incidents and Incident Response

(a) Notification

If We confirm a security incident that materially affects systems or data under Our management, We will notify Your designated Primary IT Contact without undue delay and will provide reasonable updates as additional information becomes available.

(b) Scope of Included Assistance

We will provide reasonable assistance to identify, contain, and mitigate the impact of a security incident to the extent such assistance is within the scope of the Services defined in this Agreement and the Proposal.

Standard incident triage and containment support are included only for systems covered under Your plan and maintained in accordance with the Technology Standards.

(c) Billable Incident Response Work

Work outside the scope of the Services—including but not limited to forensic analysis, malware reverse engineering, e-discovery, legal or regulatory reporting assistance, incident documentation, third-party coordination, or extended after-hours response—will be billed at Our then-current hourly rates unless otherwise agreed in a separate Statement of Work.

If remediation requires emergency resource allocation, specialized expertise, or third-party tools not included in Your plan, additional charges may apply.

If a cybersecurity incident occurs and You do not maintain the required Cyber Liability Insurance as specified in Section 26.2 of Our Terms & Conditions:

1. all incident response work—including extended triage, containment, forensics, coordination, and remediation—will be billed at Our then-current emergency hourly rates as defined in Appendix G;
2. We may require prepayment or a deposit before continuing incident response activities beyond initial containment; and
3. You assume all financial responsibility for incident-related costs that would otherwise have been mitigated or covered by insurance, including but not limited to forensic analysis, legal coordination, regulatory response, and extended remediation efforts.

(d) Client Responsibilities

You agree to promptly notify Us of any suspected or actual security incident, comply with Our reasonable instructions, and take immediate steps to mitigate further impact.

You are responsible for implementing and maintaining all administrative, physical, user-based, and organizational controls required to secure Your environment, including MFA, proper user behavior, access control, and policy enforcement.

Any failure by You to maintain required security controls, follow Our recommendations, or adhere to the Technology Standards may limit Our ability to provide incident support and may limit Our liability.

(e) No Guarantee of Prevention or Detection

You acknowledge that no system, network, or service can be fully secure or guaranteed to prevent, detect, or stop all cybersecurity incidents.

We do not guarantee the prevention of attacks, unauthorized access, malware, data breaches, or other security incidents, nor do We guarantee that all incidents will be detected.

(f) No Responsibility for Unsupported or Non-Compliant Systems

We are not responsible for any security incident involving:

• systems not covered under this Agreement;
• systems that do not meet the Technology Standards;
• user actions that bypass or disable security controls;
• third-party vendors or applications outside Our management; or
• legacy systems, manufacturing/OT devices, or custom software not expressly included.

Support for these systems, if provided, will be at Our sole discretion and may incur additional charges.

(g) Breach Notification Responsibilities

Client acknowledges that certain data protection and breach notification laws impose specific reporting timeframes, including but not limited to:

• 72 hours under GDPR (General Data Protection Regulation);
• 60 days under HIPAA (Health Insurance Portability and Accountability Act);
• varying timeframes under state breach notification laws.

Client remains solely responsible for:

• determining the applicability of any breach notification law to their organization;
• making all required notifications to regulators, affected individuals, business associates, and other parties;
• meeting all legal deadlines for such notifications; and
• ensuring accuracy and completeness of all breach-related reports.

We will provide reasonable cooperation and technical information to assist with Your breach notification obligations, but We do not assume responsibility for, and are not liable for any failure to meet, Your notification deadlines or regulatory obligations.

2.5 Reporting and QBRs

(a) Reporting

We will provide periodic reports as described in the Proposal or applicable appendices. Reporting may include summaries of service activity, system health, security alerts, project status, risks, or other information We reasonably maintain in the ordinary course of providing the Services. Reporting availability and depth depend on the tools We deploy and the level of access permitted by Your environment.

We are not responsible for creating custom reports, reconstructing historical data, or providing reporting beyond what Our systems natively support unless specifically included in a separate Statement of Work.

(b) Quarterly Business Reviews (QBRs)

We will conduct Quarterly Business Reviews to evaluate service performance, discuss business objectives, review technology alignment, and make strategic recommendations to help You plan for upcoming needs. QBRs are intended to provide high-level guidance and are not a substitute for formal consulting, engineering design, compliance governance, or project scoping engagements.

QBRs must be scheduled in advance and require participation from Your designated business and technical stakeholders. If You do not attend or decline QBR participation, We may be unable to provide proactive guidance or identify risks affecting Your environment.

(c) Limitations of QBR Responsibilities

QBRs do not include:

• detailed solution architecture or engineering design;
• comprehensive risk or compliance assessments;
• vendor contract reviews;
• preparation of project plans or budgets;
• creation of business cases or executive briefing decks; or
• any work requiring deeper analysis than can be performed within the QBR scope.

Such work may be available under separate consulting or project-based engagements.

(d) Recommendations

Recommendations made during QBRs are advisory only. You remain responsible for deciding whether to implement recommended changes and for any costs or impacts associated with non-implementation.

3. Client Responsibilities

3.1 Environment Requirements

You must maintain hardware, software, cloud services, and network infrastructure that comply with Our Technology Standards, available at the URL designated by Us. These standards may be updated periodically as technologies evolve. If Your environment does not meet these standards, Our ability to provide the Services may be limited, and additional charges or limitations of liability may apply.

3.2 Required Licensing

You must provide and maintain at least one (1) Microsoft 365 Business Premium (or equivalent) license for exclusive use by Us in administering Your environment. Failure to maintain this license may limit support and may result in additional charges.

3.3 Access and Cooperation

You agree to provide Us with all access, credentials, vendor authorizations, approvals, personnel coordination, and cooperation reasonably required to deliver the Services. Delays, access restrictions, incomplete information, or failures to follow reasonable instructions may impact response or resolution times and may result in additional charges.

3.4 Unsupported or Unauthorized Systems

If You install, operate, or permit unsupported, unapproved, outdated, or non-Braided-vetted systems—including custom applications, legacy platforms, operational technology (OT), industrial control systems, third-party appliances, or vendor-specific solutions—these systems are excluded from the Services. Support for such systems, if provided, will be at Our sole discretion and may incur additional charges.

3.5 Security Hygiene Requirements

You must follow Our reasonable security recommendations, including but not limited to multi-factor authentication (MFA), patch management, hardware refresh cycles, endpoint protection, backup integrity, privileged access controls, and other measures outlined in the Technology Standards or communicated during service delivery. Failure to implement required controls may limit Our ability to deliver the Services and may limit Our liability.

3.6 Vendor Coordination and Authorization

You authorize Us to communicate with and coordinate support with Your third-party vendors as reasonably necessary to provide the Services. You agree to maintain active support agreements with such vendors and provide Us with any required access credentials, PINs, account details, or authorizations. Vendor access requirements may vary, and You agree to complete any vendor-specific authorization forms as part of onboarding.

If a vendor refuses to provide support due to insufficient authorization, inactive support agreements, or Client-imposed restrictions, We are not responsible for delays or impacts on service delivery.

4. Service Scope, Standards & Software

4.1 Included Services

The Services included under this Agreement are listed in Appendix C. These services define the scope of the ongoing managed services covered by the monthly Plan Fee. Any service not listed in Appendix C is considered out-of-scope unless expressly included in writing.

4.2 Excluded Services

Services excluded from this Agreement are listed in Appendix B. Excluded services may be provided upon request, subject to availability, and will be billed at Our then-current hourly rates or under a separate Statement of Work. We are not obligated to provide any excluded service unless We agree to do so in writing.

4.3 Minimum Standards

Minimum Standards for hardware, software, cloud platforms, and network infrastructure are defined in the Technology Standards document referenced by URL and incorporated into this Agreement. Systems that do not meet these Minimum Standards may experience reduced supportability or be excluded from coverage. Any work required to remediate or upgrade such systems is billable at Our then-current rates unless otherwise specified.

4.4 Approved Software

Approved Software is listed in Appendix D. Use of software not listed in Appendix D is permitted; however, We retain sole discretion to determine whether issues related to such software are covered under this Agreement. This includes, without limitation, custom applications, legacy platforms, operational technology (OT), industrial control systems, and specialized vendor-managed systems. Support provided for such systems, if any, may be subject to additional charges.

5. Service Requests and Escalation

5.1 Submitting Service Requests

All Service Requests must be submitted through the channels designated by Us, as described in Appendix A. Service Requests must include sufficient detail for Us to understand, replicate, or diagnose the reported issue. Requests submitted outside of designated channels, including direct staff emails, personal texts, or verbal requests, may not be tracked or responded to and are not subject to any response time targets.

5.2 Prioritization and Response Targets

Service Requests will be assigned a priority level—Critical, High, Medium, or Low—based on the criteria described in Appendix A. Response targets apply only after the request is received through the proper channel with all required information. Response targets describe the time to begin actively working on a request and do not guarantee resolution within any specific timeframe. Response targets do not apply to issues involving third-party vendors, internet service providers, unsupported systems, non-compliant environments, or circumstances outside Our reasonable control.

5.3 Client Cooperation

Our ability to respond to and resolve Service Requests depends on Your timely cooperation, including providing required access, availability of knowledgeable staff, accurate information, authorizations, and adherence to Our instructions. Delays or failure to cooperate may impact response times and may result in additional charges.

5.4 Escalation Path

If You are dissatisfied with the progress of a Service Request, You may escalate it by contacting:

1. the Primary Technician assigned to the request;
2. the Service Manager; and
3. the Executive Sponsor or designated Leadership Contact.

Escalations must reference the ticket number and summary of the issue. Escalation requests submitted outside the formal process may not be acknowledged.

5.5 After-Hours Requests

After-hours support is not included in the monthly Plan Fee unless expressly stated in the Proposal. After-hours Service Requests, if accepted, may incur additional charges as described in Appendix G. Response targets do not apply to after-hours requests unless otherwise stated in writing.

6. Fees, Billing & Payment

6.1 Plan Fees

Your monthly Plan Fees are defined in the Proposal and cover only the Services listed in Appendix C. Plan Fees may be adjusted in accordance with the terms of this Agreement, including adjustments related to changes in user counts, device counts, licensing requirements, service tiers, or other variables defined in the Proposal.

6.2 Additional Charges

Any service not included in the monthly Plan Fee—including but not limited to project work, installations, migrations, remediations, vendor coordination beyond reasonable effort, after-hours support, emergency response, or work on unsupported or non-compliant systems—will be billed at Our then-current hourly rates or as otherwise specified in Appendix G or a separate Statement of Work. Travel time and onsite visits may incur additional charges as set forth in Appendix H.

6.3 Discount Reclamation

If Your pricing includes any incentive, discount, credit, or reduced rate tied to the length of the Commitment Term, such incentives are subject to the early termination provisions described in Section 1.2. Any reclaimed incentives are due in addition to the Termination Fee.

6.4 Invoices and Payment Terms

Invoices are due according to the payment terms set forth in the Proposal or Appendix G. Payments must be made by the due date stated on each invoice. Failure to pay invoices when due may result in suspension of Services, delays in service delivery, or termination of this Agreement. We may charge late fees or interest in accordance with applicable law and the terms defined in the Proposal or Appendix G. You are responsible for all costs of collection, including reasonable attorneys’ fees, for overdue amounts.

6.5 Billing Adjustments

User counts, device counts, or other billable quantities defined in the Proposal may be adjusted monthly based on actual usage or consumption. Any additions, removals, or changes to service quantities will be reflected in the next invoice. It is Your responsibility to notify Us promptly of staffing or system changes that affect billing.

6.6 Taxes

All fees are exclusive of applicable taxes. You are responsible for paying all required sales, use, or other taxes related to the Services, except for taxes imposed on Our net income.

6.7 Service Incentives and Discount Structure

6.7.1 Service Incentives and Discount Structure

6.8 Referral Program

6.8.1 Overview

We appreciate client referrals. When You refer an organization that becomes a managed services client, You may earn referral credits applied to Your managed services fees as described in this Section.

Participation is voluntary. Referral credits are a courtesy benefit that may be modified or discontinued as described in Section 6.8.11.

6.8.2 Eligibility

Only active managed services clients with a current Managed Service Agreement in good standing are eligible to participate and earn referral credits.

Good Standing Requirements:

• No invoices outstanding beyond applicable grace period
• Not in material breach of this Agreement
• All required insurance maintained per Section 26.2 of Terms & Conditions

If You fall out of good standing, credit application is suspended until restored. Qualified credits remain queued but will not apply until good standing is restored.

6.8.3 Qualifying Referrals

A referral qualifies if all conditions are met:

New Client Requirement:

The referred organization must not be:

• an existing Braided Technologies client;
• in active sales discussions or proposal negotiations with Us; or
• a former client within the past twelve (12) months.

Organizations that previously declined Our services but engage based on Your new referral are eligible if other requirements are met.

Minimum Agreement Requirements:

The referred organization must:

• enter into a Managed Service Agreement with Us;
• commit to minimum $5,000/month managed services (before incentives); and
• commit to minimum one (1) year Commitment Term.

Qualification Period:

The referred organization must remain an active client in good standing for ninety (90) consecutive days from their MSA start date. If they terminate or fall out of good standing during this period, the referral does not qualify.

Referral Submission:

Referrals must be submitted in writing to [email protected] and include:

• referred organization name and contact information;
• Your primary contact name and title at the organization; and
• brief description of their business and technology needs.

We will acknowledge receipt and update You on status as the referral progresses.

6.8.4 Referral Credit Calculation

If a referral qualifies under Section 6.8.3, You earn a credit calculated as:

Credit Formula:

• 5% of the referred client’s monthly Managed Services Subtotal (before incentives)
• multiplied by three (3) months

Example:

• Referred client Managed Services Subtotal: $10,000/month
• Referral credit: 5% × $10,000 × 3 = $1,500 total
• Application: $500/month for three consecutive months

Credit Application Timing:

Credits begin in the first full calendar month following the end of the Qualification Period. Credits apply as a line-item deduction over three (3) consecutive months.

Example Timeline:

• Referred client signs MSA: January 15
• MSA start date: February 1
• Qualification Period ends: May 1 (90 days)
• First credit applied: June invoice
• Credits continue: July and August invoices

6.8.5 Credit Application to Invoices

Referral credits are applied as a line-item deduction labeled “Referral Program Credit” on Your monthly invoice after all other charges are calculated.

Invoice Example:

Managed Services (Partnership Pricing): $29,776.80
Licensing & Pass-Through: $2,800.55
Optional Services: $2,500.00
Subtotal: $35,077.35
Referral Program Credit: -$500.00
Total Due: $34,577.35

Credit Limitations:

• Credits apply only to managed services fees and related charges
• Credits cannot reduce total invoice below zero; excess is forfeited
• Credits do not apply to hardware, project labor, or one-time fees

6.8.6 Maximum Active Credits and Queueing

You may have maximum two (2) active referral credits applying to invoices at any time.

Queueing System:

• Third and subsequent qualifying referrals enter a queue
• Queued referrals begin applying automatically when an active credit completes
• Queue processed first-qualified, first-applied
• No limit to number of queued referrals

Example:

• January: Referral A qualifies → begins applying
• February: Referral B qualifies → begins applying
• March: Referral C qualifies → enters queue (2 active)
• April: Credit A completes → Credit C begins automatically
• May: Referral D qualifies → enters queue

6.8.7 Annual Cap

Total referral credits earned and applied in any calendar year will not exceed twenty-five thousand dollars ($25,000) per referring client.

Once this cap is reached, additional referrals are accepted but credits will not begin applying until the following calendar year after the cap resets on January 1.

6.8.8 Credit Forfeiture Conditions

Referral credits may be forfeited or suspended:

Referred Client Termination:

If the referred organization terminates within twelve (12) months of start date, remaining unapplied credits are forfeited immediately. Credits already applied are not clawed back.

Example:

• Referred client MSA starts January 1
• Credits apply: May ($500), June ($500)
• Client terminates July 15
• July credit ($500) forfeited; May/June not clawed back

Referred Client Termination by Braided:

If We terminate the referred organization’s MSA due to material breach, payment default, or serious violation, remaining unapplied credits are forfeited.

Referring Client Termination:

If You terminate Your MSA, all queued and partially applied credits are immediately forfeited. No cash payout or prorated adjustment.

Referring Client Falls Out of Good Standing:

Credit application suspended until good standing restored. Queued credits remain but will not apply until restored.

6.8.9 Good Faith Requirements

You agree to act in good faith and not abuse, manipulate, or undermine the Referral Program.

Prohibited Conduct:

• Referring organizations already in discussions with Us
• Referring solely to earn credits without genuine belief in benefit
• Misrepresenting relationship with referred organization
• Offering/receiving kickbacks or consideration for referral
• Circular or artificial referrals (mutual referrals to generate credits)

Reciprocal Referrals:

If two organizations refer each other within a short period, We may review circumstances and decline credits if arrangement was primarily to generate credits rather than genuine referrals.

Consequences:

We may decline credits, forfeit queued/partial credits, suspend participation, or terminate participation entirely.

6.8.10 No Cash Value or Transferability

Referral credits have no cash value and cannot be:

• redeemed for cash;
• transferred, sold, or assigned;
• applied to other entities’ invoices; or
• applied retroactively.

Credits are tied to Your active MSA and forfeit upon termination.

6.8.11 Program Modification or Termination

We may modify, suspend, or terminate the Referral Program at any time upon sixty (60) days’ written notice.

Changes to Terms:

Modifications apply only to referrals submitted after the effective date. Qualified or queued referrals governed by terms in effect when submitted.

Program Termination:

• Credits actively applying continue through completion
• Queued credits apply until exhausted or You terminate MSA
• No new referrals accepted after termination date

Notice:

Material changes communicated by email to primary contact. Continued participation after notice constitutes acceptance.

6.8.12 No Obligation to Accept Referrals

We retain sole discretion to accept or decline any referred organization and are under no obligation to enter discussions, provide proposals, or accept any referral as a client.

We make commercially reasonable efforts to evaluate referrals submitted in good faith, but client acceptance decisions remain entirely at Our discretion.

Appendix A: Response Targets, Priorities, and Escalation

A.1 Overview

This Appendix defines how Service Requests are prioritized, the response targets associated with each priority level, and the escalation process available to You. Response targets describe the time to begin actively working on a request and do not guarantee resolution within any specific timeframe.

A.2 Submission Requirements

Service Requests must be submitted through Our designated channels:

1. the ticketing system;
2. the support email address; or
3. the support phone line.

Requests submitted outside these channels—including direct messages, personal emails, or verbal requests—are not subject to response targets.

A.3 Priority Levels and Response Targets

(a) Critical Priority

A Critical Priority issue is one that results in complete work stoppage for the organization or a substantial portion of users, such as:

• complete network outage;
• major server failure;
• inability to access core business systems;
• security incident requiring immediate containment.

Target Response: within 1 hour during business hours.

After-hours Critical support is billable unless included in Your plan.

(b) High Priority

A High Priority issue significantly impairs productivity but does not cause a full outage, such as:

• email delivery issues;
• line-of-business application failures affecting multiple users;
• degraded network performance;
• backup or security alerts requiring prompt review.

Target Response: within 4 business hours.

(c) Medium Priority

A Medium Priority issue affects a limited number of users or has a workaround available, such as:

• workstation performance issues;
• application errors;
• peripheral device issues;
• non-urgent vendor coordination.

Target Response: within 8 business hours.

(d) Low Priority

A Low Priority request includes general questions, non-urgent changes, routine tasks, and cosmetic issues.

Target Response: within 2 business days.

A.4 Conditions Where Response Targets Do Not Apply

Response targets do not apply to:

1. issues involving unsupported systems or non-compliant environments;
2. third-party vendor delays or ISP outages;
3. after-hours requests unless specifically covered by Your plan;
4. project work, migrations, installations, or enhancements;
5. circumstances outside Our reasonable control, including force majeure events;
6. Service Requests submitted without required information.

A.5 Escalation Path

If You are dissatisfied with the status or progress of a Service Request, You may escalate as follows:

1. Primary Technician assigned to the request;
2. Service Manager;
3. Executive Sponsor or designated Leadership Contact.

Escalation requires the ticket number and a brief explanation of the concern.

A.6 Business Hours

Unless otherwise specified in the Proposal, Business Hours are Monday through Friday, 8:00 AM to 5:00 PM Eastern Time, excluding federal holidays.

Appendix B: Exclusions from Services

The following services, activities, systems, and responsibilities are expressly excluded from the Services under this Agreement. Excluded services may be provided at Our sole discretion and, if provided, will be billed at Our then-current hourly rates or under a separate Statement of Work.

B.1 Unsupported or Non-Compliant Systems

1. Systems, devices, applications, or operating systems that do not meet the Minimum Standards or Technology Standards.
2. End-of-life or end-of-support hardware or software.
3. Custom-built applications, legacy systems, or vendor-specific solutions not vetted or approved by Us.
4. Operational technology (OT), industrial control systems, manufacturing systems, PLCs, SCADA systems, and similar equipment unless expressly included in writing.

B.2 Physical Infrastructure and Facilities Work

1. Cabling, wiring, conduit, electrical work, or physical infrastructure.
2. Environmental issues, including HVAC, humidity, ventilation, and power problems.
3. Onsite assessments or remediation related to physical building conditions.

B.3 Third-Party Vendor Failures

1. Failures, outages, or misconfigurations caused by third-party vendors, including ISPs, hosting providers, telecommunications providers, SaaS vendors, cloud services, and line-of-business application vendors.
2. Vendor-managed systems or vendor-required configurations that conflict with industry standards or Our recommendations.
3. Vendor negotiations, procurement, licensing disputes, or legal reviews.

B.4 Security Incidents and Forensic Work

1. Digital forensics, malware reverse engineering, investigation of historic incidents, chain-of-custody documentation, or breach forensics.
2. Regulatory reporting, public relations support, legal response coordination, or compliance-impact analysis.
3. Incident response activities beyond the scope described in Section 2.4, including extended after-hours response, vendor escalations, or system rebuilds.

B.5 Data Recovery and Reconstruction

1. Recovery of lost, corrupted, deleted, or inaccessible data not covered by an active, verified backup solution managed by Us.
2. Reconstruction of historical data, logs, records, documentation, or systems not maintained by Us in the ordinary course of business.
3. File restoration for systems not under Our backup management.

B.6 Projects, Migrations, and Enhancements

1. System upgrades, migrations, installations, or replacements.
2. New buildouts, device setups, office moves, or structural network changes.
3. Significant configuration changes, redesigns, or optimization projects.
4. Any work that materially modifies the architecture of Your environment.

B.7 Compliance, Governance, and Policy Work

1. Risk assessments, audit preparation, control mapping, and policy development unless expressly included in a separate Compliance Services engagement.
2. Acting as Your compliance officer, privacy officer, data protection officer, or legal representative.
3. Creation of governance documentation, evidence preparation, or auditor coordination beyond the definitions in the applicable Statement of Work.

B.8 User Training and Change Management

1. End-user training outside of what is expressly included in Your plan.
2. Organizational change management, documentation, or communications efforts.

B.9 Hardware, Licensing, and Procurement

1. Procurement of hardware, software, or licenses unless requested in writing.
2. Warranty, manufacturer support, or RMA work not directly managed by Us.
3. Vendor-required licensing changes or costs.

B.10 Personal Devices and Unauthorized Assets

1. Support for personal devices or BYOD systems unless expressly included in writing.
2. Devices not enrolled in Our management tools or not visible in Our monitoring systems.

B.11 Activities Outside Normal Business Hours

1. After-hours, weekend, or holiday work unless included in Your plan.
2. Emergency onsite or remote response, which may incur additional charges as listed in Appendix G.

B.12 Any Service Not Explicitly Listed as Included

If a service, activity, system, or responsibility is not explicitly listed in Appendix C (Included Services) or in the Proposal, it is excluded.

Appendix C: Included Services

C.1 Overview

This Appendix defines the Services included in the monthly Plan Fees. Services are grouped by functional category and are applied based on the service tier selected by the Client, including Standard User, Lite User, Managed Endpoint, Managed Server, and Site Services. Any service not expressly included in this Appendix is excluded unless agreed to in writing.

C.2 Included Services by Category

(a) User Support Services

• Remote help desk and technical support during business hours (Standard Users).
• Ticket submission, tracking, and resolution through designated support channels.
• User onboarding and offboarding, including account creation, licensing allocation, MFA enrollment, and basic workflow/setup.
• New device setup when using automated deployment tools (e.g., Autopilot/Intune).
• Self-service support tools where available (both tiers).
• For Lite Users: support is limited to self-service workflows (e.g., password resets) and requests submitted through designated managers.

(b) Endpoint Management & Device Services

• Remote monitoring and management of supported workstations, laptops, and mobile devices.
• Operating system and application patching for supported platforms.
• Deployment and management of approved endpoint security tools, including AV/EDR.
• Hardware lifecycle, warranty tracking, and asset management through an automated platform.
• Configuration enforcement and policy management using centralized device management tools.
• Triage and handling of peripheral issues; escalation to vendor support when required.
• Coverage applies to all managed endpoints, regardless of user assignment.

(c) Security Services (Core Security Stack)

• Endpoint protection and monitoring using industry-standard EDR tools.
• Email security filtering and threat protection.
• DNS and web content filtering when supported by deployed security tools or firewall configurations.
• Security baselining, configuration hardening, and ongoing posture maintenance for managed systems.
• Security awareness training and phishing simulation platform (included for all Standard and Lite Users).
• Escalation of verified threats to Client stakeholders as required.
• Optional add-ons are defined in Section C.5.

(d) Cloud & SaaS Management

• Administration of Microsoft 365 tenant, including:
  • (i) user creation and removal;
  • (ii) licensing assignments;
  • (iii) mailbox configuration;
  • (iv) basic SharePoint/Teams/OneDrive support;
  • (v) distribution lists, shared mailboxes, and permission management.
• Entra ID (Azure AD) management, including group membership, MFA enforcement, and conditional access policies.
• Basic configuration and oversight of identity security and access controls.
• Troubleshooting and light remediation for SaaS applications where possible and appropriate.
• Coordination with SaaS vendors for escalated cases when required.

(e) Network & Infrastructure Services

• Monitoring and management of supported network devices, including firewalls, switches, access points, and routing devices.
• Firmware updates, configuration management, and backup of configurations for supported devices.
• Outage remediation and performance troubleshooting.
• Basic network maintenance tasks under the monthly plan.
• Escalation to vendor support when appropriate.
• Major redesigns, net-new deployments, VLAN restructuring, firewall rebuilds, or ground-up projects are not included and may require a separate Statement of Work.

(f) Backup & Continuity (Add-On Services)

Backup and continuity services are not included by default. Optional backup services available as add-ons include:

• Microsoft 365 backup.
• Server backup and recovery services.
• Archival or long-term storage backup solutions.

Backup success depends on the presence of supported agents, appropriate storage, and proper configuration.

(g) Monitoring & Alerting

• 24/7 automated monitoring of managed endpoints, servers, and network devices.
• Alert triage and remediation for issues related to monitored systems.
• Review and response to security alerts within included scope.
• Monitoring coverage is limited to systems under active management and compliant with Minimum Standards.

(h) Vendor Coordination

• Coordination with third-party vendors for supported systems and services.
• Assistance with escalations and troubleshooting, subject to active vendor support agreements.
• Best-effort support for line-of-business applications, with escalation to vendor support when necessary.

(i) Account Management & QBRs

• Quarterly Business Reviews with Client stakeholders.
• Technology recommendations, lifecycle insights, and planning guidance.
• Review of service performance, risk items, and upcoming needs.

(j) Documentation & Asset Management

• Maintenance of network documentation and diagrams.
• Hardware and software inventory.
• Secure storage of authorized credentials and access methods.
• Lifecycle reporting for servers, endpoints, and network devices.
• Maintenance of configuration details for managed systems.

C.3 Services by Tier

(a) Standard User

Includes:

• All User Support Services in Section C.2(a).
• Full endpoint security and device management as described in Sections C.2(b) and C.2(c).
• Full Cloud & SaaS Management (Section C.2(d)).
• Full access to Security Awareness Training and phishing simulation.
• Vendor coordination and LOB support as outlined.
• Onboarding and offboarding included.
• New device setups included when using automated deployment (Autopilot/Intune); manual setups may incur additional charges.

(b) Lite User

Includes:

• Access to Security Awareness Training and phishing simulation.
• Device management and security stack on assigned device.
• Access to self-service functions (e.g., password reset).
• Ticket submission only through designated managers; direct user submissions may be rejected or delayed.
• Limited Cloud & SaaS support for authentication, access, and core controls.
• No direct help desk support beyond manager-approved escalations.

(c) Managed Endpoint

Includes:

• Device management and security stack as defined in C.2(b) and C.2(c).
• Monitoring and patching.
• Lifecycle and warranty management.
• No user-specific support unless associated with a Standard or Lite User plan.

(d) Managed Server

Includes:

• Full server monitoring and alerting.
• OS patching and maintenance.
• Antivirus/EDR coverage.
• Disk, CPU, memory, and service monitoring.
• Vendor escalation for supported applications.
• Configuration maintenance and documentation.
• Coordination of restarts and maintenance windows.

(e) Site Services (Basic, Standard, Advanced)

Includes:

• Monitoring and management of supported network infrastructure devices.
• Firmware updates and configuration backups.
• Remediation of performance, outage, and security issues.
• Number of covered devices per site is determined by the Site Services tier:
  • Basic: 1–5 devices
  • Standard: 6–15 devices
  • Advanced: 16+ devices
• Net-new deployments, redesigns, or major configuration changes require a separate Statement of Work.

C.4 Tools and Platforms

We may use industry-standard tools for monitoring, security, documentation, automation, and management.

Specific tools may change over time based on vendor performance, market conditions, or product improvements. Tool substitutions do not alter the scope of Services.

C.5 Optional Add-On Services

Optional add-ons available under this Agreement include:

• Microsoft 365 Backup
• Server Backup and Archival Backup
• Password Manager / Identity & Access Management (IAM)
• Privileged Access Management (PAM)
• SIEM or SOC services beyond the core security stack
• Compliance-as-a-Service programs
• Penetration testing and vulnerability scanning (project-based or co-termed add-on)
• Agent-level platform access (PSA, documentation systems, etc.)

Appendix D: Approved Software

D.1 Overview

This Appendix defines the categories of software that We support under this Agreement (“Approved Software”). Approved Software includes only the types of applications listed below. Any software not listed in this Appendix is considered non-approved and may be excluded from support unless We agree otherwise in writing.

Approved Software is limited to standard, commercially supported business software that is current, licensed, and compatible with Your operating environment. Support for any custom, deprecated, unsupported, or end-of-life software is excluded unless expressly agreed upon.

D.2 Categories of Approved Software

(a) Operating Systems

• Current and supported versions of Microsoft Windows for workstations and servers.
• Current and supported versions of macOS for workstations.
• Supported versions of server-based or virtualization platforms when explicitly included in Appendix C.

(b) Productivity & Office Applications

• Supported office productivity suites (e.g., Microsoft 365 Apps, Google Workspace applications).
• Current, supported versions of standard business applications including web browsers, conferencing tools, PDF readers, and other mainstream productivity software.

(c) Security & Compliance Software

• Endpoint protection, EDR, or antivirus agents deployed and managed by Us.
• DNS, web filtering, or threat protection tools integrated with Our security stack.
• Email filtering, threat protection, or anti-phishing tools deployed by Us.
• Security awareness training and phishing simulation platforms included in Your plan.

(d) Cloud & SaaS Platforms

• Microsoft 365 services, including authentication, licensing, email, collaboration tools, and related administrative functions.
• Google Workspace core services, including email, Drive, Calendar, document collaboration, and user management, provided the platform is configured in a standard and supported manner.
• SaaS applications for which You maintain an active vendor support agreement and which operate in a commercially supported configuration.
• Identity and access controls integrated with supported cloud platforms.

(e) Remote Access & Management Tools

• Remote monitoring and management (RMM) agents deployed by Us.
• Remote access tools approved and installed by Us.
• Device management and automation tools included in Your service tier.

(f) Network Infrastructure Software

• Firmware and management interfaces for supported firewalls, switches, access points, or SD-WAN devices covered under Site Services.
• Network management tools deployed or approved by Us.

(g) Backup & Continuity Software (Add-On Services)

• Backup agents, retention configurations, and cloud storage systems used for add-on backup services.
• Archival and continuity tools deployed through backup subscriptions purchased through Us.

D.3 Unsupported Software (Not Approved)

The following software categories are not approved and are excluded from support unless We expressly agree in writing:

• Custom-built applications, proprietary systems, and legacy line-of-business applications without active vendor support.
• Operational Technology (OT), industrial control systems, SCADA, PLCs, HMI software, CNC controllers, manufacturing or production equipment software.
• End-of-support operating systems or applications no longer receiving security updates.
• Consumer-grade, personal, or BYOD applications not deployed through Your organization’s approved channels.
• Freeware, abandonware, cracked, pirated, or improperly licensed software.
• Experimental, alpha, or beta software or early-access programs.
• Applications requiring custom integrations, reverse engineering, or data reconstruction.
• Legacy email servers, on-premises Exchange servers, or unsupported hybrid configurations.

D.4 Vendor Support Requirements

Support for any software is contingent upon:

• The Client maintaining an active, valid support agreement with the vendor for any line-of-business or specialty applications;
• The software being configured, updated, and maintained in accordance with vendor best practices;
• The software being compatible with supported operating systems and environment standards;
• The Client providing any necessary access credentials or configuration information.

Without active vendor support, Our ability to assist may be limited or unavailable.

Appendix E: Definitions & Interpretations

The following terms used in this Agreement have the meanings set out below. Defined terms may appear in the singular or plural form.

“Agreement” means the Managed Service Agreement, including all Appendices, the Proposal, and any written amendments or addenda executed by both parties.

“Approved Software” means the categories of software defined in Appendix D that We support under this Agreement. Any software not listed in Appendix D is considered non-approved.

“Business Hours” means the standard hours during which We provide Services, as defined in the Proposal or communicated by Us.

“Client,” “You,” or “Your” means the entity or individual entering into this Agreement and receiving the Services.

“Commitment Term” means the minimum service term defined in the Proposal and described in Section 1.1 of this Agreement.

“Confidential Information” means any non-public information disclosed by either party to the other in connection with the Services, including business, financial, technical, operational, or personal information.

“Discount Reclamation” means the repayment obligations described in Section 1.2 of this Agreement when incentives or discounts tied to term length are forfeited due to early termination.

“Excluded Services” means those services expressly excluded under Appendix B, as well as any services not expressly listed in Appendix C or the Proposal.

“Managed Endpoint” means a workstation, laptop, mobile device, or similar supported device under active management by Us, whether or not it is assigned to a specific user.

“Managed Server” means a physical or virtual server under active management by Us, including monitoring, patching, maintenance, and security functions.

“Minimum Standards” or “Technology Standards” means the hardware, software, network, cloud, security, and configuration requirements We publish and maintain, which define the supported environment required for the Services.

“Plan Fee” means the monthly fee for the Services included in the Client’s selected service plan, as defined in the Proposal.

“Proposal” means the service proposal or service order provided by Us and accepted by You, which defines selected service tiers, pricing, quantities, terms, and any applicable add-ons.

“Service Request” means a request submitted through Our designated channels asking for assistance, support, configuration, or troubleshooting related to the Services.

“Services” means the managed IT services, support, monitoring, maintenance, security services, and related activities described in this Agreement and Appendix C, and any additional services included in the Proposal or a Statement of Work.

“Site Services” means the management and monitoring of network infrastructure devices, provided according to the Site Services tier selected by the Client (Basic, Standard, or Advanced).

“Statement of Work” or “SOW” means a written work order executed by both parties that defines the scope, deliverables, timeline, and fees for project-based or non-recurring services.

“Standard User” means a user licensed under the Standard User tier, which includes full help desk support, endpoint management, security stack, and cloud/SaaS administration.

“Lite User” means a user licensed under the Lite User tier, limited to self-service workflows, restricted support pathways, endpoint management, and security awareness training.

“Termination Fee” means the fee due upon early termination by the Client, as defined in Section 1.2 of this Agreement.

“Third-Party Vendor” means any external provider of goods, software, applications, cloud services, or support services used by the Client and not operated by Us.

Appendix F: On-Site Support Terms

F.1 Overview

On-site support is provided as described in this Appendix. Unless expressly included in the Client’s service plan, on-site visits are billable at Our then-current onsite rates and subject to scheduling availability.

F.2 When On-Site Support Is Included

On-site support is included only when:

1. expressly stated in the Proposal or service plan;
2. required as part of a scheduled project or engagement; or
3. resulting from a failure of equipment under a managed service plan, where remote remediation is not possible.

On-site support included in a service plan covers only reasonable troubleshooting and remediation efforts for systems within the scope of Appendix C.

F.3 When On-Site Support Is Billable

On-site support is billable when:

1. the request is for any out-of-scope service as defined in Appendix B;
2. the issue stems from unsupported, non-compliant, third-party, or end-of-life systems;
3. remote troubleshooting efforts have not been attempted or are declined by the Client;
4. the onsite visit is for non-critical or convenience-based requests;
5. the Client requests onsite presence for end-user issues that can normally be resolved remotely;
6. physical tasks require an onsite presence (cabling, equipment moves, etc.); or
7. the visit occurs after-hours, on weekends, or on holidays unless included in the plan.

Billable onsite time is charged according to Appendix G.

F.4 On-Site Scheduling and Availability

1. On-site visits must be scheduled in advance unless the issue qualifies as a Critical Priority under Appendix A.
2. Scheduling is subject to technician availability, travel time, and resource allocation.
3. Same-day onsite requests may incur an expedited or emergency onsite fee.

F.5 Minimum On-Site Billing

Unless otherwise stated, onsite visits are billed at a minimum of two (2) hours per technician per visit, plus travel time where applicable. Additional time is billed in increments stated in Appendix G.

F.6 Travel and Location Requirements

1. Travel within the primary service region defined in the Proposal is billed according to Appendix G.
2. Travel outside the primary region requires advance approval and may incur additional mileage, travel time, or onsite surcharges.
3. Overnight travel, if required, will be billed at cost plus applicable per-diem rates.

F.7 Safety and Access Requirements

1. The Client must provide safe, reasonable access to all required areas.
2. Environments that present safety risks (manufacturing floors, server rooms, outdoor locations, or hazardous environments) must comply with OSHA or applicable safety protocols.
3. If a technician determines an environment is unsafe, We may decline or reschedule the visit.

F.8 Limitations

On-site support does not include:

1. structural building issues (power, HVAC, humidity, cabling);
2. physical repairs requiring specialized electrical or contractor licensing;
3. work requiring coordination with general contractors, property managers, or facility teams;
4. new buildouts, office expansions, relocations, or structured cabling projects;
5. major network or infrastructure redesigns unless covered under a Statement of Work.

F.9 Equipment Replacement and Hardware Failures

Hardware replacement resulting from equipment failure, damage, misuse, or environmental factors is not included unless covered by a separate warranty, service plan, or manufacturer support agreement. Replacement labor may be billable.

Appendix G: Rates and Additional Charges

This Appendix defines the rates, billing increments, and additional charges applicable to any Services not included in the Client’s monthly Plan Fees. All rates listed below are subject to change upon renewal in accordance with the terms of the Agreement.

G.1 Standard Hourly Rate

The standard hourly rate for engineering, remediation, troubleshooting, configuration, and general technical services not included in the monthly Plan Fee is $150 per hour.

G.2 After-Hours Rate

Work performed outside Business Hours will be billed at 1.5× the standard rate, equal to $225 per hour.

After-hours work includes evenings, weekends, and holidays unless otherwise stated.

Holiday rates are included under the Emergency/Expedited rate described in Section G.3.

G.3 Emergency and Expedited Response Rate

Emergency response, expedited response, or any issue requiring immediate allocation of resources — including but not limited to outages, security incidents, urgent onsite requests, and high-priority escalations — will be billed at 2× the standard rate, equal to $300 per hour.

Holiday work falls under this rate unless otherwise agreed in writing.

G.4 On-Site Minimum Billing

All onsite work is billed at a minimum of two (2) hours per technician per visit, plus any applicable travel time.

Time beyond the minimum is billed according to the increments defined in Section G.5.

G.5 Billing Increments

Remote support is billed in 15-minute increments.

Onsite support is billed in 30-minute increments after the two-hour minimum.

G.6 Travel Charges

Travel time for onsite visits is billed at 50% of the standard hourly rate, equal to $75 per hour.

Additional travel-related expenses (such as tolls, parking, lodging, or long-distance mileage) will be billed at cost unless otherwise stated in the Proposal.

G.7 Project Rates

Project-based work — including deployments, migrations, redesigns, upgrades, and major configuration changes — will be billed at $225 per hour, unless otherwise defined in a Statement of Work.

Project work may require deposits, milestone billing, or prepayment depending on scope.

G.8 Senior Engineer and Specialty Rates

Certain advanced or specialized services may be billed at different rates, including:

• (a) Senior Engineer Rate: $200 per hour
• (b) vCISO / Compliance Consulting: $250 per hour
• (c) Penetration Testing / Vulnerability Services: $300 per hour or as defined in the applicable Statement of Work
• (d) Holiday Onsite Work: billed at the Emergency/Expedited rate in Section G.3
• (e) Specialized security, cloud, or compliance engineering: as defined in the applicable Statement of Work

G.9 Out-of-Scope or Unsupported Environment Charges

Any work performed due to unsupported systems, third-party failures, non-compliant environments, client-caused issues, or services excluded under Appendix B will be billed according to this Appendix.

G.10 Materials, Equipment, and Licensing

Hardware, software, licensing, appliances, parts, and consumables are billed separately and are not included in any hourly rate.

Shipping, procurement, or handling fees may apply as specified in the Proposal or applicable Statement of Work.

Appendices

The following Appendices form an integral part of this Agreement:

• Appendix A — Response Targets, Priorities, and Escalation
• Appendix B — Exclusions from Services
• Appendix C — Included Services
• Appendix D — Approved Software
• Appendix E — Definitions
• Appendix F — On-Site Support Terms
• Appendix G — Rates and Additional Charges

Each Appendix may be updated by Us from time to time to reflect changes in technology, best practices, regulatory requirements, or service delivery improvements. Any such updates will not materially reduce the overall level of Services provided without written notice to the Client.

Acceptance

By accepting any Proposal, Statement of Work, renewal, or change order issued by Braided Technologies, LLC, the Client acknowledges and agrees that such acceptance incorporates this Managed Service Agreement and the associated Terms & Conditions by reference and binds the Client to all applicable terms.