MANAGED IT SERVICES ADDENDUM

This Managed IT Services Addendum ("Addendum") supplements the IMPACT Master Services Agreement ("MSA") entered into by and between IMPACT Technology Group, Inc. ("IMPACT") and Client. Capitalized terms not defined herein shall have the meanings set forth in the MSA.

This Addendum applies only to the extent Managed IT Services are expressly described in, and provided pursuant to, an executed Order. In the absence of an executed Order for Managed IT Services, this Addendum shall have no force or effect.

In the event of any conflict between this Addendum and the MSA, this Addendum shall govern solely with respect to Managed IT Services, in accordance with the order of precedence set forth in MSA Section 2.5.

1. DEFINITIONS

For purposes of this Addendum, the following capitalized terms shall have the meanings set forth below. Capitalized terms used but not defined herein shall have the meanings set forth in the MSA.

1.1 "Approved Alternatives"

means technologies, products, platforms, configurations, or services that are not part of IMPACT's default standard stack but have been expressly approved by IMPACT as meeting its minimum technical, security, operational, and manageability requirements. Approved Alternatives are published and maintained by IMPACT at a URL designated by IMPACT and may be updated from time to time without amendment to this Addendum.

1.2 "Assignment Zones"

means the allocation of responsibility, authority, and control between IMPACT and Client, as defined in Schedule F (Assignment Zones — Default Responsibility Matrix), which identifies which systems, services, environments, and functions are: (a) fully controlled by IMPACT (Zone 1); (b) subject to shared or co-managed responsibility (Zone 2); or (c) controlled exclusively by Client or third parties (Zone 3).

1.3 "Basic Cabling Work"

means troubleshooting and repair of existing cabling. Any new cabling, replacement of existing cabling, or relocation of existing cabling, regardless of scope, is a Project and requires execution of the Cabling & Low-Voltage Addendum and a separate Order.

1.4 "Cabling & Low-Voltage Services"

means design, installation, termination, testing, or support of low-voltage and/or fiber-optic cabling and related infrastructure. Project-scale Cabling & Low-Voltage Services are governed by the Cabling & Low-Voltage Addendum. Basic Cabling Work, as defined in Section 1.3, may be performed under this Addendum.

1.5 "Co-Managed Services"

means Managed IT Services delivered by IMPACT where Client, Client's internal IT personnel, or third-party providers retain partial administrative authority or operational responsibility over certain systems or environments, as defined in the applicable Assignment Zones.

1.6 "Fully Managed Services"

means Managed IT Services where IMPACT maintains exclusive administrative authority and operational responsibility over the systems, platforms, or environments within the applicable Assignment Zones.

1.7 "Managed IT Services"

means the managed information technology services expressly described in an executed Order and governed by this Addendum, which may include endpoint management, network operations, server administration, patch management, monitoring, backup oversight, identity and access management administration, helpdesk support, on-site dispatch, and related operational services.

1.8 "Moves, Adds, or Changes" or "MAC"

means any Client-requested or Client-necessitated action that requires IMPACT to implement, modify, remove, reconfigure, or execute changes to any user, device, system, application, service, configuration, permission, security control, or data within the Client environment beyond routine monitoring, oversight, administration, and maintenance. MACs constitute execution labor and are not included in recurring fees unless expressly stated in an Order. Additional information regarding MACs is published at https://impact.huducloud.com/shared_article/hkFBWdBcmLDLdnCi8N2jm4Xn.

1.9 "Required Standards"

means the mandatory technical, security, operational, and configuration standards published in Schedule A (Technical Standards & Security Requirements), as updated from time to time. The Required Standards apply to all systems, devices, users, and environments within IMPACT-controlled or shared Assignment Zones.

1.10 "Shadow IT"

means any hardware, software, cloud service, application, device, system, or technology deployed, used, or accessed by Client or its users without IMPACT's prior written approval, including systems not disclosed to or documented by IMPACT.

1.11 "Waiver of Standards"

means Acknowledgment G.7 (Waiver of Required Standards (Schedule A)) set forth in Schedule G, invoked by reference and initialed or signed by Client on an Order, Variance Sheet, or Risk Acknowledgment Form in accordance with Schedule G Section 1.1, identifying the specific Required Standards from which Client deviates. References in this Addendum, in Schedule A, or in any Order to a "Waiver of Standards," a "Waiver of Required Standards," or an executed waiver of any Required Standard mean Acknowledgment G.7 so invoked and initialed. No separate or standalone waiver instrument is required, and no other writing constitutes a Waiver of Standards.1.12 "Zone 1"

means systems, services, environments, or functions designated as IMPACT-Controlled, in which IMPACT maintains full administrative authority and operational responsibility.

1.13 "Zone 2"

means systems, services, environments, or functions designated as Shared Authority, in which administrative authority and operational responsibility are divided between IMPACT and Client (or Client's third-party providers) as defined in Schedule F or the applicable Order.

1.14 "Zone 3"

means systems, services, environments, or functions designated as Client-Controlled, in which Client (or Client's third-party providers) retains full administrative authority and operational responsibility.

1.15 "New to Environment” or “NTE"

means the introduction into the Client environment of any hardware, software, endpoint, device, system, application, user account, or workstation that was not previously present in, deployed within, or managed as part of the Client environment, together with the installation, configuration, provisioning, and setup work required to place such component into service. Hardware or software in used, refurbished, or any condition other than new from the manufacturer shall constitute NTE if it was not previously present in the Client environment. NTE constitutes Project work pursuant to MSA Section 9 and Section 13 of this Addendum and is not included in recurring fees unless expressly stated in an Order. Additional information regarding what constitutes a Project, including NTE, is published at https://impact.huducloud.com/shared_article/uUrEWTRELTKaaH5TqCvQ5bE4/what-is-a-project-the-definition.

1.16 "Cascade"

means the redeployment, reassignment, or relocation of an existing device, endpoint, or user configuration from one user, station, or location to another, typically arising when a new or upgraded device is installed and the displaced device is moved to another user so that multiple users receive upgraded or reassigned equipment. A Cascade may involve equipment (an "Equipment Cascade") or a user account together with its associated configuration, data, and access (a "User Cascade"). Cascades constitute Project work pursuant to MSA Section 9 and Section 13 of this Addendum and are not included in recurring fees unless expressly stated in an Order. Additional information regarding what constitutes a Project, including Cascades, is published at https://impact.huducloud.com/shared_article/uUrEWTRELTKaaH5TqCvQ5bE4/what-is-a-project-the-definition.

1.17 "Agent"

means the software agent or agents deployed by IMPACT on a Device to enable remote monitoring, management, patching, endpoint security, or support of that Device under an Order. The presence of an active Agent is the basis on which a Device is identified as managed.

1.18 "Managed Device"

means a Device running IMPACT's Agent and receiving patching, endpoint security, and support under an Order. Managed Devices include workstations, laptops, and company-owned mobile devices, and include shared, kiosk, conference-room, and virtual machines when running the Agent under IMPACT's management. Servers and network infrastructure, including firewalls, switches, routers, and access points, are not Managed Devices for purposes of any per-User managed device allowance and are covered, if at all, under their respective Services and line items.

1.19 "Managed User"

means a User for whom Managed IT Services are provided and billed under an Order, counted as an active user seat for purposes of pricing and any per-User managed device allowance.

1.20 "Service Plan"

means a named bundle of Managed IT Services offered by IMPACT under its stabilIT brand and published in the Service Catalog, the inclusions, exclusions, conditions, support model, and pricing basis of which are set forth in the Service Catalog entry for that Service Plan. The Service Plan applicable to an Order is the Service Plan identified in that Order. Service Plans identified in the Service Catalog as closed are not available for new Orders, plan changes, or renewals.

1.21 "Cloud Platform Management & Tenant Oversight" (the "Tenant Oversight")

means the Recurring Services IMPACT provides with respect to a Client-owned cloud productivity tenant where expressly included in an Order, consisting of: (a) holding and maintaining IMPACT's administrative relationship to the tenant; (b) maintaining the tenant's security baseline and conditional access posture in accordance with the Required Standards or an Approved Alternative; (c) reconciling license counts and subscription assignment against Client's Managed User count; and (d) monitoring platform health and configuration drift.

Tenant Oversight is a Recurring Service within the meaning of MSA Section 1 (Recurring Services) and does not include Moves, Adds, or Changes, New to Environment onboarding, Cascades, Projects, or Out-of-Scope Services. Without limiting the foregoing, the following constitute Moves, Adds, or Changes and are not included in recurring fees unless expressly stated in an Order: user provisioning and deprovisioning; changes to permissions, mailbox access, delegation, or sharing; creation or modification of groups, distribution lists, or shared mailboxes; license assignment changes; and configuration of new applications, connectors, or integrations within the tenant.

Client is and remains the owner of its tenant and Client Data. Tenant Oversight does not transfer, and shall not be construed to transfer, ownership or control of the tenant to IMPACT, and does not make IMPACT a custodian, steward, records custodian, or officer of Client.

1.22 "Emergency"

means either (a) a support issue in which all systems or a critical system is inoperable, affecting a large group of Users or all Users and critical operations of Client, or (b) a security outbreak in which measures must be taken to prevent irreparable harm to critical Client systems or to Client itself. An issue that does not meet this definition is not an Emergency regardless of Client's characterization of it. IMPACT determines whether an issue constitutes an Emergency in its reasonable discretion, applying this definition and the priority definitions in Schedule B. Additional guidance on incident classification is published by IMPACT and may be updated from time to time in accordance with MSA Section 2.4.

1.23 "Day-Zero Environmental Assessment" means IMPACT's written documentation of the state of Client's environment as of the commencement of Services, including identification of systems and conditions that do not comply with the Required Standards as inherited.

2. SCOPE OF MANAGED IT SERVICES

2.1 Services Provided

IMPACT shall provide to Client only those Managed IT Services expressly identified in an executed Order. The Services shall be performed in a commercially reasonable manner, consistent with generally accepted industry standards applicable to managed IT services, subject to the terms and limitations set forth in this Addendum and the MSA.

The classification of work as Recurring Services, MACs, or Projects shall be determined by IMPACT in its reasonable discretion based on scope, complexity, risk, and effort required.

2.2 Recurring Services vs. MACs vs. NTE vs. Projects

For purposes of this Addendum:

Recurring Services mean ongoing monitoring, oversight, administration, governance, maintenance, and advisory services provided on a continuous basis under an executed Order;
MACs mean discrete Client-requested or Client-necessitated execution actions, as defined in Section 1.8, and are not included in recurring fees unless expressly stated in an Order;
NTE means the introduction, installation, configuration, and setup of hardware, software, or other components that are new to the Client environment, as defined in Section 1.15, is a form of Project work governed by Section 13, and is not included in recurring fees unless expressly stated in an Order;
Projects are governed by MSA Section 9 and may be triggered by, among other things, the conditions identified in Section 13 of this Addendum.

2.3 Service Catalog Controls Scope

The scope, inclusions, exclusions, dependencies, and limitations of Managed IT Services are defined in the Service Catalog. Only Managed IT Services expressly listed in the Service Catalog and included in an executed Order are covered under this Addendum.

2.4 Baseline Out-of-Scope Categories

In addition to the categories of Out-of-Scope Services identified in MSA Section 3.4, the following are deemed Out-of-Scope Managed IT Services unless expressly included in an executed Order:

services related to unsupported, end-of-life, or end-of-support systems;
remediation required to bring Client into compliance with Required Standards;
work resulting from Client-caused issues, unauthorized changes, or Shadow IT;
vendor, regulatory, or security requirements not contemplated in the Order;
emergency or after-hours work not expressly included.

Out-of-Scope Managed IT Services shall be billable at IMPACT's then-current rates unless otherwise agreed in writing.

2.5 Service Plans

(a) Incorporation. Where an Order identifies a Service Plan, the Services set forth as included in the Service Catalog entry for that Service Plan, in the version in effect as of the Effective Date of that Order, are incorporated into and deemed expressly included in that Order for purposes of MSA Sections 3.2 and 3.3, whether or not each such Service is separately itemized on the Order. Identification of a Service Plan on an Order constitutes express inclusion of that Service Plan's Services within the meaning of MSA Section 3.2.

(b) Order-level deviation. Where an Order expressly includes a Service not included in the identified Service Plan, or expressly excludes or limits a Service otherwise included in the identified Service Plan, the Order controls as to that Service. Absent express deviation on the Order, the incorporated Service Plan inclusions apply in full. For the avoidance of doubt, this subsection operates by incorporation of the Service Plan inclusions into the Order and does not alter the order of precedence set forth in MSA Section 2.5.

(c) Conditional and elective items. Items identified within a Service Plan entry as billable, custom, available, scoped per Client, add-on, or otherwise conditional are not included in recurring fees and are provided only where expressly listed and priced on an executed Order. Items identified as not included are not provided under that Service Plan.

(d) No implied expansion. Identification of a Service Plan does not include any Service that is not listed as included in the Service Plan entry or expressly listed on the Order. Plan names, plan comparison materials, feature summaries, marketing descriptions, and proposals are descriptive only and do not expand the Services, consistent with MSA Sections 2.5, 2.6, and 3.3.

(e) Version control. The Service Catalog entry in effect as of the Effective Date of an Order governs that Order for its term. Updates to Service Catalog Service Plan entries are governed by MSA Section 2.4 and shall not materially reduce the Services purchased under an active Order.

(f) Plan changes. A change from one Service Plan to another requires a new or amended Order executed by both Parties. IMPACT is under no obligation to provide Services associated with a Service Plan other than the one identified in the executed Order then in effect.

(g) Service levels. Service Level Targets applicable to a Service Plan, including any plan-specific target, are set forth in Schedule B and are subject to Schedule B Section 1 in full.

3. CO-MANAGED SERVICES & ASSIGNMENT ZONES

3.1 Co-Managed Services Overview

Client acknowledges that Co-Managed Services involve shared responsibility between IMPACT and Client (including Client's internal IT staff or third-party providers). The specific allocation of authority, responsibility, and control for Co-Managed Services is defined in Schedule F (Assignment Zones — Default Responsibility Matrix) and may vary by system, platform, or service.

IMPACT does not assume full responsibility for Client's environment unless expressly stated in writing.

3.2 Assignment Zones Control Responsibility

Assignment Zones establish which Party has authority over specific systems, services, and functions. Each Assignment Zone defines:

administrative authority;
responsibility for configuration, maintenance, and security;
applicability of Required Standards;
Service Level Target eligibility; and
liability allocation.

Client acknowledges that IMPACT's obligations are strictly limited to the Assignment Zones expressly designated as IMPACT-controlled or shared.

3.3 Zone 1 — IMPACT-Controlled Systems

For systems designated as Zone 1:

IMPACT maintains full administrative authority;
Required Standards apply in full;
Service Level Targets apply subject to Schedule B;
Client and third parties may not make changes without IMPACT's prior written approval.

IMPACT shall not be responsible for failures or incidents caused by unauthorized access or modifications by Client or third parties within Zone 1.

3.4 Zone 2 — Shared Authority

For systems designated as Zone 2:

responsibility is divided between IMPACT and Client as defined in Schedule F or the applicable Order;
Required Standards apply in full; responsibility for performing each control is allocated per Schedule F and Schedule A Section 3;
Service Level Targets apply only to the specific responsibilities assigned to IMPACT;
all changes must be coordinated and documented.

IMPACT shall not be liable for failures, outages, or security incidents caused by Client actions, delays, or decisions within Zone 2.

3.5 Zone 3 — Client-Controlled Systems

For systems designated as Zone 3:

Client retains full authority and responsibility;
Required Standards do not apply unless expressly agreed in writing;
Service Level Targets do not apply;
IMPACT has no obligation to secure, monitor, or remediate such systems.

Any assistance provided by IMPACT in Zone 3 is advisory only and shall not create responsibility or liability.

3.6 Default Co-Managed Model

Unless otherwise stated in an Order, the default Co-Managed model shall be set forth in Schedule F (Assignment Zones — Default Responsibility Matrix), with deviations documented in an applicable Order.

3.7 Order-Level Zone Assignment

Where the Services purchased under an Order do not require deviation from the Schedule F default responsibility matrix, the applicable Order may incorporate Schedule F by reference without restating Zone assignments. Where deviations from Schedule F are necessary or where shared or split responsibility requires explicit allocation, the applicable Order shall identify the affected Services and their Assignment Zone designations.

For Orders providing Fully Managed Services in which all Services are within IMPACT-controlled Assignment Zones, no Order-level Zone table is required, and all Services shall be deemed Zone 1 unless otherwise stated.

3.8 Changes to Assignment Zones

Assignment Zones may be modified only by written agreement of the Parties, documented in an executed Order or Order amendment. IMPACT may require remediation, standardization projects, or security upgrades as a condition of accepting additional responsibility for any system transitioning into a higher-responsibility Zone.

3.9 Impact of Non-Compliance

Where Client fails to comply with the Required Standards, coordination requirements, or change control obligations with respect to systems within Zone 1 or Zone 2, the consequences and remedies set forth in Section 4.3 apply, including suspension of applicable Service Level Targets, the requirement to invoke a Waiver of Standards, reclassification of affected systems to a lower-responsibility Assignment Zone, and limitation, suspension, or termination of affected Managed IT Services pursuant to MSA Section 4.

3.10 No Assumption of Client IT Duties

Nothing in this Addendum shall be construed as IMPACT assuming the duties, obligations, or liabilities of Client's internal IT department, employees, or third-party providers, except as expressly stated in writing.

3.11 Access to IMPACT Systems

Where IMPACT grants Client or Client's Internal Resource access to any IMPACT System, such access is governed by MSA Section 5.10, including IMPACT's right of suspension and revocation. Suspension or revocation of an Access Grant does not alter the Assignment Zone allocations set forth in Schedule F, an Order, or a Variance Sheet, and Client remains responsible for any function allocated to it.

4. REQUIRED TECHNICAL STANDARDS & COMPLIANCE

4.1 Required Standards Apply to Managed IT Services

Client shall maintain all systems, platforms, devices, users, and configurations within IMPACT-controlled or shared Assignment Zones in compliance with the Required Standards set forth in Schedule A (Technical Standards & Security Requirements).

Required Standards are designed to support reliable service delivery, security, manageability, and risk reduction. Client acknowledges that Required Standards are designed to reduce risk but do not eliminate risk, and failure to comply materially increases the likelihood and severity of service failures, security incidents, and business disruption.

4.2 Updates to Required Standards

Schedule A may be updated from time to time. Updates, including material updates and Client's associated notice and termination rights, are governed by MSA Section 2.4. The version of Schedule A in effect as of the Effective Date of an Order applies to that Order.

4.3 Failure to Comply with Required Standards

Failure to comply with the Required Standards that is not remediated within a reasonable period following written notice from IMPACT may result in any combination of the following, at IMPACT's discretion:

suspension of Service Level Targets applicable to affected systems;
requirement to invoke a Waiver of Standards pursuant to Section 4.5;
classification of resulting work as Out-of-Scope Managed IT Services;
triggering of Project work pursuant to Section 13;
reclassification of affected systems to a lower-responsibility Assignment Zone;
limitation, suspension, or termination of affected Managed IT Services pursuant to MSA Section 4.

Notwithstanding the foregoing, no notice or cure period is required where Client has not satisfied a manageability prerequisite set forth in Schedule A, or with respect to an asset Client has not disclosed to IMPACT, in each case for the duration of the condition, because those conditions prevent delivery of the affected Service. Suspension of Services or removal of a system from scope under this paragraph does not excuse Client's payment obligations.

IMPACT's election of any remedy under this Section does not waive its right to pursue additional remedies available under this Addendum, the MSA, or at law. Nothing in this Section limits IMPACT's responsibility for a control IMPACT is obligated to provide under an executed Order.

4.4 Co-Managed Compliance Responsibility

For Co-Managed Services, compliance with Required Standards is allocated between IMPACT and Client according to the Assignment Zones. IMPACT shall not be responsible for, and shall have no liability arising from:

security controls implemented or managed by Client or third parties;
Client decisions to delay, reject, or modify recommended security controls;
actions or omissions of Client's internal IT staff or contractors;
systems designated as Client-controlled Assignment Zones.

Client-provided controls. Where a Required Standard is satisfied by a control provided by Client or a third party rather than by IMPACT, Client shall maintain that control in an operational and functionally equivalent state for the duration of the applicable Order, and shall notify IMPACT in writing without undue delay upon any lapse, termination, expiration, or material reduction in that control.

No verification obligation. IMPACT does not verify and is not responsible for the existence, configuration, coverage, or effectiveness of any control IMPACT does not provide. Service Level Targets are suspended with respect to any affected system or Incident to the extent attributable to such a control, and no obligation to monitor, detect, or respond to any condition arises from IMPACT's administration of any system that depends on it. This Section applies whether or not an Acknowledgment under Schedule G has been invoked with respect to the control.

Cross-reference. Where an Order does not include one or more of IMPACT's cybersecurity Services and a system within Zone 1 or Zone 2 depends on a security control IMPACT does not provide, Acknowledgment G.22 shall be invoked on the applicable Order, Variance Sheet, or Risk Acknowledgment Form. Failure to invoke G.22 does not limit this Section.

4.5 Waiver of Standards

Where Client elects not to implement, or is unable to implement, one or more Required Standards, IMPACT may, in its sole discretion, require Client to invoke a Waiver of Standards as a condition of providing or continuing Services covering the affected system or configuration. A Waiver of Standards is effected solely by invoking Acknowledgment G.7 in accordance with Section 1.11 of this Addendum and Schedule G Section 1.1.

The effects of a Waiver of Standards are those set forth in Acknowledgment G.7 and in Schedule G Section 1.4, which include Client's assumption of risk and liability for the waived standards, suspension of Service Level Targets for affected systems and for any incident caused or contributed to by the deviation, classification of resulting remediation as Out-of-Scope Managed IT Services, and Client's indemnification obligation.

IMPACT may decline to accept a Waiver of Standards where the non-compliant condition poses material risk to IMPACT's staff, systems, or other clients, or where the condition prevents IMPACT from delivering the Services. A Waiver of Standards is not a negotiation of Required Standards; it is Client's documented acceptance of risk arising from a deviation. A Waiver of Standards applies only to the Required Standards it expressly identifies, does not waive any other Required Standard, and does not relieve Client of the manageability prerequisites set forth in Schedule A.

4.6 Approved Alternatives

Where IMPACT, in its sole discretion, determines that a non-default technology, product, platform, or configuration meets IMPACT's minimum technical, security, operational, and manageability requirements, such item may be designated as an Approved Alternative and published at the URL designated by IMPACT. Use of an Approved Alternative does not require invocation of a Waiver of Standards.

Approved Alternatives may be added, modified, or removed by IMPACT from time to time in its sole discretion without amendment to this Addendum.

4.7 Security Recommendations Are Advisory

Security recommendations provided by IMPACT in connection with Managed IT Services are advisory in nature. Client retains ultimate responsibility for accepting or rejecting such recommendations, subject to the consequences set forth in this Section 4 and MSA Section 7.

Where Client declines, defers, or does not act on a recommendation that is not a Required Standard, Acknowledgment G.16 (Declination of IMPACT Recommendation) shall be invoked. Where the recommendation addresses a Required Standard, a Waiver of Standards is required pursuant to Section 4.5.

5. CLIENT RESPONSIBILITIES SPECIFIC TO MANAGED IT SERVICES

5.1 General Cooperation

Client shall comply with all obligations set forth in this Addendum and shall cooperate fully with IMPACT in the performance of Managed IT Services. The general client responsibilities set forth in MSA Section 5 apply in addition to the Managed-IT-specific responsibilities set forth in this Addendum.

5.2 Compliance with Required Standards

Client shall maintain all systems, platforms, devices, users, and configurations within IMPACT-controlled or shared Assignment Zones in compliance with the Required Standards. The consequences of non-compliance are set forth in Section 4.3 of this Addendum.

5.3 Co-Managed Cooperation

For Co-Managed Services, Client shall:

ensure that Client's internal IT personnel and third-party providers cooperate with IMPACT in good faith;
coordinate changes affecting IMPACT-controlled or shared Assignment Zones with IMPACT in advance;
promptly inform IMPACT of personnel changes within Client's IT staff or third-party providers that affect access to managed systems;
ensure that Client personnel and third-party providers do not exceed the authority allocated to them under the applicable Assignment Zones.

IMPACT shall not be responsible or liable for issues, outages, security incidents, or failures arising from systems, configurations, or actions within Client-controlled Assignment Zones or caused by Client personnel or third-party providers.

5.4 Client Environment Integrity

Client acknowledges that IMPACT does not control all aspects of Client's environment and shall not be responsible for failures or issues caused by:

Client-provided hardware or software;
Third-Party Providers;
internet service providers or utilities;
actions or omissions of Client personnel or contractors;
systems or configurations that pre-date the commencement of Managed IT Services and have not been remediated to comply with Required Standards.

5.5 Cybersecurity Cooperation for MSP Engagements

In addition to the general cybersecurity cooperation duties set forth in MSA Sections 5.6 and 7, where IMPACT is engaged to provide Managed IT Services, Client shall:

provide immediate access to systems, logs, backups, credentials, and personnel necessary for incident containment, investigation, and recovery;
preserve evidence and refrain from altering affected systems without IMPACT's direction;
follow IMPACT's reasonable instructions related to containment, remediation, and recovery;
coordinate communications with regulators, customers, employees, and third parties in accordance with IMPACT's reasonable recommendations and Client's legal counsel.

IMPACT shall not be liable for damages, delays, or failures caused by Client's lack of cooperation or interference.

5.6 Authorized Decision-Maker

Client shall designate at least one authorized point of contact for Managed IT Services with decision-making authority to:

approve MACs, Projects, and changes to Assignment Zones;
authorize Out-of-Scope Managed IT Services;
execute Waivers of Standards;
direct incident response decisions during cybersecurity events.

Client shall promptly notify IMPACT of any change in authorized decision-makers.

5.7 Scheduling of Strategic and Recurring Deliverables

Where an Order includes Strategic Business Reviews, technology planning or roadmap sessions, assigned relationship personnel, or other scheduled recurring deliverables, such deliverables are scheduled in cooperation with Client and require Client's participation. Client shall make appropriate personnel with decision-making authority available. Client's failure to schedule, attend, or participate in a scheduled deliverable does not give rise to a service credit, refund, fee reduction, or carried-forward obligation, and IMPACT shall have no obligation to reschedule more than once per scheduled occurrence. IMPACT may substitute assigned personnel at its discretion.

6. CHANGE CONTROL & SHADOW IT

6.1 Change Control

Client shall not make, and shall ensure that its employees, contractors, and third-party providers do not make, any changes to systems within IMPACT-controlled or shared Assignment Zones without IMPACT's prior written approval. Approval may be granted via email, ticket, change-management workflow, or other mechanism designated by IMPACT in the ordinary course.

Any unauthorized changes shall:

void applicable Service Level Targets for the affected systems;
shift responsibility and liability to Client for any resulting issues;
render any required remediation billable as Out-of-Scope Managed IT Services or Project work, as determined by IMPACT;
where the unauthorized change creates a security risk, trigger IMPACT's right to suspend Services pursuant to MSA Section 4.5.

6.2 Coordination of Permitted Changes

Where Client or Client's third-party providers are authorized to make changes within Zone 2 (Shared Authority) systems, such changes shall be coordinated with IMPACT in advance and documented in IMPACT's change-management or ticketing system. Changes made without coordination shall be treated as unauthorized changes pursuant to Section 6.1.

6.3 Shadow IT

Client shall not deploy, use, or permit the use of any hardware, software, cloud services, applications, devices, or systems ("Shadow IT") for business purposes without IMPACT's prior written approval.

IMPACT shall have no obligation to support, secure, document, monitor, remediate, or take any responsibility for Shadow IT and shall not be liable for any issues, security incidents, data loss, regulatory exposure, or business interruption arising therefrom.

6.4 Discovery of Shadow IT

Where IMPACT identifies Shadow IT during the course of providing Managed IT Services, IMPACT may, at its discretion:

notify Client and recommend remediation;
decline to support the Shadow IT;
require Client to either remove the Shadow IT or bring it into compliance with Required Standards as a Project;
require execution of a Waiver of Standards covering the Shadow IT;
treat work involving the Shadow IT as Out-of-Scope Managed IT Services billable at IMPACT's then-current rates.

IMPACT has no obligation to discover Shadow IT, and the absence of detection does not constitute approval.

6.5 Approval of New Technology

Client shall obtain IMPACT's prior written approval before deploying or procuring any new hardware, software, cloud service, or other technology intended to be supported by IMPACT or to interact with systems within IMPACT-controlled or shared Assignment Zones. IMPACT may condition approval upon:

verification of compatibility with Required Standards;
procurement through IMPACT or an Approved Alternative;
execution of additional Orders or Project authorizations as required to onboard the new technology.

Client acknowledges that deploying new technology without IMPACT's approval may result in classification of the technology as Shadow IT and the consequences set forth in Section 6.3.

7. UNSUPPORTED SYSTEMS & RISK ACCEPTANCE

7.1 Unsupported Systems Defined

For purposes of this Addendum, "Unsupported Systems" means any hardware, software, operating system, firmware, application, platform, or service that:

has reached End-of-Life or End-of-Support;
is no longer receiving security updates, patches, or vendor support;
is operating outside the manufacturer's supported configuration or licensing terms;
does not meet the Required Standards;
is otherwise designated by IMPACT as unsupportable due to security, manageability, or operational risk.

7.2 Risk Acceptance Required

Where Client elects to retain or continue operating Unsupported Systems within IMPACT-controlled or shared Assignment Zones, IMPACT may, in its sole discretion, require Client to execute a written risk acknowledgment, which may take the form of a Waiver of Standards or a separate risk-acceptance instrument.

By electing to retain Unsupported Systems, Client acknowledges and agrees that:

the affected systems present elevated risk of failure, security incident, data loss, and business disruption;
IMPACT has no obligation to support, secure, monitor, patch, or remediate Unsupported Systems unless expressly stated in an Order;
Service Level Targets do not apply to Unsupported Systems;
IMPACT shall have no liability for damages arising from or related to Unsupported Systems;
any work performed by IMPACT involving Unsupported Systems shall be Out-of-Scope Managed IT Services billable at IMPACT's then-current rates.

7.3 Limitation or Exclusion of Services

IMPACT may, at its discretion:

limit, suspend, or exclude Managed IT Services related to Unsupported Systems;
require Client to remediate, replace, or decommission Unsupported Systems as a condition of continued Managed IT Services;
treat work involving Unsupported Systems as Project work pursuant to Section 13;
terminate affected Services pursuant to MSA Section 4 if Client refuses remediation and the Unsupported Systems present unacceptable risk to IMPACT, Client, or third parties.

7.4 No Implied Obligation to Support

The fact that IMPACT has previously provided Services with respect to a system or has not previously objected to a system's configuration does not create an obligation to continue providing Services after the system becomes an Unsupported System.

8. PROCUREMENT & CLIENT-SUPPLIED EQUIPMENT

8.1 Procurement of Hardware and Software

Unless otherwise stated in writing, IMPACT shall have sole discretion to source, select, and procure hardware, software, and related components used in connection with Managed IT Services to ensure compatibility, supportability, and compliance with Required Standards.

Client acknowledges that delivery timelines, availability, and pricing are dependent on Third-Party Providers and supply-chain conditions beyond IMPACT's control.

8.2 Client-Supplied Hardware and Software

Client shall not procure or deploy hardware, software, or systems intended to be supported by IMPACT under Managed IT Services without IMPACT's prior written approval.

IMPACT reserves the right to:

refuse to support Client-supplied hardware or software that does not meet Required Standards;
require remediation, reconfiguration, or replacement to bring Client-supplied items into compliance with Required Standards as a condition of providing support;
classify resulting work as Out-of-Scope Managed IT Services or Project work;
treat unapproved Client-supplied items as Shadow IT pursuant to Section 6.3.

IMPACT shall not be responsible for failures, incompatibilities, performance issues, or security incidents arising from Client-supplied equipment or software.

8.3 Approved Procurement Channels

Client may satisfy the procurement-approval requirement set forth in Section 8.2 by procuring through:

IMPACT's procurement program;
a Hardware-as-a-Service (HaaS / TaaS) Order pursuant to the HaaS / TaaS Addendum;
an Approved Alternative pursuant to Section 4.6; or
an alternative source pre-approved in writing by IMPACT.

8.4 Manufacturer Warranties and Support

Hardware and software procured by IMPACT, supplied by Client, or operating within the Managed IT Services environment may be subject to manufacturer warranties and support terms. IMPACT does not guarantee manufacturer response times, replacement timelines, or availability of parts. IMPACT makes no independent warranty regarding hardware or software performance beyond any express warranties provided by the manufacturer.

The general procurement, manufacturer-warranty, and shipping/handling provisions set forth in MSA Section 10 apply to procurement under this Addendum.

8.5 Cloud Subscription Transition

(a) Provider of record. Where IMPACT procures Microsoft, Google, or other cloud productivity subscriptions on Client's behalf, IMPACT may act as Cloud Solution Provider, reseller, or partner of record for those subscriptions. Client's ownership of its tenant and Client Data is unaffected by IMPACT's role as provider of record.

(b) Vendor commitment terms. Client acknowledges that cloud subscriptions procured through IMPACT are subject to the vendor's then-current commercial terms, which may include annual or multi-year commitment periods, mid-term cancellation restrictions, seat-reduction restrictions, and price protection windows. Such terms are established by the vendor, are outside IMPACT's control, and may extend beyond the term of the applicable Order. Client remains responsible for all amounts owing under any commitment period in effect, including any portion of a commitment period extending past termination or expiration of an Order.

(c) Transition on termination. Upon termination or expiration of an Order under which IMPACT is provider of record, and subject to payment of all outstanding amounts, Client may elect to (i) transition the subscriptions to a direct relationship with the vendor, (ii) transition the subscriptions to a provider of record designated by Client, or (iii) retain IMPACT as provider of record under a separate written agreement. Client shall notify IMPACT of its election not less than thirty (30) days prior to the end-of-service date. Absent timely election, IMPACT may release, relinquish, or allow the lapse of its provider-of-record relationship without further obligation to Client.

(d) IMPACT cooperation. Upon Client's timely election under subsection (c), IMPACT shall provide the cooperation reasonably necessary to effect the transition, including submission of the transfer or relinquishment requests required by the vendor and provision of subscription and license inventory information. Such cooperation constitutes transition assistance under MSA Section 4.7, is not included in recurring fees, and is billable at IMPACT's then-current rates or as set forth in a separately purchased deboarding statement of work.

(e) Vendor-controlled outcomes. Client acknowledges that subscription transfer eligibility, transfer timing, transfer windows, and the treatment of commitment periods on transfer are determined solely by the vendor. IMPACT does not guarantee that any subscription can be transferred, that a transfer will occur within any timeframe, or that a commitment period will be released, reduced, or reassigned. IMPACT shall have no liability for vendor-imposed restrictions, delays, refusals, or charges arising in connection with a subscription transition.

(f) Data. This Section addresses subscriptions and licensing only. Client Data retention, retrieval, and deletion are governed by MSA Sections 4.8 and 4.9.

9. BASIC CABLING WORK

9.1 Scope of Basic Cabling Work

Where Managed IT Services are provided under an executed Order, IMPACT may perform Basic Cabling Work as defined in Section 1.3, meaning troubleshooting and repair of existing cabling, as part of routine Managed IT Services support, subject to:

availability of IMPACT personnel and tools appropriate to the work;
safe and reasonable site conditions;
absence of code, permitting, structural, or specialized-trade requirements;
the work being incidental to other Managed IT Services activity.

9.2 What is NOT Basic Cabling Work

For clarity, the following are not Basic Cabling Work and shall be performed only pursuant to the Cabling & Low-Voltage Addendum and a separate Order:

any installation of new cabling, regardless of length, count, or scope;
replacement of existing cabling;
relocation of existing cabling;
structured cabling design, certification, or testing beyond basic continuity;
fiber optic installation, splicing, or termination beyond patch-cable replacement;
cabling work requiring permits, licensed trades, or code inspection;
cabling work requiring access above ceilings, behind walls, or through floors;
cabling work involving hazardous environments or specialized safety requirements.

9.3 Discretionary Performance

IMPACT may, in its sole discretion, decline to perform any Basic Cabling Work and instead require execution of a Cabling & Low-Voltage Addendum and Order. Factors considered may include scope, safety, accessibility, site conditions, and resource availability.

9.4 No Warranty on Basic Cabling Work

Basic Cabling Work is performed on a best-efforts basis without warranty of performance, longevity, or compliance with cabling-industry standards (such as TIA/EIA structured-cabling specifications). Client acknowledges that Basic Cabling Work is intended as a service convenience for Managed IT Services clients and not as a substitute for professional cabling installation services.

9.5 Billing for Basic Cabling Work

Basic Cabling Work performed in connection with other in-scope Managed IT Services activity may be included in the underlying Service or billed at IMPACT's then-current rates as MAC or Out-of-Scope work, as determined by IMPACT.

10. SERVICE LIMITATIONS & OUT-OF-SCOPE MSP WORK

10.1 Additional Out-of-Scope Categories

In addition to the categories identified in Section 2.4 of this Addendum and MSA Section 3.4, the following are deemed Out-of-Scope Managed IT Services unless expressly included in an executed Order:

support for systems, applications, or services not disclosed to or documented by IMPACT;
work in or affecting Zone 3 (Client-Controlled) systems beyond advisory consultation;
support for Shadow IT pursuant to Section 6.3;
support for Unsupported Systems pursuant to Section 7;
work involving Client-supplied hardware or software not approved pursuant to Section 8.2;
cabling work exceeding the scope of Basic Cabling Work pursuant to Section 9.2;
compliance attestation, audit support, or evidence-gathering not expressly included in the Order;
legal, regulatory, accounting, insurance, or risk-management advice;
forensic investigation beyond initial triage;
specialized cybersecurity services beyond those expressly included in the Order;
on-site dispatch, after-hours, or emergency work not expressly included;
data restoration or recovery from backups, including file, folder, mailbox, dataset, and disaster recovery restoration;
backup testing, test restoration, or recovery validation;
vendor liaison, coordination, escalation, or case management with Third-Party Providers on Client's behalf;
risk assessments, gap analyses, and security or compliance posture assessments;
cloud platform tenant oversight activities as described in Section 1.21, including security baseline and conditional access maintenance beyond expressly included identity Services, license and subscription reconciliation, and configuration drift monitoring;
training, end-user education, or change-management consulting not expressly included.

10.2 Service Level Targets — Conditional Application

Service Level Targets set forth in Schedule B apply only to:

Managed IT Services expressly included in an executed Order;
systems within IMPACT-controlled or shared Assignment Zones;
systems in compliance with Required Standards or operating under an Approved Alternative; and
systems and configurations not subject to a Waiver of Standards or risk acceptance instrument that suspends Service Level Targets.

For clarity, the conditional nature of Service Level Targets set forth in this Section does not modify the no-remedy, advisory-only character of Service Level Targets established in MSA Section 15.8. Failure to meet a Service Level Target shall not constitute a breach of this Addendum or the MSA.

10.3 Acceptance of Pre-Existing Environment

The commencement of Managed IT Services does not constitute IMPACT's acceptance, approval, or warranty of Client's pre-existing environment. Client acknowledges that:

the pre-existing environment may contain non-compliant configurations, Unsupported Systems, Shadow IT, or other risks;
bringing the environment into compliance with Required Standards may require Project work pursuant to Section 13;
IMPACT's responsibility for the environment is limited to systems and configurations that comply with Required Standards or are operating under an executed Waiver of Standards;
pre-existing issues identified during the course of Managed IT Services do not become IMPACT's responsibility solely by virtue of being identified.

10.4 Reasonable Consumption of Included Support

(a) Scope of included support. Where an Order provides support on an included, unlimited, or non-retainer basis, such support means support of in-scope incidents affecting Managed Users and Managed Devices that are within the scope of the Order, in compliance with the Required Standards or operating under an Approved Alternative, and reported through authorized channels. Included support does not extend to Moves, Adds, or Changes, New to Environment device onboarding, Cascades, Projects, or Out-of-Scope Managed IT Services, each of which is separately chargeable unless expressly stated in an Order.

(b) Reasonable consumption. Included support is priced on the assumption of consumption reasonably consistent with the size, complexity, and standards compliance of Client's environment. Client shall not use included support in a manner that constitutes, in substance, the delivery of Project work, staff augmentation, or the replacement of Client-provided internal functions, through the aggregation of individually in-scope requests.

(c) Consumption review. Where Client's consumption of included support exceeds an average of one and one-half (1.5) labor hours per Managed User per month over any rolling three (3) month period, IMPACT may notify Client and request a consumption review. For purposes of this calculation, labor hours include remote and onsite time applied to included support, and exclude time applied to Moves, Adds, or Changes, New to Environment device onboarding, Cascades, Projects, Out-of-Scope Managed IT Services, and any work separately charged to Client.

(d) Remedies available to IMPACT. Following a consumption review, IMPACT may, in its reasonable discretion: (i) identify specific recurring work as Project work or Out-of-Scope Managed IT Services chargeable in accordance with Section 13 or Section 10.1; (ii) identify environmental non-compliance with Required Standards driving consumption and require remediation as a condition of continued included support; (iii) propose an amended Order adjusting Service Plan, pricing, scope, or Assignment Zones; or (iv) where the Parties do not agree on an adjustment within thirty (30) days of the review, exercise IMPACT's termination rights under MSA Section 4.3(b).

IMPACT shall not reduce or suspend included support during a consumption review, and any change to pricing or scope requires a written amendment to the applicable Order executed by both Parties.

(e) Not a cap. This Section does not establish a cap, quota, or entitlement limit on included support, and does not authorize IMPACT to decline in-scope support requests. It establishes a review mechanism for consumption materially outside the pricing assumptions of the applicable Order.

(f) Onsite support. Included onsite support is subject to Schedule C, including travel time, mileage, and zone-based charges, and to the scheduling and availability provisions of the applicable Order.

10.5 Fixed-Fee Moves, Adds, and Changes

(a) Application. Where an Order provides that Moves, Adds, and Changes are performed at a fixed fee, IMPACT shall perform each MAC within the scope defined in subsection (b) for the per-MAC fee set forth in that Order, in lieu of time-and-materials charges.

(b) Scope of a fixed-fee MAC. A fixed-fee MAC means a single discrete configuration change of the type described in Section 1.8, performed on an existing supported system within an IMPACT-controlled or shared Assignment Zone, and completed within a normal execution window. The following are not fixed-fee MACs and are charged separately in accordance with Section 13 or Section 10.1: New to Environment device onboarding; Cascades; Projects; any change requiring design, architecture, migration, testing, or scoping work; any change to a system that does not meet the Required Standards or that is subject to a Waiver of Standards or Risk Acknowledgment; any change requested outside IMPACT's business hours; and any change requiring onsite attendance, which is additionally subject to Schedule C.

(c) Excess volume generally. Fixed-fee MAC pricing is available for MAC volume reasonably consistent with the size and stability of Client's environment. Where MAC volume materially exceeds the volume reasonably anticipated for an environment of Client's size, IMPACT may request a consumption review under Section 10.4.

(d) User lifecycle turnover. "User Lifecycle MAC" means a MAC consisting of the provisioning of a new User or the deprovisioning of a departing User, including associated account, license, mailbox, access, and device-assignment changes.

Where the number of deprovisioning User Lifecycle MACs performed in any rolling twelve (12) month period exceeds thirty percent (30%) of Client's average Managed User count during that period, IMPACT may, upon written notice to Client, charge each subsequent User Lifecycle MAC at IMPACT's then-current time-and-materials rates for the remainder of the then-current term, in lieu of fixed-fee pricing. Fixed-fee pricing continues to apply to all other MACs.

Where Client's Managed User count has increased on a net basis over the measurement period, IMPACT shall disregard a number of provisioning User Lifecycle MACs equal to that net increase before applying this subsection. Client's growth in Managed Users shall not, by itself, cause the threshold in this subsection to be exceeded.

IMPACT shall provide Client with the underlying counts upon request. This subsection does not limit IMPACT's rights under Section 10.4.

(e) Relationship to included support. Fixed-fee MAC pricing does not make MACs part of Recurring Services and does not modify Section 2.2 of this Addendum or MSA Section 1 (Recurring Services).

11. MSP-SPECIFIC INDEMNIFICATION TRIGGERS

11.1 Additive Client Indemnification Obligations

In addition to the indemnification obligations set forth in MSA Section 16, Client shall defend, indemnify, and hold harmless the IMPACT Indemnitees from and against any and all claims, demands, causes of action, damages, losses, liabilities, penalties, fines, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to:

Client's failure to comply with Required Standards within IMPACT-controlled or shared Assignment Zones;
execution of a Waiver of Standards by Client;
Client's deployment, use, or retention of Shadow IT;
Client's deployment, use, or retention of Unsupported Systems;
unauthorized changes by Client, Client's personnel, or Client's third-party providers to systems within IMPACT-controlled or shared Assignment Zones;
failure of Client's third-party IT providers to cooperate with IMPACT or to operate within their authorized Assignment Zones;
pre-existing environment issues, including non-compliant configurations, undocumented systems, or undisclosed risks present at the commencement of Managed IT Services;
Client's procurement or deployment of hardware or software in violation of Section 8.2.

This indemnification obligation shall apply regardless of whether such claims arise from alleged negligence, except to the extent caused by IMPACT's gross negligence or willful misconduct.

11.2 Coordination with MSA

The indemnification obligations set forth in this Section 11 are additive to, and do not replace, the indemnification obligations set forth in MSA Section 16. The procedural requirements, indemnity allocations, subrogation provisions, insurance coordination, and limitation-of-liability coordination set forth in MSA Sections 15 and 16 apply to the indemnification obligations set forth in this Addendum.

12. MSP-SPECIFIC LIABILITY ALLOCATIONS

12.1 Additional No-Liability Categories

In addition to the no-liability categories set forth in MSA Section 15.9, and subject to the uncapped liability carve-outs set forth in MSA Section 15.2(c), IMPACT shall have no liability for claims, damages, or losses arising from or related to:

Unsupported Systems retained by Client;
Shadow IT deployed or used by Client;
pre-existing environment issues that have not been remediated;
unauthorized changes by Client, Client's personnel, or Client's third-party providers;
systems or configurations within Zone 3 (Client-Controlled) Assignment Zones;
decisions by Client to delay, reject, or modify recommended remediation, upgrades, or security controls;
failure of Client's third-party IT providers;
Client-supplied hardware or software not approved pursuant to Section 8.2;
cabling work outside the scope of Basic Cabling Work as defined in Section 1.3.

12.2 Coordination with MSA

The no-liability categories set forth in this Section 12 are additive to, and do not replace, the limitation of liability provisions set forth in MSA Section 15. The Default Cap, Super-Cap, and uncapped categories set forth in MSA Section 15.2 apply to all claims subject to this Addendum.

13. MSP-SPECIFIC PROJECT TRIGGERS

13.1 Conditions That Trigger Project Work

In addition to the Project examples and authorization mechanics set forth in MSA Section 9, the following conditions shall trigger Project work pursuant to MSA Section 9 and a separate SOW or Order:

onboarding and environment remediation upon commencement of Managed IT Services;
standardization initiatives required to bring Client's environment into compliance with Required Standards;
migrations, upgrades, or platform changes affecting systems within IMPACT-controlled or shared Assignment Zones;
installation, setup, provisioning, or introduction of any hardware, software, endpoint, device, user, or workstation that is New to Environment (NTE), as defined in Section 1.15;
redeployment, reassignment, or relocation of any device, endpoint, or user configuration constituting a Cascade, whether an Equipment Cascade or a User Cascade, as defined in Section 1.16;
security remediation required following an incident or risk discovery;
consulting, assessments, or architecture design beyond routine Managed IT Services advisory;
work required to bring Client into compliance with Required Standards following a Waiver remediation;
work necessitated by Client-caused issues, Shadow IT discovery, Unsupported Systems remediation, or unauthorized changes;
significant changes to Client's environment, headcount, or business operations that materially affect the scope of Managed IT Services;
forensic investigation, incident response, or recovery work beyond initial triage included in Recurring Services.

13.2 New to Environment (NTE) Work

NTE work, as defined in Section 1.15, constitutes Project work and shall be authorized and billed in accordance with MSA Section 9 or at the installation, setup, or provisioning rates set forth in the applicable Order. NTE addresses the one-time introduction, installation, configuration, and setup of a component into the Client environment. The ongoing monitoring, management, security, and support of a component following its introduction is governed separately by the Recurring Services and pricing set forth in the applicable Order, and NTE charges are in addition to, and do not include or offset, any recurring fees applicable to that component. To the extent NTE work also involves Moves, Adds, or Changes, it shall be classified and billed as Project work under this Section 13 rather than as a MAC. Client's deployment or introduction of any component without IMPACT's prior approval may additionally constitute Shadow IT under Section 6.3 and an unauthorized change under Section 6.1.

13.3 Cascades

Cascade work, as defined in Section 1.16, constitutes Project work and shall be authorized and billed in accordance with MSA Section 9 or at the rates set forth in the applicable Order. Where a Cascade arises from the installation of a device that is New to Environment, the introduction and setup of the new device is NTE under Section 13.2, and the redeployment or reassignment of displaced or existing devices and user configurations is the Cascade; both are Project work. To the extent Cascade work also involves Moves, Adds, or Changes, it shall be classified and billed as Project work under this Section 13 rather than as a MAC. The extent to which any category of Cascade is included in Recurring Services or billed separately is governed by the applicable Order.

13.4 No Implied Project Authorization

The conditions set forth in Section 13.1 identify when Project work may be required; they do not constitute authorization to perform Project work. Project work shall be authorized only pursuant to MSA Section 9.2.

13.5 Coordination with MSA

The Project triggers set forth in this Section 13 are additive to, and do not replace, the Projects framework set forth in MSA Section 9. All Project authorization, scope control, billing, and termination provisions of MSA Section 9 apply to Projects performed under this Addendum.

14. SERVICE LEVEL TARGETS

14.1 Schedule B Application

Service Level Targets applicable to Managed IT Services are set forth in Schedule B, which is structured as a global Service Level Targets schedule with sections corresponding to specific service lines. The Managed IT Services section of Schedule B applies to Services delivered under this Addendum, subject to the conditional-application provisions of Section 10.2 of this Addendum.

14.2 No Remedy

Service Level Targets are advisory operational objectives only and do not constitute contractual commitments, performance warranties, or guaranteed outcomes. The no-remedy character of Service Level Targets established in MSA Section 15.8 applies in full to all Service Level Targets set forth in Schedule B, including those applicable to Managed IT Services. Failure to meet any Service Level Target shall not constitute a breach of this Addendum or the MSA, shall not give rise to service credits, refunds, damages, termination rights, or any other remedy, and shall not be asserted as a basis for any claim against IMPACT.

14.3 Conditional Application

Service Level Targets applicable to Managed IT Services apply only as set forth in Section 10.2 of this Addendum.

15. SUPPORT RETAINERS

15.1 Application

Where an Order provides that support is funded through a prepaid support retainer (a "Support Retainer"), this Section governs the purchase, drawdown, and administration of that Support Retainer. A Support Retainer is a prepaid dollar balance against which IMPACT applies charges for work performed, and is not a purchase of a fixed quantity of hours.

15.2 Purchase and Replenishment

The initial Support Retainer amount, the replenishment amount, and the replenishment trigger are set forth in the applicable Order.

Unless the applicable Order expressly provides otherwise, automatic replenishment applies. Where automatic replenishment applies, IMPACT shall invoice the replenishment amount upon the remaining balance reaching or falling below the replenishment trigger, without further authorization from Client, and shall notify Client of each replenishment. Client authorizes such invoicing for the duration of the Order. IMPACT shall not process more than two (2) automatic replenishments in any calendar month; additional replenishment within the same calendar month requires Client's written authorization.

Where an Order expressly provides that automatic replenishment does not apply, IMPACT shall notify Client when the balance reaches the replenishment trigger, and replenishment requires Client's written authorization. Client acknowledges that declining automatic replenishment may result in suspension of support under Section 15.7.

Replenishment invoices are due in accordance with MSA Section 6.

15.3 Rate Applied

Work is applied against the Support Retainer at IMPACT's rates in effect at the time the work is performed, as set forth in the applicable Order or IMPACT's then-current rate schedule. Client acknowledges that a Support Retainer purchases a prepaid balance and does not fix, lock, or pre-purchase any labor rate, and that rates may be adjusted in accordance with MSA Section 6.7.

15.4 Drawdown and Increments

Work is applied against the Support Retainer in fifteen (15) minute increments, with a minimum charge of fifteen (15) minutes per discrete request or incident. Work performed outside IMPACT's business hours is applied at IMPACT's then-current after-hours rate. Travel and onsite charges are applied in accordance with Schedule C.

15.5 Eligible Work

Unless the applicable Order provides otherwise, a Support Retainer may be applied against remote and onsite support of in-scope incidents, Moves, Adds, or Changes, and Out-of-Scope Managed IT Services. Notwithstanding their classification as Project work under Sections 1.15, 1.16, and 13, New to Environment device onboarding and Cascade work may be applied against a Support Retainer where the applicable Order so provides. A Support Retainer may not be applied against any other Project, Recurring Services fees, Third-Party Provider charges, pass-through costs, hardware, software, licensing, or fees payable under any other Addendum, except where expressly stated in an Order.

15.6 Roll-Forward

Unused Support Retainer balance rolls forward from month to month and from term to term for so long as the applicable Order remains in effect. Balance does not expire during the term of the Order.

15.7 Exhaustion and Suspension

Where the Support Retainer balance is exhausted or insufficient to cover work in progress, and automatic replenishment has not restored a sufficient balance, IMPACT shall notify Client and may, at its discretion: (a) continue work and invoice the excess at IMPACT's then-current rates; (b) suspend further work until the Support Retainer is replenished; or (c) require Client's authorization to proceed. IMPACT shall have no obligation to perform work in excess of the available balance absent Client's authorization to incur charges beyond the balance.

Notwithstanding the foregoing, IMPACT may continue work without prior authorization where necessary to address an Emergency as defined in Section 1.22, and shall invoice the resulting charges at IMPACT's then-current rates.

Suspension under this Section is not a suspension of Recurring Services and does not relieve Client of its obligation to pay recurring fees. Monitoring, patching, and security Services included in the applicable Service Plan continue during any suspension of retainer-funded support.

15.8 Reporting

IMPACT shall make Support Retainer balance and drawdown activity available to Client through IMPACT's client portal or upon request. Balance reporting reflects IMPACT's records as of the time of reporting and may not include work performed but not yet posted.

15.9 Non-Refundable

Support Retainer amounts are prepaid fees and are non-refundable in accordance with MSA Section 6.12. Upon termination or expiration of the applicable Order, any unused Support Retainer balance may be applied, at Client's request, against (a) final invoices for Services rendered through the effective date of termination, and (b) transition assistance fees under MSA Section 4.7. Any balance remaining after such application is forfeited and shall not be refunded, credited, or applied against any other Order or obligation.

15.10 No Service Level Effect

The existence, size, or exhaustion of a Support Retainer does not modify, suspend, or expand any Service Level Target set forth in Schedule B.

16. SURVIVAL

The provisions of this Addendum shall survive termination or expiration of the MSA to the extent necessary to enforce rights, obligations, and remedies arising during the term, including provisions relating to:

Required Standards compliance and Waiver of Standards consequences;
Unsupported Systems risk acceptance;
Shadow IT consequences;
Assignment Zone-based responsibility allocation;
procurement, manufacturer warranties, and Client-supplied equipment;
MSP-specific indemnification triggers;
MSP-specific liability allocations;
MSP-specific Project triggers;
pre-existing environment risk allocation;
Support Retainer non-refundability and application at termination;
cloud subscription transition and vendor commitment responsibility;
Service Plan incorporation and version control;
reasonable consumption and fixed-fee MAC volume provisions.

The survival provisions set forth in MSA Section 23.11 apply to this Addendum.

17. EXECUTION AND EFFECTIVENESS

This Addendum becomes effective on the Order Effective Date of the first Order referencing it and requires no separate signature page. Where this Addendum is delivered as a supplemental document with an Order executed by Client, Client's execution of that Order constitutes Client's execution of this Addendum. This Addendum binds the Parties with the same force and effect as if separately executed.

End of Addendum

IMPACT MSA Managed IT Services Addendum