Services Guide

Backup and File Recovery Add-On

Implementation and facilitation of an image-based backup and file-recovery solution from Surety’s designated Third-Party Provider. Features include:

• Image-based backups of covered servers and workstations, capturing the full system (operating system, applications, settings, and data).
• Two deployment options, as indicated in the Quote: (i) an onsite backup appliance (“Backup Appliance”) with replication to secure cloud storage, or (ii) direct-to-cloud backup with no onsite appliance.
• Immutable copies of backed-up data retained in the cloud to protect against ransomware and accidental or malicious deletion.
• Automated, recurring backup integrity checks.
• Recovery options ranging from individual files and folders to full system images, including virtualization of protected systems locally or in the cloud for business continuity purposes.
• Offsite backup of supported network-attached storage (NAS) devices to secure cloud storage, where indicated in the Quote.
• Monitoring of the backup system, including monitoring of backup successes and failures, and troubleshooting and remediation of failed backups.
• Firmware and software updates of the Backup Appliance (if deployed).

Backup Data Security: All backed-up data is encrypted in transit and at rest using AES-256 encryption. Cloud copies of backed-up data are stored in secure data centers that implement physical security controls and redundant internet connectivity.

Backup Retention: Backed-up data will be retained for a rolling period of thirty (30) days unless a different time period is expressly stated in the Quote. This applies to both local and cloud backups.

Recovery of Data: The following procedures apply when Client requests recovery of backed-up data:

• Service Hours: Backed-up data may be requested during Surety’s normal business hours, which are currently 8:00 a.m. to 5:00 p.m. Central Time, Monday through Friday.
• Request Method. Requests to restore backed-up data should be made through one of the following methods:
  • Email: help@suretytek.com
  • Telephone: 402-896-4261
• Restoration Time: Surety will use commercially reasonable efforts to begin recovery promptly. Timing depends on technician availability and confirmation that the requested recovery point and destination are available.

Backup & Recovery Planning Included

Development and maintenance of a backup and recovery strategy for Client’s critical data and systems. Features include:

• Identification of Client’s critical data, systems, and resources.
• Definition of Client’s tolerances for recovery time and data loss.
• Development of a backup and recovery strategy using the backup solutions described in this Services Guide, with recommended backup services reflected in the Quote.
• Annual review of the backup and recovery strategy, with updated recommendations as Client’s Environment and needs change.

Scope. Backup & Recovery Planning is a planning and advisory service. The backup services themselves (such as Backup and File Recovery and Microsoft 365 Backup) are provided as described in their respective sections and as indicated in the Quote.

Basic Network Monitoring & Maintenance Included

• Basic 24/7/365 automated monitoring of covered network devices’ online status.
• Management of covered network devices, including configuration changes as reasonably needed.
• Patch management for covered network devices, including deployment of firmware and software updates as deemed necessary by Surety.
• Backup of covered network device configurations to support recovery and device replacement.

Prepaid Block Hours Separate Quote

If Client purchases prepaid technical support or consulting hours, Surety will provide eligible professional information technology services on demand during the applicable validity period (“Block Hour Services”). This section governs only Block Hour Services.

Client may purchase Prepaid Block Hours through a Quote or invoice identifying the number of hours, price, and any applicable scope, timing, term, or limitations (a “Block Order”). A Block Order becomes binding when Client signs or electronically accepts it, confirms acceptance by email, or pays the invoice. When payment is electronic, the associated payment record constitutes an electronic record of Client’s acceptance. A Block Order supplements an existing Quote, the MSA, and this Services Guide. It does not amend or override any of them unless it also satisfies the MSA’s “Amendment” provision. Surety’s performance or delivery alone does not constitute Client’s acceptance of a Block Order.

Nature; Availability; Expiration. Surety and Client intend each Block Order to be a business-to-business prepaid entitlement for the eligible Block Hour Services identified in that Block Order, not a gift card, general-purpose stored-value product, or transferable monetary balance. Client may not resell, redistribute, or market Prepaid Block Hours as a gift or for personal, family, or household use. This characterization does not limit applicable law. A Block Order may become binding under the acceptance methods above, but hours are not available and the validity period does not begin until Surety receives the full purchase price in cleared funds. That date is the “Purchase Date.”

Surety will state the Purchase Date and the “Expiration Date” on the Block Order or, if the Purchase Date is not known when the Block Order is issued, on the paid receipt. Unless a written Surety-approved extension or applicable law provides otherwise, the Expiration Date is 11:59 p.m. Central Time on the date twelve (12) calendar months after the Purchase Date. If that date does not occur in the applicable month, the Expiration Date is 11:59 p.m. Central Time on the last day of that month.

Unused hours automatically lapse at the Expiration Date. They are not refundable, transferable, or convertible into cash or a general credit against unrelated Fees, except as expressly provided under “Effect of Termination” below or required by applicable law. Hours may be used only for the eligible Block Hour Services identified in the applicable Block Order. Work requested after expiration requires a new Quote and will be billed at Standard Rates.

Order of Use. When more than one unexpired Block Order can be applied to the same requested work, Surety will deduct hours from the oldest applicable Block Order first, regardless of the purchase price or rate of that Block Order.

A request, ticket, or email submitted before expiration does not by itself extend or reserve the hours. If Surety confirms the request in writing before expiration and Surety’s scheduling delay alone causes the confirmed work to be performed after expiration, the confirmed work may be charged against the applicable Block Order. A Client-caused delay, nonpayment, or suspension does not extend the Expiration Date.

Extensions; Transfer. Surety may, but is not obligated to, extend an Expiration Date or permit carryover only by written confirmation issued before expiration. A courtesy extension is limited to the written period and does not waive any other term or create a course of dealing. Client may not sell, assign, or transfer Prepaid Block Hours without Surety’s written consent.

Effect of Termination. Upon termination of the applicable Block Hour Services or the MSA, hours may be used only until the earlier of the termination date or Expiration Date. If Surety ends the applicable Block Hour Services or the MSA before expiration for a reason not caused by Client’s breach or voluntary termination, Surety will refund the affected unused, unexpired hours. The refund is calculated at the Block Order’s stated per-hour purchase price, less amounts then due from Client. If Client terminates for convenience or Surety terminates for Client’s uncured material breach, unused hours are nonrefundable and lapse upon termination, except as required by applicable law.

Cloud Server & Cloud Desktop Hosting Add-On

Implementation, configuration, and ongoing management of cloud-hosted servers and cloud-hosted desktops on a platform supplied by Surety’s designated Third-Party Provider.

• Hosted resources may be provisioned in Client’s own cloud tenant and subscription, or in a cloud environment provisioned and managed by Surety, as indicated in the Quote. Where resources are provisioned in Client’s own tenant, Client owns and controls the subscription, and Surety manages the hosted resources on Client’s behalf.
• Provisioning and configuration of cloud servers or cloud desktops, including operating system deployment, network configuration, and secure access setup.
• Ongoing monitoring, patching, and maintenance of managed cloud resources in accordance with “Response Time Objectives and Support Hours” below.

Billing. Cloud platform consumption fees are usage-based, are billed under the cloud provider’s terms, and may fluctuate from month to month based on Client’s actual usage. Recurring managed-service Fees begin on the Commencement Date. Separately quoted or directly billed cloud consumption charges remain governed by the Quote and applicable Provider Terms. Availability and uptime of the cloud platform are governed by the cloud provider’s own terms and service level commitments, and are not warranted or guaranteed by Surety. Cloud-hosted services require a continuous, reliable internet connection.

DNS Threat Protection Included

Implementation and facilitation of a DNS-filtering and web-protection solution from Surety’s designated Third-Party Provider. Features include:

• Blocking of known malicious websites, including phishing, malware, and command-and-control domains.
• Category-based content filtering of unwanted or inappropriate web content, configured in consultation with Client.
• Protection for managed devices both on and off the managed network.
• Web activity and threat reporting available on request.

This Service is subject to the “Antivirus; Anti-Malware” and “Cybersecurity Incident Response and Recovery” provisions below. No filtering solution will block all malicious or unwanted content.

Email Archiving Add-On

Implementation and facilitation of an email-archiving solution from Surety’s designated Third-Party Provider. Features include:

• Automatic capture and preservation of inbound, outbound, and internal email messages for archived mailboxes.
• Archived messages are retained in secure, tamper-evident storage and encrypted in transit and at rest.
• Search and export capabilities to assist with Client’s legal, regulatory, or internal record-keeping needs.
• Archived data will be retained for the period indicated in the Quote or, if no period is indicated, for the platform’s standard retention period.

Scope. Email archiving is a message retention service only and is not a backup and file recovery solution. Mailbox backup is addressed under “Microsoft 365 Backup.”

Email-Only User Add-On

An “Email-Only User” is a user identified in the Quote who does not use a managed workstation. For each Email-Only User, the following Services are provided for that user’s account and mailbox:

• Email threat protection (as described in the Email Threat Protection section).
• Identity threat detection and response monitoring of the user’s account (as described in the Microsoft 365 Management & Security section).
• Cloud-to-cloud backup of the user’s mailbox and associated cloud data (as described in the Microsoft 365 Backup section).

Scope. Support for Email-Only Users is limited to email and account-related issues. Email-Only Users are not entitled to the Business Device included in standard “per user” billing (see Covered Environment below), and device-related support for Email-Only Users is an Out-of-Scope Service.

Email Threat Protection Included

Implementation and facilitation of an email-threat-protection solution from Surety’s designated Third-Party Provider. Features include:

• Managed email protection from phishing, business email compromise (BEC), spam, and email-based malware.
• Artificial intelligence and machine learning analysis of inbound, outbound, and internal email to detect phishing and social engineering attacks such as whaling, CEO fraud, and invoice fraud.
• Scanning and emulation of attachments and links to detect malware and malicious websites before delivery.
• Protection against impersonation attacks, including display name spoofing and “look-alike” domain names.
• Management of email authentication records (SPF, DKIM, and DMARC) for Client’s domains, including ongoing monitoring of authentication reporting to detect spoofing of Client’s domains and unauthorized senders.
• Quarantine management and end-user notification of blocked or held messages.

This Service is subject to the “Antivirus; Anti-Malware” and “Cybersecurity Incident Response and Recovery” provisions below. All hosted email is subject to the “Hosted Email” provision and the “Acceptable Use Policy” below.

Endpoint Antivirus & Malware Protection Included

Implementation and facilitation of a cloud-native endpoint-protection platform from Surety’s designated Third-Party Provider. This Service covers workstations and servers expressly identified in the Quote. Features include:

• Next-generation antivirus using artificial intelligence, machine learning, and behavioral analysis to block malware, ransomware, and fileless attacks, including malicious scripts and macros.
• Software agents deployed to managed laptops and desktops and, when expressly covered in the applicable Quote, managed servers across supported operating systems.
• Endpoint detection and response (EDR): continuous recording of endpoint activity to support threat detection, investigation, and root cause analysis.
• Remote response capabilities, including network containment (isolation) of a compromised endpoint to prevent the spread of a threat.
• Cloud-delivered threat intelligence, with endpoint telemetry retained in the platform to support investigations.

Response actions are subject to the “Automated Security Response” provision and Client’s documented response settings.

This Service is subject to the “Antivirus; Anti-Malware” and “Cybersecurity Incident Response and Recovery” provisions below.

Extended Detection & Response (XDR) Add-On

Implementation and facilitation of an extended detection and response platform from Surety’s designated Third-Party Provider. Features include:

• Collection and correlation of security telemetry from across the Environment, which may include endpoints, network devices, servers, and cloud services.
• Threat detections developed and maintained by the Third-Party Provider, updated as new threats emerge.
• Automated response capabilities, which may include isolation of a compromised endpoint in response to critical threats and automated blocking of traffic from known malicious sources.
• Prioritized findings with recommended response steps.
• Deception (honeypot) sensors that provide early detection of unauthorized activity inside the managed network, where deployed.
• Escalation support from the Third-Party Provider for urgent, priority findings.

Remediation of detected threats beyond the automated response actions described above may be provided on a time-and-materials basis. This Service is subject to the “Antivirus; Anti-Malware” and “Cybersecurity Incident Response and Recovery” provisions below.

End-User Security Awareness Training Add-On

Implementation and facilitation of a security awareness training solution from Surety’s designated Third-Party Provider. Features include:

• Online, on-demand training modules covering phishing, social engineering, and other common security threats (multilingual).
• Simulated phishing email campaigns, which may be automatically generated and personalized based on real-world attack patterns, or configured from administrator-defined templates.
• Tracking and reporting of training completion and simulation results.

This Service is subject to the “Antivirus; Anti-Malware” and “Cybersecurity Incident Response and Recovery” provisions below.

Expert Solution Planning Included

Assistance identifying technology problems and opportunities within Client’s business and mapping out practical solutions. Features include:

• Consultation to help identify and define the underlying problem or business need.
• Research and recommendation of appropriate solutions, including hardware, software, and service options.
• Scoping and planning of the recommended solution.

Scope. Implementation of a recommended solution is performed as a separately quoted project (see “Fees” and “Procurement” below). Solution planning is advisory, and Surety does not warrant or guarantee any particular business outcome.

Extra Workstations Add-On

Standard “per user” billing includes one (1) Business Device per Covered User (see Covered Environment below). If a user requires more than one managed workstation, each additional workstation may be added as an “Extra Workstation” for an additional per-device fee as indicated in the Quote. Each Extra Workstation includes:

• Remote monitoring and management agent.
• Next-generation antivirus and endpoint protection (as described in the Endpoint Antivirus & Malware Protection section above).
• DNS threat protection and malicious-website blocking (as described in the DNS Threat Protection section above).
• Privileged access management (as described in the Privileged Access Management section below).

Each Extra Workstation is a Covered Device and receives the Services listed above, together with Updates & Patching, Workstation Monitoring & Maintenance, and Remote Help Desk support, on the same terms as other covered workstations.

Front of Line Response Add-On

If the Quote includes Front of Line Response, support requests submitted by Client will be placed at the front of Surety’s support queue, ahead of standard-priority requests from other clients.

• Applies to support requests received through Surety’s designated support channels during normal business hours.
• Requests remain subject to severity-based triage; a higher-severity issue affecting another client may still be addressed first where reasonably necessary.
• Front of Line Response determines the order in which requests are addressed. It does not change the objectives under “Response Time Objectives and Support Hours” below or guarantee resolution within any time period.

HIPAA Compliance Program Facilitation Add-On

For Clients subject to the Health Insurance Portability and Accountability Act (“HIPAA”), Surety may facilitate Client’s enrollment in a HIPAA compliance program offered by an independent Third-Party Provider. Compliance program features (such as risk assessments, policy templates, workforce training, and compliance documentation) are provided solely by the Third-Party Provider under its own agreement with Client.

Limitations. Surety does not provide legal or HIPAA compliance services and is not a compliance auditor or law firm. Enrollment in a compliance program or implementation of technical safeguards does not by itself make Client compliant. Surety does not guarantee that Client will achieve or maintain compliance with HIPAA or another legal requirement. Client remains responsible for its compliance and should consult qualified legal counsel.

IT Consulting Separate Quote

Professional IT consulting services provided under a separate Quote or engagement. Consulting services may include:

• Technology strategy, roadmaps, and assessments.
• Assistance in creating information- and data-related plans and budgets.
• Strategic guidance and consultation across different technologies.
• Development of technology standards and operating practices tailored to Client.
• Education and recommendations for business technologies.
• Periodic advisory meetings to review progress against agreed objectives.
• Maintenance of technology documentation.
• Assessment and recommendations for improving technology usage and services.

Managed VPN Add-On

Implementation and facilitation of a secure virtual private network (VPN) solution from Surety’s designated Third-Party Provider. Features include:

• Encrypted, point-to-point connectivity between enrolled devices, networks, and designated resources.
• Zero trust access policies that limit connectivity based on user, device, and resource.
• Central management of device enrollment, encryption keys, and access policies.
• Integration with Client’s identity provider for single sign-on and multi-factor authentication, where applicable.

Dependencies. VPN services require a reliable internet connection at each participating location and device. Connection speed and quality depend on the underlying internet connections. Surety does not warrant or guarantee uninterrupted or error-free VPN connectivity.

Microsoft 365 Backup Included

Implementation and facilitation of a cloud-to-cloud backup solution from Surety’s designated Third-Party Provider. Features include:

• Automated daily backup of covered Microsoft 365 data, which may include mailboxes, calendars, contacts, cloud file storage, and collaboration site data (as indicated in the Quote).
• Backed-up data is stored in secure cloud storage, separate from Client’s Microsoft 365 tenant, and encrypted in transit and at rest.
• Granular restore capabilities at the item, folder, mailbox, or account level.
• Backed-up data will be retained for the period indicated in the Quote or, if no period is indicated, for the platform’s standard retention period.
• Monitoring of backup successes and failures.

Limitations. Native Microsoft 365 retention features are not a backup solution. Requests to restore backed-up Microsoft 365 data follow the “Recovery of Data” procedures described in the Backup and File Recovery section above.

Microsoft 365 Management & Security Included

Administration, hardening, and security monitoring of Client’s Microsoft 365 tenant. Features include:

• Tenant Administration: Management of users, licenses, mailboxes, groups, and tenant-level settings; user onboarding and offboarding support.
• Consolidated Billing: Microsoft 365 licenses may be purchased and billed through Surety (see “Access Licensing” in the Fees section below for important license terms).
• Tenant Hardening: Application of security baseline standards to the managed tenant, with monitoring for configuration drift and remediation of deviations from the established baseline.
• Identity Threat Detection & Response: Surety’s designated Third-Party Provider monitors sign-in activity and identity-related events for suspicious activity, including anomalous sign-ins, unauthorized mailbox rules, and indicators of account compromise. Response actions may include disabling affected accounts and terminating active sessions.
• Encrypted Email: Configuration and support of encrypted email capabilities included with Client’s Microsoft 365 licensing.

Surety configures its designated Third-Party Provider’s Microsoft 365 integration to collect security event logs, user metadata, and access-attempt information. The integration is not intended for electronic protected health information (ePHI) storage. If a Service will create, receive, maintain, or transmit ePHI on Client’s behalf, the MSA’s Business Associate Agreement requirement applies before that Service begins.

This Service is subject to the “Antivirus; Anti-Malware” and “Cybersecurity Incident Response and Recovery” provisions below. No security solution is completely effective, and Surety does not warrant or guarantee that all threats to the managed tenant will be detected or prevented.

Mobile Device Management (MDM) Add-On

Implementation and facilitation of a mobile device management solution. Features include:

• Enrollment of Client-owned devices (and, where expressly agreed, personal devices) into the managed platform.
• Deployment of configuration profiles, compliance policies, and device access requirements to enrolled devices.
• Deployment and updating of approved applications on enrolled devices.
• Remote lock and selective removal of managed Client data, where supported.

Scope. Support for personal (BYOD) devices is limited to these management functions; hardware, carrier, and personal application issues are Out-of-Scope Services. Surety does not factory-reset personal devices or remove personal data. Remote actions require a responsive, powered-on, internet-connected device, and removal of all managed Client data is not guaranteed.

Multi-Factor Authentication (MFA) Add-On

Implementation and facilitation of a multi-factor authentication solution from Surety’s designated Third-Party Provider that extends multi-factor authentication beyond Microsoft 365 to other applications and logins. Features include:

• App-based authentication on user smartphones, including push-notification approvals and one-time passcodes.
• Protection for cloud applications and supported on-premises applications and logins.
• Access policies based on user, group, location, or device state, where supported by the platform and Client’s licensing.
• Enrollment support and ongoing administration of the MFA platform.

Network as a Service (NaaS) Add-On

If indicated in the Quote, Surety will supply, install, and manage network hardware at Client’s premises on a subscription basis (“NaaS Equipment”). NaaS Equipment may include gateway/firewall appliances, network switches, and wireless access points from Surety’s designated hardware provider. Features include:

• NaaS Equipment is centrally managed through a cloud-based management platform, enabling remote configuration, monitoring, and alerting.
• Managed gateway/firewall appliances provide supported stateful firewalling, intrusion detection and prevention, website and content filtering, encrypted remote access, and site-to-site VPN capabilities.
• Wireless access points are installed to provide wireless coverage in areas agreed upon by Surety and Client.
• Surety applies firmware updates as it reasonably determines necessary.
• Replacement, at no additional charge, of NaaS Equipment that fails through ordinary use, subject to hardware availability.

Limitations. Gateway appliances do not perform antivirus scanning of network traffic. Malware protection is provided at the endpoint level as described under “Endpoint Antivirus & Malware Protection.” Surety will use commercially reasonable efforts to support wireless connectivity. Client acknowledges that some end-user devices may not connect to, or perform well on, the wireless network.

The following terms apply to all NaaS Equipment:

• NaaS Equipment is and remains the sole property of Surety. Client acquires no ownership interest in NaaS Equipment.
• Client must not move, modify, reconfigure, or affix or install any accessory, addition, or upgrade to NaaS Equipment without Surety’s prior written consent.
• Upon termination of the applicable Services, all NaaS Equipment must be returned in accordance with the MSA’s “Equipment; Software Agents” provision. Client is responsible for the replacement value of NaaS Equipment that is missing or damaged beyond ordinary wear and tear.

Network Operations Center (NOC) Add-On

Network Operations Center (“NOC”) Services cover only supported network devices identified in the Quote, such as gateway/firewall appliances, switches, and wireless access points. They may be purchased as an add-on or as a standalone Service. Features include:

• 24/7/365 automated monitoring of covered network devices, including online status, performance, and device health, with alerting to Surety’s network operations team.
• Management of covered network devices, including configuration changes as reasonably needed.
• Patch management for covered network devices, including deployment of firmware and software updates as deemed necessary by Surety.
• Backup of covered network device configurations to support recovery and device replacement.
• Coordination with Client’s designated onsite contacts and with Client’s internet service provider(s) during alert response, as reasonably needed to facilitate remediation.
• Response to alerts during Surety’s normal business hours in accordance with “Response Time Objectives and Support Hours” below.
• For critical alerts received outside normal business hours, Surety will use commercially reasonable efforts to respond, subject to technician availability. After-hours response is not guaranteed, and after-hours remediation work is billed as Non-Business Hour Support (see “Response Time Objectives and Support Hours” below).

Scope. NOC services cover only the network devices identified in the Quote. Support for workstations, servers, applications, end users, and other portions of the Environment is not included and, if requested, requires a separate Service or will be billed on a time-and-materials basis. When NOC services are provided on a standalone basis, the Covered Environment consists only of those network devices.

Password Manager Add-On

Implementation and facilitation of a password-management solution from Surety’s designated Third-Party Provider. Features include:

• Secure Vaults: Encrypted vaults for storing passwords and other sensitive items, such as payment cards, identities, and secure notes.
• Password Generation: Generate strong, unique passwords with editable options to meet specific criteria.
• Shared Vaults: Team-based shared vaults with permission controls, allowing credentials to be shared securely within Client’s organization.
• Browser Extension: Browser extension with automatic form filling for easy, secure sign-ins.
• Mobile App: Mobile apps provide access to vaults and stored items on smartphones and tablets.
• Credential Health Monitoring: Built-in monitoring that flags weak, reused, or compromised passwords that appear in known data breaches.

PDF Editing Software Add-On

Licensing of a PDF-editing application from Surety’s designated Third-Party Provider on the per-user or per-device basis stated in the Quote. Features include:

• Creation, editing, conversion, and annotation of PDF documents.
• Installation and deployment of the application on managed devices.
• License management through Surety (see the Software Licensing section below).

The application is licensed, not sold, and is subject to the vendor’s end-user license agreement. For support beyond installation and basic configuration, Surety will use commercially reasonable efforts to coordinate with the applicable software provider.

Penetration (Pen) Testing Separate Quote

Penetration testing is an authorized, point-in-time simulation of a cyberattack intended to identify exploitable vulnerabilities. Unlike automated vulnerability scanning, it may include staged reconnaissance and exploitation, such as brute-force or SQL-injection testing, during business or non-business hours. Testing may include:

• External Pen Testing: Evaluates internet-facing systems, networks, firewalls, devices, and web applications for vulnerabilities that could permit unauthorized access.
• Internal Pen Testing: Evaluates the effort required for an attacker to overcome and exploit Client’s internal security controls after gaining access.
• PCI Pen Testing: PCI penetration testing uses external and internal testing methodologies within the scope identified in the Quote to evaluate the applicable PCI DSS penetration-testing requirements.
• Web Application Pen Testing: Evaluates a website or web application using the Penetration Testing Execution Standard and the Open Worldwide Application Security Project testing framework.

This Service is subject to the “Penetration Testing; Vulnerability Scanning” provision below.

Printer Management Add-On

Implementation and facilitation of a cloud-print management solution from Surety’s designated Third-Party Provider. Features include:

• Centralized deployment of print queues and printer drivers to managed devices.
• Monitoring of managed print infrastructure and print-related alerting.
• User self-service printer installation on managed devices.
• Secure print release functionality, where supported by Client’s printer hardware.

Scope. Printer management covers print software and queue management only. Printer hardware repair, physical maintenance, and consumables (such as toner and drums) are not included. If requested, Surety will facilitate hardware service with the applicable printer vendor on a time-and-materials basis.

Privileged Access Management (PAM) Included

Implementation and facilitation of an endpoint privilege management solution from Surety’s designated Third-Party Provider. Features include:

• Removal of standing local administrator rights from end users on managed endpoints.
• Just-in-time elevation requests, with approval workflows handled by Surety technicians in accordance with “Response Time Objectives and Support Hours” below.
• Application-level privilege rules that permit approved applications to run with elevated rights without exposing administrator credentials to end users.
• Audit logging of elevation requests and privileged activity on managed endpoints.

Dependencies. Because standing administrator rights are removed, some software installations and system changes on managed endpoints will require an elevation request and Surety’s approval. This control is an intentional part of the Service’s security design.

Project Labor Separate Quote

Surety provides project-based professional services under a separate Quote. The Quote describes the applicable scope of work (the “Project Scope”). Projects may include:

• Deployment of new or replacement workstations, including setup, agent and security software installation, domain or tenant join, application installation, and transfer of user data and profiles.
• Server deployments, migrations, and upgrades.
• Network design, infrastructure refresh, and new office buildouts.
• Cloud and email platform migrations.
• Office moves and equipment relocations.
• Other technology projects described in a Quote.

Fixed Fee. Unless the Quote states otherwise, the quoted project fee is fixed solely for the Project Scope.

Unforeseen Conditions. Surety will notify Client in writing if a preexisting, hidden, or undisclosed condition requires work beyond the Project Scope. Examples include deficient cabling, a corrupted directory service, unsupported or failing hardware, and undocumented configurations. If the additional work is reasonably expected to cost no more than the lesser of ten percent (10%) of the quoted project fee or $500, Surety may proceed after giving notice. Surety will invoice that work at Standard Rates. Work above that threshold requires an accepted written change order describing the condition, additional work, price, and anticipated schedule effect. If Client does not accept the change order, Surety may suspend the affected work and adjust the schedule.

Payment Terms. Fifty percent (50%) of the quoted project fee is due in advance before work begins. For projects with a quoted fee of more than $5,000, the remaining balance will be invoiced against completion milestones if milestones are identified in the Quote, and otherwise upon completion. For all other projects, the remaining balance is invoiced upon completion.

Scheduling; Rates. Project work is scheduled in advance and is subject to technician, hardware, and license availability. Unless the Quote states otherwise, project work is performed during normal business hours. Non-Business Hour Support is subject to the rates below, and onsite project work is subject to the minimum of two (2) hours per onsite visit. Project labor does not draw from the Included Monthly Remote Support Allowance but may be applied against eligible Prepaid Block Hours.

Scope Changes; Acceptance. Changes to the Project Scope are governed by the Change Orders section below. The MSA’s “Services Warranty; Acceptance” provision governs acceptance and notice of defects or nonconformance.

Exclusions. Unless expressly included in the Quote, project fees do not include:

• Data or voice cabling, wiring, electrical work, furniture, millwork, or physical mounting.
• Customization or programming of third-party applications, data entry, data cleanup, or end-user training.
• Battery-backup replacement; hardware, software, licenses, parts, shipping, or Third-Party Services; or hardware repair.
• Support for manufacturer-unsupported systems or remediation of preexisting conditions outside the Project Scope.

Hardware or licenses supplied as part of a project must be identified in the Quote and are subject to the Procurement policy below.

Client Responsibilities. Client will:

• Provide timely physical and remote access to the premises and Environment.
• Make an authorized decision-maker reasonably available for questions and approvals.
• Approve and honor scheduled downtime and maintenance windows.
• Provide required licenses, installation media, and license keys.
• Disclose known deficiencies and undocumented configurations before work begins.
• Not modify affected portions of the Environment during the project without Surety’s authorization under the MSA.
• Maintain current backups of affected data and systems unless Client purchases applicable backup Services from Surety.

Appointment cancellation and rescheduling are subject to the Appointment Cancellations provision below. Used, remanufactured, or consumer-grade hardware may limit supportability; see Minimum Requirements and Exclusions.

Recurring Onsite Technician Add-On

If the Quote includes Recurring Onsite Technician services, a Surety technician will visit Client’s designated location(s) on a predetermined, recurring schedule (e.g., weekly or monthly) as indicated in the Quote.

• During scheduled visits, the technician will address open support requests, perform proactive maintenance, and assist end users on site.
• Visit frequency and duration are as indicated in the Quote. Time required beyond the scheduled visit duration is subject to technician availability and will be billed at Standard Rates.
• Scheduled visits may be rescheduled by either party with reasonable advance notice. The Appointment Cancellations provisions in the Fees section below apply to missed or untimely canceled visits.

Remote Help Desk Included

• Remote support provided during normal business hours for managed devices and covered software.
• Included Monthly Remote Support Allowance: Each Covered User is allocated fifteen (15) minutes of remote support time per month. The allowance is pooled among Covered Users. Unless the Quote states otherwise, unused time does not carry over and has no cash value.
• Remote support beyond the pooled monthly allowance is billed at Standard Rates, less any eligible discount.
• The allowance applies only to remote support. Onsite visits do not consume it and are billed at Standard Rates, less any eligible discount, subject to a minimum of two (2) hours per visit.
• Remote Employee Onboarding: Assistance establishing computer and email accounts for new employees, including initial sign-in and access support.
• Vendor Coordination: Coordination with Client’s line of business software and service vendors to help bridge the gap between those vendors and Client’s managed technology.

Remote Monitoring and Management (RMM) Agent Included

The Remote Monitoring and Management (“RMM”) Service uses software agents installed on Covered Devices to report status and IT-related events continuously. Surety responds to generated alerts under “Response Time Objectives and Support Hours” below.

• Includes capacity monitoring, with alerts to Surety for available disk space below configured alert thresholds (covers standard fixed HDD and SSD partitions, not external devices such as USB or mapped drives).
• Includes routine operating-system maintenance, including removal of temporary files where appropriate.
• Review and installation of updates and patches for supported software.

In addition to the above, Surety’s remote monitoring and management service will monitor and alert on the following:

• Hardware Failures
• Device Offline
• Failed or Missing Backup
• Failed or Missing Updates
• Low Disk Space
• Excessive Uptime

Security Information & Event Management (SIEM) Add-On

Implementation and facilitation of a cloud-delivered SIEM solution from Surety’s designated Third-Party Provider.

The SIEM service collects and analyzes log data from across the Environment to detect threats against the managed network.

• Log Collection. Collection of log and event data from covered network devices, servers, cloud services, and applications through sensors and platform integrations deployed in the Environment.
• Detection. Prebuilt threat detection rules developed and maintained by the Third-Party Provider’s security operations team, updated automatically as new threats emerge. Detections cover external attacks as well as potential insider threats occurring inside the monitored network.
• Alerts & Analysis. Detections are prioritized by severity and accompanied by guided response playbooks. For urgent, priority findings, the Third-Party Provider’s security operations team is available for additional analysis and assistance.
• Retention. Collected log data will be retained for the period indicated in the Quote or, if no period is indicated, for the platform’s standard retention period.

Detection rules are tuned to Client’s Environment and user behavior after deployment, and tuning continues as the Environment changes. At any time, detections may include false positives, and some anomalous or malicious activity may go undetected. The MSA’s “Security Limitations” provision applies.

Scope. SIEM is a monitoring and alerting service. Remediation of detected or actual threats is not included and, if requested, may require Client to retain Surety’s services on a time-and-materials basis.

Server Monitoring & Maintenance Add-On

As part of the RMM Service, Surety will monitor and maintain managed servers as follows:

• Software agents installed in covered servers report status and IT-related events on a 24/7 basis; alerts are generated and responded to in accordance with “Response Time Objectives and Support Hours” below.
• Online status monitoring, with alerts to Surety for potential failures or outages.
• Capacity monitoring, with alerts to Surety for available disk space below configured alert thresholds (covers standard fixed HDD and SSD partitions, not external devices such as USB or mapped network drives).
• Performance monitoring, with alerts to Surety for unusual processor or memory usage.
• Monitoring of essential operating-system and server-role services, with alerts to Surety for detected failures.
• Endpoint protection agent monitoring, with alerts to Surety for potential security vulnerabilities.
• Routine operating-system maintenance, including removal of temporary files where appropriate.
• Secure remote connectivity to the server and collaborative screen sharing.
• Review and installation of updates and patches for Windows and supported software.
• Asset inventory and server information collection.

Software Licensing

(applies to all software licensed by or through Surety)

Software provided by or through Surety is licensed, not sold. Client and its Authorized Users must comply with applicable EULAs, acceptable use policies, and other Provider Terms.

The MSA’s “Provider Terms; Third-Party Terms Schedule” provision governs identification and acceptance of those terms. Surety will not accept terms on Client’s behalf when direct Client or Authorized User acceptance is required. The Third-Party Terms Schedule or applicable Quote identifies the governing documents and acceptance method.

Updates & Patching Included

• Remotely deploy approved operating-system and supported-software bug fixes, minor updates, security updates, and service packs.
• Deploy and monitor approved firmware updates on applicable Covered Devices.
• Perform minor remote installations or upgrades that typically require less than thirty (30) minutes.

Limitations. Surety deploys critical patches and updates (“Patches”) after general release by the applicable provider, subject to testing, compatibility, maintenance windows, and Surety’s reasonable deployment judgment. Provider-developed Patches may cause instability or failure even when installed correctly. Surety may defer a Patch that presents a known or reasonably suspected compatibility or stability risk. The MSA’s “Updates” and liability provisions apply.

Voice over Internet Protocol (VoIP) Services Facilitation Add-On

Surety may facilitate Client’s enrollment with a VoIP telephone service offered by an independent Third-Party Provider. The VoIP service, including call routing, voicemail, caller ID, conference calling, desktop and mobile applications, and related telephone features, is hosted and provided solely by the Third-Party Provider under its own agreement with Client.

Surety’s facilitation services may include:

• Assisting with provider selection and initial account setup.
• Deployment and configuration of telephone hardware and applications on the managed network.
• Coordinating with the Third-Party Provider on service and support issues.

Scope. Surety does not host, operate, or provide telephone or VoIP services. Service availability, call quality, uptime commitments, and E911 functionality are governed by the Third-Party Provider’s own terms of service, including any E911 address registration requirements and consent forms required by the Third-Party Provider. Client is responsible for reviewing and complying with the Third-Party Provider’s E911 requirements. Client acknowledges that 911 dialing over VoIP services has limitations, including dependence on power, internet connectivity, and accurate registered addresses.

Vulnerability Management Add-On

Implementation and facilitation of an agent-based vulnerability management solution from Surety’s designated Third-Party Provider. Features include:

• Continuous monitoring of covered devices for known vulnerabilities in operating systems and supported applications.
• Periodic vulnerability reporting, including severity ratings and remediation recommendations.
• Development of a custom patch deployment plan with Client that aligns remediation activities with Client’s business requirements, maintenance windows, and application compatibility considerations.
• Deployment of patches and remediations in accordance with the agreed patch deployment plan.
• For covered servers, confirmation of usability after updates are applied, based on a verification plan outlined by Client.

Limitations. Patches and updates are developed by third-party vendors and may occasionally cause instability or failure even when installed correctly (see the Updates & Patching section above). Unless Client subscribes to Surety’s backup Services (see Backup and File Recovery above), Client is responsible for maintaining backups, snapshots, or other rollback protection for covered devices before patch deployment. Server usability confirmation is limited to the checks in Client’s verification plan. Client is responsible for defining and maintaining that plan, and Surety does not warrant or guarantee detection of every post-update issue.

Vulnerability Scanning Separate Quote

Implementation and facilitation of a vulnerability scanning solution from Surety’s designated Third-Party Provider.

Vulnerability scanning identifies potential vulnerabilities within the defined scan scope. External vulnerability scans (which pertain to the IP address assigned to each Client location through Client’s ISP) are run monthly. Internal vulnerability scans (which pertain to all systems inside the managed network) are run at least annually.

Vulnerability results will be discussed during business review meetings with Client. Vulnerability reports will be made available on request.

This Service is subject to the “Penetration Testing; Vulnerability Scanning” provision below.

Workstation Monitoring & Maintenance Included

Software agents installed in covered workstations report status and IT-related events on a 24/7 basis; alerts are generated and responded to in accordance with “Response Time Objectives and Support Hours” below.

• Online status monitoring, with alerts to Surety for potential failures or outages.
• Capacity monitoring, with alerts to Surety for available disk space below configured alert thresholds (covers standard fixed HDD and SSD partitions, not external devices such as USB or mapped network drives).
• Performance monitoring, with alerts to Surety for unusual processor or memory usage.
• Endpoint protection agent monitoring, with alerts to Surety for potential security vulnerabilities.
• Routine operating-system maintenance, including removal of temporary files where appropriate.
• Secure remote connectivity to the workstation and collaborative screen sharing.
• Review and installation of updates and patches for Windows and supported software.
• Asset inventory and workstation information collection.