Services Guide

Backup and File Recovery Add-On

Implementation and facilitation of a top-tier, image-based backup and file recovery solution from our designated Third Party Provider. Features include:

• Image-based backups of covered servers and workstations, capturing the full system (operating system, applications, settings, and data).
• Two deployment options, as indicated in the Quote: (i) an onsite backup appliance (“Backup Appliance”) with replication to secure cloud storage, or (ii) direct-to-cloud backup with no onsite appliance.
• Immutable copies of backed up data retained in the cloud to protect against ransomware and accidental or malicious deletion.
• Automated, recurring backup integrity checks.
• Recovery options ranging from individual files and folders to full system images, including virtualization of protected systems locally or in the cloud for business continuity purposes.
• Offsite backup of supported network-attached storage (NAS) devices to secure cloud storage, where indicated in the Quote.
• Monitoring of the backup system, including monitoring of backup successes and failures, and troubleshooting and remediation of failed backups.
• Firmware and software updates of the Backup Appliance (if deployed).

Backup Data Security: All backed up data is encrypted in transit and at rest using 256-bit AES encryption. Cloud copies of backed up data are stored in secure datacenters that implement physical security controls and redundant internet connectivity.

Backup Retention: Backed up data will be retained on a rolling thirty (30) day basis unless a different time period is expressly stated in the Quote. This applies to both local and cloud backups.

Recovery of Data: If you need to recover any of your backed up data, then the following procedures will apply:

• Service Hours: Backed up data can be requested during our normal business hours, which are currently 8:00 AM to 5:00 PM Central, Monday through Friday.
• Request Method. Requests to restore backed up data should be made through one of the following methods:
  • Email: help AT suretytek.com
  • Telephone: 402-896-4261
• Restoration Time: We will endeavor to restore backed up data as quickly as possible following our receipt of a request to do so; however, in all cases data restoration services are subject to (i) technician availability and (ii) confirmation that the restoration point(s) is/are available to receive the backed up data.

Backup & Recovery Planning Included

Development and maintenance of a backup and recovery strategy for Client’s critical data and systems. Features include:

• Identification of Client’s critical data, systems, and resources.
• Definition of Client’s tolerances for recovery time and data loss.
• Development of a backup and recovery strategy using the backup solutions described in this Services Guide, with recommended backup services reflected in the Quote.
• Annual review of the backup and recovery strategy, with updated recommendations as Client’s environment and needs change.

Note: Backup & Recovery Planning is a planning and advisory service. The backup services themselves (such as Backup and File Recovery and Microsoft 365 Backup) are provided as described in their respective sections and as indicated in the Quote.

Basic Network Monitoring & Maintenance Included

• Basic 24x7x365 automated monitoring of covered network devices’ online status.
• Management of covered network devices, including configuration changes as reasonably needed.
• Patch management for covered network devices, including deployment of firmware and software updates as deemed necessary by Surety.
• Backup of covered network device configurations to support recovery and device replacement.

Prepaid Block Hours Separate Purchase

If you purchase one or more blocks of prepaid technical support or consulting hours from Surety, then we will provide our professional information technology consulting services to you from time to time on an ongoing, “on demand” basis (“Block Hour Services”). Block Hour Services are a subset of the Services, and this section governs only Block Hour Services.

Client may purchase Prepaid Block Hours through a Quote or invoice identifying the number of hours, price, and any applicable scope, timing, term, or limitations (a “Block Order”). A Block Order becomes binding when Client signs or electronically accepts it, confirms acceptance by email, or pays the invoice. When payment is electronic, the associated payment record constitutes an electronic record of Client’s acceptance. A Block Order supplements, but does not amend or override, an existing Quote, the MSA, or this Services Guide unless the Block Order is a Surety-initiated amendment that satisfies the “Amendment” provision of the MSA. Surety’s performance or delivery alone does not constitute Client’s acceptance of a Block Order.

The specific scope, timing, term, and pricing of the Services (collectively, “Specifications”) will be determined between you and us at the time that you request the Services from us.

You and we may finalize the Specifications (i) by exchanging emails confirming the relevant terms, or (ii) by you agreeing to an invoice, purchase order, or similar document we send to you that describes the Specifications (an “Invoice”), or in some cases, (iii) by us performing the Services or delivering the applicable deliverables in conformity with the Specifications.

An email or Invoice may confirm Specifications for a particular request within an accepted Block Order, but does not amend or override the Block Order, a Quote, the MSA, or this Services Guide. If requested Specifications would differ from an existing Block Order or Quote, Surety will issue a replacement Quote for Client’s acceptance or a written amendment that satisfies the “Amendment” provision of the MSA.

A Service will be deemed completed upon our final delivery of the applicable portions of Specifications unless a different completion milestone is expressly agreed upon in the Specifications (“Service Completion”). (For example, sales of hardware will be deemed completed when the hardware is delivered to you; licensing will be completed when the licenses are provided to you, etc.) Acceptance of, and the reporting of any defects or deviations from the Specifications in, a completed Service is governed by the “Services Warranty; Acceptance” provisions of the MSA. Issues or remedial activities that fall outside of those provisions will be billed to you at our then-current hourly rates.

Unless we agree otherwise in writing, Services will be provided only during our normal business hours, which are currently 8:00 AM to 5:00 PM Central, Monday through Friday. Services provided outside of our normal business hours are subject to increased fees and technician availability and require your and our mutual consent to implement.

The priority given to implementing the Services will be determined in our reasonable discretion, considering any milestones or deadlines expressly agreed upon in an invoice or email from Surety. If no specific milestone or deadline is agreed upon, then the Services will be performed in accordance with your needs, the specific requirements of the job(s), and technician availability.

Cloud Server & Cloud Desktop Hosting Add-On

Implementation, configuration, and ongoing management of cloud-hosted servers and/or cloud-hosted desktops on an industry-leading cloud platform from our designated Third Party Provider.

• Hosted resources may be provisioned in Client’s own cloud tenant and subscription, or in a cloud environment provisioned and managed by Surety, as indicated in the Quote. Where resources are provisioned in Client’s own tenant, Client owns and controls the subscription, and Surety manages the hosted resources on Client’s behalf.
• Provisioning and configuration of cloud servers and/or cloud desktops, including operating system deployment, network configuration, and secure access setup.
• Ongoing monitoring, patching, and maintenance of managed cloud resources in accordance with the Service Levels described below.

Please note: Cloud platform consumption fees are usage-based, are billed under the cloud provider’s terms, and may fluctuate from month to month based on Client’s actual usage. Consumption fees may begin to accrue before the “go-live” date of other Services (see “Reconciliation” in the Fees section below). Availability and uptime of the cloud platform are governed by the cloud provider’s own terms and service level commitments, and are not warranted or guaranteed by Surety. Cloud-hosted services require a reliable, always-connected internet solution.

DNS Threat Protection Included

Implementation and facilitation of an industry-recognized DNS filtering and web protection solution from our designated Third Party Provider. Features include:

• Blocking of known malicious websites, including phishing, malware, and command-and-control domains.
• Category-based content filtering of unwanted or inappropriate web content, configured in consultation with Client.
• Protection for managed devices both on and off the managed network.
• Web activity and threat reporting available on request.

Please see the Anti-Virus; Anti-Malware and Breach / Cyber Security Incident Recovery sections below for important details. No filtering solution will block all malicious or unwanted content.

Email Archiving Add-On

Implementation and facilitation of an industry-recognized email archiving solution from our designated Third Party Provider. Features include:

• Automatic capture and preservation of inbound, outbound, and internal email messages for archived mailboxes.
• Archived messages are retained in secure, tamper-evident storage and encrypted in transit and at rest.
• Search and export capabilities to assist with Client’s legal, regulatory, or internal record-keeping needs.
• Archived data will be retained for the period indicated in the Quote.

Note: Email archiving is a message retention service only and is not a backup and file recovery solution. Please see the Microsoft 365 Backup section for mailbox backup services.

Email-Only User Add-On

An “Email-Only User” is a user identified in the Quote who does not use a managed workstation. For each Email-Only User, the following Services are provided for that user’s account and mailbox:

• Email threat protection (as described in the Email Threat Protection section).
• Identity threat detection and response monitoring of the user’s account (as described in the Microsoft 365 Management & Security section).
• Cloud-to-cloud backup of the user’s mailbox and associated cloud data (as described in the Microsoft 365 Backup section).

Please note: Support for Email-Only Users is limited to email and account-related issues. Email-Only Users are not entitled to the Business Device included in standard “per user” billing (see Covered Environment below), and device-related support for Email-Only Users is out of scope unless otherwise agreed in writing.

Email Threat Protection Included

Implementation and facilitation of a trusted email threat protection solution from our designated Third Party Provider. Features include:

• Managed email protection from phishing, business email compromise (BEC), SPAM, and email-based malware.
• Artificial intelligence and machine learning analysis of inbound, outbound, and internal email to detect phishing and social engineering attacks such as whaling, CEO fraud, and invoice fraud.
• Scanning and emulation of attachments and links to detect malware and malicious websites before delivery.
• Protection against impersonation attacks, including display name spoofing and “look-alike” domain names.
• Management of email authentication records (SPF, DKIM, and DMARC) for Client’s domains, including ongoing monitoring of authentication reporting to detect spoofing of Client’s domains and unauthorized senders.
• Quarantine management and end-user notification of blocked or held messages.

Please see the Anti-Virus; Anti-Malware and Breach / Cyber Security Incident Recovery sections below for important details. All hosted email is subject to the terms of our Hosted Email Policy and our Acceptable Use Policy.

Endpoint Antivirus & Malware Protection Included

Implementation and facilitation of a top-tier, cloud-native endpoint protection platform from our designated Third Party Provider. This service covers managed workstations and managed servers expressly identified as covered in the applicable Quote. Features include:

• Next-generation antivirus using artificial intelligence, machine learning, and behavioral analysis to block malware, ransomware, and fileless attacks, including malicious scripts and macros.
• Software agents deployed to managed laptops and desktops and, when expressly covered in the applicable Quote, managed servers across supported operating systems.
• Endpoint detection and response (EDR): continuous recording of endpoint activity to support threat detection, investigation, and root cause analysis.
• Remote response capabilities, including network containment (isolation) of a compromised endpoint to prevent the spread of a threat.
• Cloud-delivered threat intelligence, with endpoint telemetry retained in the platform to support investigations.

Please see the Anti-Virus; Anti-Malware and Breach / Cyber Security Incident Recovery sections below for important details.

Extended Detection & Response (XDR) Add-On

Implementation and facilitation of an industry-recognized extended detection and response platform from our designated Third Party Provider. Features include:

• Collection and correlation of security telemetry from across the managed environment, which may include endpoints, network devices, servers, and cloud services.
• Threat detections developed and maintained by the Third Party Provider, updated as new threats emerge.
• Automated response capabilities, which may include isolation of a compromised endpoint in response to critical threats and automated blocking of traffic from known malicious sources.
• Prioritized findings with recommended response steps.
• Deception (honeypot) sensors that provide early detection of unauthorized activity inside the managed network, where deployed.
• Escalation support from the Third Party Provider for urgent, priority findings.

Remediation of detected threats beyond the automated response actions described above may be provided on a time and materials basis. Please see the Anti-Virus; Anti-Malware and Breach / Cyber Security Incident Recovery sections below for important details.

End User Security Awareness Training Add-On

Implementation and facilitation of a security awareness training solution from our designated Third Party Provider. Features include:

• Online, on-demand training modules covering phishing, social engineering, and other common security threats (multi-lingual).
• Simulated phishing email campaigns, which may be automatically generated and personalized based on real-world attack patterns, or configured from administrator-defined templates.
• Tracking and reporting of training completion and simulation results.

Please see the Anti-Virus; Anti-Malware and Breach / Cyber Security Incident Recovery sections below for important details.

Expert Solution Planning Included

Assistance identifying technology problems and opportunities within Client’s business and mapping out practical solutions. Features include:

• Consultation to help identify and define the underlying problem or business need.
• Research and recommendation of appropriate solutions, including hardware, software, and service options.
• Scoping and planning of the recommended solution.

Note: Implementation of a recommended solution is performed as a separately quoted project (see the Fees section below and the Procurement policy toward the end of this Services Guide). Solution planning is advisory in nature, and we do not warrant or guarantee any particular business outcome.

Extra Workstations Add-On

Standard “per user” billing includes one (1) Business Device per licensed user (see Covered Environment below). If a user requires more than one managed workstation, each additional workstation may be added as an “Extra Workstation” for an additional per-device fee as indicated in the Quote. Each Extra Workstation includes:

• Remote monitoring and management agent.
• Next-generation antivirus and endpoint protection (as described in the Endpoint Antivirus & Malware Protection section above).
• DNS threat protection / malicious website blocking (as described in the DNS Threat Protection section below).
• Privileged access management (as described in the Privileged Access Management section below).

Extra Workstations are Covered Hardware. Each Extra Workstation receives the services listed above together with Updates & Patching, Workstation Monitoring & Maintenance, and Remote Helpdesk support, on the same terms as other covered workstations.

Front of Line Response Add-On

If the Quote includes Front of Line Response, support requests submitted by Client will be placed at the front of our support queue, ahead of standard-priority requests from other clients.

• Applies to support requests received through our designated support channels during our normal business hours.
• Requests remain subject to severity-based triage; a higher-severity issue affecting another client may still be addressed first where reasonably necessary.
• Front of Line Response prioritizes the order in which requests are addressed; it does not modify the response time targets in the Service Levels section below and does not constitute a guarantee of resolution within any specific time period.

HIPAA Compliance Program Facilitation Add-On

For Clients subject to the Health Insurance Portability and Accountability Act (“HIPAA”), we can facilitate Client’s enrollment in a HIPAA compliance program offered by an independent Third Party Provider. Compliance program features (such as risk assessments, policy templates, workforce training, and compliance documentation) are provided solely by the Third Party Provider under its own agreement with Client.

Please note: Surety does not provide HIPAA compliance services, and we are not a compliance auditor, compliance consultant, or law firm. Enrollment in a compliance program, and/or the implementation of technical safeguards by Surety as described in a Quote, does not by itself make Client HIPAA compliant, and we do not warrant or guarantee that Client will achieve or maintain compliance with HIPAA or any other law or regulation. Client is and remains solely responsible for its own regulatory compliance, and we strongly recommend that Client consult with competent legal counsel regarding its compliance obligations.

Managed VPN Add-On

Implementation and facilitation of an industry-recognized secure remote network access (VPN) solution from our designated Third Party Provider. Features include:

• Encrypted, point-to-point connectivity between enrolled devices, networks, and designated resources.
• Zero trust access policies that limit connectivity based on user, device, and resource.
• Central management of device enrollment, encryption keys, and access policies.
• Integration with Client’s identity provider for single sign-on and multi-factor authentication, where applicable.

Note: VPN services require a reliable internet connection at each participating location and device. Connection speed and quality depend on the underlying internet connections, and we do not warrant or guarantee uninterrupted or error-free VPN connectivity.

Microsoft 365 Backup Included

Implementation and facilitation of an industry-recognized cloud-to-cloud backup solution from our designated Third Party Provider. Features include:

• Automated daily backup of covered Microsoft 365 data, which may include mailboxes, calendars, contacts, cloud file storage, and collaboration site data (as indicated in the Quote).
• Backed up data is stored in secure cloud storage, separate from Client’s Microsoft 365 tenant, and encrypted in transit and at rest.
• Granular restore capabilities at the item, folder, mailbox, or account level.
• Backed up data will be retained for the period indicated in the Quote.
• Monitoring of backup successes and failures.

Note: Native Microsoft 365 retention features are not a backup solution. Requests to restore backed up Microsoft 365 data follow the “Recovery of Data” procedures described in the Backup and File Recovery section above.

Microsoft 365 Management & Security Included

Administration, hardening, and security monitoring of Client’s Microsoft 365 tenant. Features include:

• Tenant Administration: Management of users, licenses, mailboxes, groups, and tenant-level settings; user onboarding and offboarding support.
• Consolidated Billing: Microsoft 365 licenses may be purchased and billed through Surety (see “Access Licensing” in the Fees section below for important license terms).
• Tenant Hardening: Application of security baseline standards to the managed tenant using an industry-recognized tenant management platform, with ongoing monitoring for configuration drift and remediation of deviations from the established baseline.
• Identity Threat Detection & Response: Continuous monitoring of sign-in activity and identity-related events in the managed tenant using an industry-recognized identity threat detection solution from our designated Third Party Provider; detection of suspicious activity such as anomalous sign-ins, unauthorized mailbox rules, and indicators of account compromise; alerting and response actions, which may include disabling affected accounts and terminating active sessions.
• Encrypted Email: Configuration and support of encrypted email capabilities included with Client’s Microsoft 365 licensing.

Blumira’s identity-threat-detection telemetry consists of security event logs, user metadata, and access-attempt information. Blumira does not store electronic protected health information (ePHI). If a Service will create, receive, maintain, or transmit ePHI on Client’s behalf, the MSA’s Business Associate Agreement requirement applies before that Service begins.

Please see the Anti-Virus; Anti-Malware and Breach / Cyber Security Incident Recovery sections below for important details. No security solution is 100% effective, and we do not warrant or guarantee that all threats to the managed tenant will be detected or prevented.

Mobile Device Management (MDM) Add-On

Implementation and facilitation of an industry-recognized mobile device management solution. Features include:

• Enrollment of Client-owned devices (and, where expressly agreed, personal devices) into the managed platform.
• Deployment of configuration profiles, compliance policies, and device access requirements to enrolled devices.
• Deployment and updating of approved applications on enrolled devices.
• Remote lock and selective removal of managed Client data, where supported.

Please note: Support for personal (BYOD) devices is limited to these management functions; hardware, carrier, and personal application issues are out of scope. Surety does not factory-reset personal devices or remove personal data. Remote actions require a responsive, powered-on, internet-connected device, and removal of all managed Client data is not guaranteed.

Network as a Service (NaaS) Add-On

If indicated in the Quote, Surety will supply, install, and manage network hardware at Client’s premises on a subscription basis (“NaaS Equipment”). NaaS Equipment may include gateway/firewall appliances, network switches, and wireless access points from our designated hardware provider. Features include:

• NaaS Equipment is centrally managed through a cloud-based management platform, enabling remote configuration, monitoring, and alerting.
• Managed gateway/firewall appliances help to prevent unauthorized access to internal network(s) from outside the network(s), and include stateful firewalling, intrusion detection and prevention (IDS/IPS), website/content filtering, and secure and encrypted remote access and site-to-site VPN capabilities, as supported by the deployed hardware. Please note: gateway appliances do not perform antivirus scanning of network traffic; malware protection is provided at the endpoint level (see Endpoint Antivirus & Malware Protection above).
• Wireless access points are installed to provide wireless coverage in areas agreed upon by Surety and Client. Wireless connectivity support is provided on a “best efforts” basis, and Client understands that some end-user devices may not connect to, or perform well on, the wireless network.
• Firmware updates applied as deemed necessary by Surety.
• Replacement of failed NaaS Equipment (normal wear and tear) at no additional charge, subject to hardware availability.

The following terms apply to all NaaS Equipment:

• NaaS Equipment is and remains the sole property of Surety. Client acquires no ownership interest in NaaS Equipment.
• Client must not move, modify, reconfigure, or affix or install any accessory, addition, or upgrade to NaaS Equipment without our prior written consent.
• Upon termination of the applicable Services, all NaaS Equipment must be returned in accordance with the Term; Termination section of this Services Guide. Client will be responsible for the replacement value of missing or damaged (normal wear and tear excepted) NaaS Equipment.

Network Operations Center (NOC) Add-On

NOC services are focused exclusively on network devices, such as gateway/firewall appliances, switches, wireless access points, and other supported network hardware identified in the Quote, and may be purchased as an add-on to other managed services or as a standalone service under its own Quote. Features include:

• 24x7x365 automated monitoring of covered network devices, including online status, performance, and device health, with alerting to our network operations team.
• Management of covered network devices, including configuration changes as reasonably needed.
• Patch management for covered network devices, including deployment of firmware and software updates as deemed necessary by Surety.
• Backup of covered network device configurations to support recovery and device replacement.
• Coordination with Client’s designated onsite contacts and with Client’s internet service provider(s) during alert response, as reasonably needed to facilitate remediation.
• Response to alerts during our normal business hours in accordance with the Service Levels described below.
• For critical alerts received outside of normal business hours, we will endeavor to respond on a “best efforts” basis, subject to technician availability. After-hours response is not guaranteed, and after-hours remediation work is billed as Non-Business Hour Support (see the Service Levels section below).

Please note: NOC services cover only the network devices identified in the Quote. Support for workstations, servers, applications, end users, and other portions of the Environment is not included and, if requested, will be provided under a separate service or billed on a time and materials basis. Where NOC services are provided on a standalone basis, references in this Services Guide to Covered Hardware and the Environment apply only to the covered network devices.

Password Manager Add-On

Implementation and facilitation of industry-leading password management protection solution from our designated Third Party Provider. Features include:

• Secure Vaults: Encrypted vaults for storing passwords and other sensitive items, such as payment cards, identities, and secure notes.
• Password Generation: Generate strong, unique passwords with editable options to meet specific criteria.
• Shared Vaults: Team-based shared vaults with permission controls, allowing credentials to be shared securely within Client’s organization.
• Browser Extension: Browser extension with automatic form filling for easy, secure sign-ins.
• Mobile App: Mobile apps provide access to vaults and stored items on smartphones and tablets.
• Credential Health Monitoring: Built-in monitoring that flags weak, reused, or compromised passwords that appear in known data breaches.

PDF Editing Software Add-On

Licensing of a business-grade PDF editing application from our designated Third Party Provider, resold on a per-user or per-device basis as indicated in the Quote. Features include:

• Creation, editing, conversion, and annotation of PDF documents.
• Installation and deployment of the application on managed devices.
• License management through Surety (see the Software Licensing section below).

The application is licensed, not sold, and is subject to the vendor’s end user license agreement. Support beyond installation and basic configuration is facilitated with the software vendor on a best-effort basis.

Penetration (Pen) Testing Separate Quote

Penetration testing (or “pen” testing) simulates a cyberattack against your IT infrastructure to identify exploitable vulnerabilities. Unlike ongoing vulnerability scanning services that provide a constant, static level of network scanning, pen testing may involve several stages of reconnaissance and actual attack methodologies (such as brute force attacks and/or SQL injection attacks) and may include unconventional and targeted attacks that occur during business and non-business hours. Pen testing may consist of any of the following:

• External Pen Testing: Exposes vulnerabilities in your internet-facing systems, networks, firewalls, devices, and/or web applications that could lead to unauthorized access.
• Internal Pen Testing: Validates the effort required for an attacker to overcome and exploit your internal security infrastructure after access is gained.
• PCI Pen Testing: Using the goals set by the PCI Security Standards Council, this test involves both external and internal pen testing methodologies.
• Web App Pen Testing: Application security testing using attempted infiltration through a website or web application utilizing PTES and the OWASP standard testing checklist.

Please see additional terms for Penetration Testing below.

Printer Management Add-On

Implementation and facilitation of an industry-recognized cloud print management solution from our designated Third Party Provider. Features include:

• Centralized deployment of print queues and printer drivers to managed devices.
• Monitoring of managed print infrastructure and print-related alerting.
• User self-service printer installation on managed devices.
• Secure print release functionality, where supported by Client’s printer hardware.

Please note: Printer management covers print software and queue management only. Printer hardware repair, physical maintenance, and consumables (such as toner and drums) are not included; if requested, we will facilitate hardware service with the applicable printer vendor on a time and materials basis.

Privileged Access Management (PAM) Included

Implementation and facilitation of an industry-recognized endpoint privilege management solution from our designated Third Party Provider. Features include:

• Removal of standing local administrator rights from end users on managed endpoints.
• Just-in-time elevation requests, with approval workflows handled by our technicians in accordance with the Service Levels described below.
• Application-level privilege rules that permit approved applications to run with elevated rights without exposing administrator credentials to end users.
• Audit logging of elevation requests and privileged activity on managed endpoints.

Note: Because standing administrator rights are removed, some software installations and system changes on managed endpoints will require an elevation request and our approval. This is by design and is an important part of the security value of this service.

Project Labor Separate Quote

Project-based professional services performed under a separate quote. The specific scope of work for each project (the “Project Scope”) will be described in the applicable Quote. Projects may include, by way of example and not limitation:

• Deployment of new or replacement workstations, including setup, agent and security software installation, domain or tenant join, application installation, and transfer of user data and profiles.
• Server deployments, migrations, and upgrades.
• Network design, infrastructure refresh, and new office buildouts.
• Cloud and email platform migrations.
• Office moves and equipment relocations.
• Other technology projects described in a Quote.

Fees; Fixed Fee; Hidden Conditions. Unless otherwise stated in the Quote, the quoted project fee is fixed for the Project Scope. If Surety identifies a pre-existing, hidden, or undisclosed condition in the Environment (for example, deficient cabling, a corrupted directory service, unsupported or failing hardware, or undocumented configurations) that requires work beyond the Project Scope, Surety will notify Client in writing. Where the additional work is reasonably expected to cost the lesser of ten percent (10%) of the quoted project fee or five hundred dollars ($500), Surety may proceed and invoice that work at our then-current hourly rates following notice to Client. For additional work above that threshold, Surety will provide a written change order describing the condition, the additional work, the pricing, and any anticipated schedule impact, and will not perform or bill that work unless Client accepts the change order in accordance with the Change Orders section below. If Client does not accept the change order, Surety may suspend the affected portion of the project and the project schedule may be adjusted accordingly.

Payment Terms. Fifty percent (50%) of the quoted project fee is due in advance before work begins. For projects with a quoted fee of more than $5,000, the remaining balance will be invoiced against completion milestones if milestones are identified in the Quote, and otherwise upon completion. For all other projects, the remaining balance is invoiced upon completion.

Scheduling; Rates. Project work is scheduled in advance and is subject to technician availability and, where applicable, hardware and licensing availability. Unless otherwise stated in the Quote, project work is performed during our normal business hours; work performed outside of normal business hours is subject to the increased rates described in the Service Levels section below. Onsite project work is subject to the two (2) hour minimum charge described in the Service Levels section below. Project labor does not draw from prepaid remote support time; however, project labor may be applied against Prepaid Block Hours purchased by Client.

Scope Changes; Acceptance. Changes to the Project Scope are governed by the Change Orders section below. Acceptance of completed project work, and the reporting of any defects or non-conformance, are governed by the “Services Warranty; Acceptance” provisions of the MSA.

Exclusions. Unless expressly included in the Quote, project fees do not include: data or voice cabling and wiring; electrical work; furniture, millwork, or physical mounting; customization or programming of third party applications; data entry or data cleanup; end user training; battery backup replacement; the cost of hardware, software, licenses, parts, shipping, or third party services; repairs to hardware; support for operating systems, applications, or hardware no longer supported by the manufacturer; and remediation of pre-existing issues or deficiencies not identified in the Project Scope. Where Surety is providing hardware or licensing as part of a project, that will be stated in the Quote and is subject to the Procurement policy below.

Client Responsibilities. To allow us to complete projects on schedule, Client agrees to: (i) provide timely physical and remote access to the premises and the Environment; (ii) make an authorized decision maker reasonably available for questions and approvals; (iii) agree to and honor scheduled downtime and maintenance windows; (iv) provide all required software licenses, installation media, and key codes; (v) disclose known issues, deficiencies, and undocumented configurations in the Environment before work begins; (vi) refrain from making changes to the affected portions of the Environment during the project without our knowledge; and (vii) unless Client subscribes to our backup services, maintain current backups of all data and systems affected by the project.

Note: Appointment cancellation and rescheduling of project work is subject to the Appointment Cancellations provisions in the Fees section below. We recommend business-grade computers and equipment from major manufacturers; used, remanufactured, or consumer-grade hardware may limit supportability (see Minimum Requirements / Exclusions below).

Recurring On-Site Technician Add-On

If the Quote includes Recurring On-Site Technician services, a Surety technician will visit Client’s designated location(s) on a pre-determined, recurring schedule (e.g., weekly or monthly) as indicated in the Quote.

• During scheduled visits, the technician will address open support requests, perform proactive maintenance, and assist end users on site.
• Visit frequency and duration are as indicated in the Quote. Time required beyond the scheduled visit duration is subject to technician availability and will be billed at our then-current hourly rates.
• Scheduled visits may be rescheduled by either party with reasonable advance notice. The Appointment Cancellations provisions in the Fees section below apply to missed or untimely canceled visits.

Remote Helpdesk Included

• Remote support provided during normal business hours for managed devices and covered software.
• Prepaid Remote Support Time: Each covered user accumulates fifteen (15) minutes of prepaid remote support time each month. Prepaid remote support time is pooled among all covered users in Client’s organization and may be used by any covered user. Unless otherwise stated in the Quote, unused prepaid remote support time does not roll over to subsequent months and has no cash value.
• Remote support time in excess of the monthly pooled allotment will be billed at our then-current hourly rates, less any eligible discounts.
• Prepaid remote support time applies to remote support only. Onsite visits do not consume prepaid remote support time and are billed at our then-current applicable rates, less any eligible discounts, with a two (2) hour minimum charge per visit (see the Fees section below).
• Tiered-level support provides a smooth escalation process and helps to ensure effective solutions.
• Remote Employee Onboarding: Assistance establishing computer and email accounts for new employees, including initial sign-in and access support.
• Vendor Coordination: Coordination with Client’s line of business software and service vendors to help bridge the gap between those vendors and Client’s managed technology.

Remote Monitoring and Management Agent Included

Software agents installed in Covered Equipment (defined below) report status and IT-related events on a 24x7 basis; alerts are generated and responded to in accordance with the Service Levels described below.

• Includes capacity monitoring, alerting us to severely decreased or low disk capacity (covers standard fixed HDD partitions, not external devices such as USB or mapped drives).
• Includes routine operating system inspection and cleansing to help ensure that disk space is increased before space-related issues occur.
• Review and installation of updates and patches for supported software.

In addition to the above, our remote monitoring and management service will monitor and alert on the following:

• Hardware Failures
• Device Offline
• Failed/Missing Backup
• Failed/Missing Updates
• Low Disk Space
• Excessive Uptime

Security Information & Event Management (SIEM) Add-On

Implementation and facilitation of an industry leading, cloud-delivered SIEM solution from our designated Third Party Provider.

The SIEM service collects and analyzes log data from across the managed environment to detect threats against the managed network.

• Log Collection. Collection of log and event data from covered network devices, servers, cloud services, and applications through sensors and platform integrations deployed in the managed environment.
• Detection. Prebuilt threat detection rules developed and maintained by the Third Party Provider’s security operations team, updated automatically as new threats emerge. Detections cover external attacks as well as potential insider threats occurring inside the monitored network.
• Alerts & Analysis. Detections are prioritized by severity and accompanied by guided response playbooks. For urgent, priority findings, the Third Party Provider’s security operations team is available for additional analysis and assistance.
• Retention. Collected log data will be retained for the period indicated in the Quote or, if no period is indicated, for the platform’s standard retention period.

During the initial period following deployment, detection rules are tuned to the Client’s environment and user behavior. During this tuning period, Client may experience some “false positives” or, alternatively, not all anomalous activities may be detected.

Note: The SIEM service is a monitoring and alert-based system only; remediation of detected or actual threats is not within the scope of this service and may require Client to retain Surety’s services on a time and materials basis.

Server Monitoring & Maintenance Add-On

As part of our RMM service, we will monitor and maintain managed servers as follows:

• Software agents installed in covered servers report status and IT-related events on a 24x7 basis; alerts are generated and responded to in accordance with the Service Levels described below.
• Online status monitoring, alerting us to potential failures or outages.
• Capacity monitoring, alerting us to severely decreased or low disk capacity (covers standard fixed HDD and SSD partitions, not external devices such as USB or mapped network drives).
• Performance monitoring, alerting us to unusual processor or memory usage.
• Server essential service monitoring, alerting us to server role-based service failures.
• Endpoint protection agent monitoring, alerting us to potential security vulnerabilities.
• Routine operating system inspection and cleansing.
• Secure remote connectivity to the server and collaborative screen sharing.
• Review and installation of updates and patches for Windows and supported software.
• Asset inventory and server information collection.

Two Factor Authentication Add-On

Implementation and facilitation of a two factor authentication solution from our designated Third Party Provider. Features include:

• App-based authentication on user smartphones, including push-notification approvals and one-time passcodes.
• Protection for cloud applications and supported on-premises applications and logins.
• Access policies based on user, group, location, and/or device state, where supported by the platform and Client’s licensing.
• Enrollment support and ongoing administration of the two factor authentication platform.

Software Licensing

(applies to all software licensed by or through Surety)

All software provided to you by or through Surety is licensed, not sold, to you (“Software”). In addition to any Software-related requirements described in Surety’s Master Services Agreement, Software may also be subject to end user license agreements (EULAs), acceptable use policies (AUPs), and other restrictions all of which must be strictly followed by you and any of your authorized users.

When installing or implementing Software licenses in the managed Environment or as part of the Services, acceptance and applicability of any EULA, AUP, or other Provider Term will follow the MSA’s “Provider Terms; Third-Party Terms Schedule” provision. If a provider requires direct acceptance by Client or an Authorized User, Surety will not accept for Client or activate the affected Software until that required direct acceptance is completed. If a provider expressly permits Surety, its reseller, or a service provider to complete acceptance for the customer, Surety may complete that permitted acceptance step. Otherwise, Client accepts the identified customer- and user-facing obligations in the Provider Terms by accepting the Quote and MSA as stated in the MSA. The applicable provider document, published version or effective date, and acceptance method will be identified in the Third-Party Terms Schedule or applicable Quote. You should assume that all Software has an applicable EULA and/or AUP to which your authorized users and you must adhere. If you have any questions or require a copy of the EULA or AUP, please contact us.

Updates & Patching Included

• Remotely deploy updates (e.g., x.1 to x.2), as well as bug fixes, minor enhancements, and security updates as deemed necessary on all managed hardware.
• Perform minor hardware and software installations and upgrades of managed hardware.
• Perform minor installations (i.e., tasks that can be performed remotely and typically take less than thirty (30) minutes to complete).
• Deploy, manage, and monitor the installation of approved service packs, security updates and firmware updates as deemed necessary on all applicable managed hardware.

Please note: We will keep all managed hardware and managed software current with critical patches and updates (“Patches”) as those Patches are released generally by the applicable manufacturers. Patches are developed by third party vendors and, on rare occasions, may make the Environment, or portions of the Environment, unstable or cause the managed equipment or software to fail to function properly even when the Patches are installed correctly. We will not be responsible for any downtime or losses arising from or related to the installation or use of any Patch. We reserve the right, but not the obligation, to refrain from installing a Patch if we are aware of technical problems caused by a Patch, or we believe that a Patch may render the Environment, or any portion of the Environment, unstable.

IT Consulting Separate Quote

Professional IT consulting services provided under a separate quote or engagement. Consulting services may include:

• Technology strategy, roadmaps, and assessments.
• Assistance in the creation of information/data-related plans and budgets.
• Strategic guidance and consultation across different technologies.
• Creation of company-specific best standards and practices.
• Education and recommendations for business technologies.
• Participation in scheduled meetings to maintain goals.
• Maintenance of technology documentation.
• Assessment and recommendations for improving technology usage and services.

Voice Over IP (VoIP) Services Facilitation Add-On

We can facilitate Client’s enrollment with an industry-recognized VoIP telephone service offered by an independent Third Party Provider. The VoIP service, including call routing, voicemail, caller ID, conference calling, desktop and mobile applications, and related telephone features, is hosted and provided solely by the Third Party Provider under its own agreement with Client.

Our facilitation services may include:

• Assisting with provider selection and initial account setup.
• Deployment and configuration of telephone hardware and applications on the managed network.
• Coordinating with the Third Party Provider on service and support issues.

Please note: Surety does not host, operate, or provide telephone or VoIP services. Service availability, call quality, uptime commitments, and E911 functionality are governed by the Third Party Provider’s own terms of service, including any E911 address registration requirements and consent forms required by the Third Party Provider. Client is responsible for reviewing and complying with the Third Party Provider’s E911 requirements and for understanding the limitations of 911 dialing over VoIP services.

Vulnerability Management Add-On

Implementation and facilitation of an industry-recognized, agent-based vulnerability management solution from our designated Third Party Provider. Features include:

• Continuous monitoring of covered devices for known vulnerabilities in operating systems and supported applications.
• Periodic vulnerability reporting, including severity ratings and remediation recommendations.
• Development of a custom patch deployment plan with Client that aligns remediation activities with Client’s business requirements, maintenance windows, and application compatibility considerations.
• Deployment of patches and remediations in accordance with the agreed patch deployment plan.
• For covered servers, confirmation of usability after updates are applied, based on a verification plan outlined by Client.

Please note: Patches and updates are developed by third party vendors and, on rare occasions, may cause instability or failures even when installed correctly (see the Updates & Patching section above). Unless Client subscribes to our backup services (see the Backup and File Recovery section above), Client is solely responsible for maintaining backups, snapshots, or other rollback protection for covered devices prior to patch deployment. Server usability confirmation is limited to the checks identified in Client’s verification plan; Client is responsible for defining and maintaining that plan, and we do not warrant or guarantee that all post-update issues will be detected.

Vulnerability Scanning Separate Quote

Implementation and facilitation of an industry-recognized vulnerability scanning solution from our designated Third Party Provider.

Vulnerability scanning identifies holes in the managed network that could be exploited. External vulnerability scans (which pertain to the IP address assigned to each customer location through the Client’s ISP) are run monthly. Internal vulnerability scans (which pertain to all systems inside the managed network) are run at least annually.

Vulnerability results will be discussed during business review meetings with Client. Vulnerability reports will be made available on request.

Please see additional terms for vulnerability scanning below.

Workstation Monitoring & Maintenance Included

Software agents installed in covered workstations report status and IT-related events on a 24x7 basis; alerts are generated and responded to in accordance with the Service Levels described below.

• Online status monitoring, alerting us to potential failures or outages.
• Capacity monitoring, alerting us to severely decreased or low disk capacity (covers standard fixed HDD and SSD partitions, not external devices such as USB or mapped network drives).
• Performance monitoring, alerting us to unusual processor or memory usage.
• Endpoint protection agent monitoring, alerting us to potential security vulnerabilities.
• Routine operating system inspection and cleansing.
• Secure remote connectivity to the workstation and collaborative screen sharing.
• Review and installation of updates and patches for Windows and supported software.
• Asset inventory and workstation information collection.