IMPACT MSA Cybersecurity Addendum

CYBERSECURITY ADDENDUM

This Cybersecurity Addendum ("Addendum") supplements the IMPACT Master Services Agreement ("MSA") entered into by and between IMPACT Technology Group, Inc. ("IMPACT") and Client. Capitalized terms not defined herein shall have the meanings set forth in the MSA.

This Addendum applies only to the extent Cybersecurity Services are expressly described in, and provided pursuant to, an executed Order. In the absence of an executed Order for Cybersecurity Services, this Addendum shall have no force or effect.

In the event of any conflict between this Addendum and the MSA, this Addendum shall govern solely with respect to Cybersecurity Services, in accordance with the order of precedence set forth in MSA Section 2.5.

This Addendum is designed to operate independently of any other IMPACT services. Where Client also purchases Managed IT Services pursuant to the Managed IT Services Addendum, the two Addendums shall apply additively, with conflicts resolved in accordance with MSA Section 2.5.

1. DEFINITIONS

For purposes of this Addendum, the following capitalized terms shall have the meanings set forth below. Capitalized terms used but not defined herein shall have the meanings set forth in the MSA.

1.1 "Cybersecurity Services"

means the cybersecurity services expressly described in an executed Order and governed by this Addendum, which may include the Service categories enumerated in Section 2.

1.2 "Cybersecurity Minimum Environment Requirements" or "CMER"

means the minimum technical, operational, and access requirements that Client's environment must satisfy in order for IMPACT to deliver Cybersecurity Services, as set forth in Schedule H (Cybersecurity Minimum Environment Requirements), which is incorporated into this Addendum by reference.

1.3 "Cybersecurity Waiver of Standards" or "Cyber Waiver"

means Acknowledgment G.23 (Waiver of Cybersecurity Minimum Environment Requirements (CMER)) set forth in Schedule G, invoked by reference and initialed or signed by Client on an Order, Variance Sheet, or Risk Acknowledgment Form in accordance with Schedule G Section 1.1, identifying the specific CMER from which Client's environment deviates. References in this Addendum to a "Cyber Waiver," a "Cybersecurity Waiver of Standards," or an executed waiver of any CMER mean Acknowledgment G.23 so invoked and initialed. No separate or standalone waiver instrument is required, and no other writing constitutes a Cyber Waiver. A Cyber Waiver is distinct in scope from a Waiver of Standards under the Managed IT Services Addendum, which is effected by Acknowledgment G.7 and applies to the Required Standards set forth in Schedule A. Declination of a cybersecurity recommendation that is not a CMER is effected by Acknowledgment G.16.

1.4 "Detection"

means the identification, alerting, or surfacing of potential security events, indicators of compromise, anomalies, or threats observed within the systems, data sources, and telemetry covered by an executed Order.

1.5 "Incident"

means any actual or reasonably suspected unauthorized access, compromise, breach, malicious activity, malware infection, ransomware event, business email compromise, data exfiltration, or other adverse cybersecurity event affecting Client's systems, data, accounts, users, or third-party services.

1.6 "Incident Response" or "IR"

means investigation, containment, eradication, recovery, forensic analysis, communications support, and related activities performed in response to an Incident. Incident Response is not included in Recurring Cybersecurity Services unless Client has purchased an Incident Response Retainer pursuant to Section 6, and shall otherwise be performed as Project work pursuant to MSA Section 9.

1.7 "Incident Response Retainer" or "IR Retainer"

means a separately purchased Service line under which IMPACT pre-positions Incident Response capability for Client, including specified hours, response targets, and engagement terms set forth in the applicable Order.

1.8 "Initial Triage"

means the initial assessment and notification activities performed by IMPACT upon Detection of a potential Incident, including (a) verification that an event has occurred, (b) preliminary scoping of affected systems or accounts, and (c) notification to Client. Initial Triage is included in Recurring Cybersecurity Services as expressly stated in an applicable Order. Initial Triage does not include containment, eradication, recovery, forensic analysis, or other Incident Response activities.

1.9 "Managed Detection and Response" or "MDR"

means continuous monitoring, threat detection, behavioral analytics, threat hunting, and Initial Triage performed by IMPACT or IMPACT's designated security operations partners, as expressly described in an executed Order.

1.10 "Recurring Cybersecurity Services"

mean the ongoing monitoring, detection, alerting, administration, advisory, and other Cybersecurity Services delivered on a continuous basis under an executed Order, excluding Incident Response (unless purchased under an IR Retainer) and Projects.

1.11 "Security Operations Center" or "SOC"

means the personnel, tooling, and operational infrastructure used by IMPACT or IMPACT's designated SOC partner to deliver continuous security monitoring, alerting, and Initial Triage services.

1.12 "Tooling"

means the security software, agents, sensors, platforms, services, and related components deployed in Client's environment or used by IMPACT to deliver Cybersecurity Services.

1.13 "Virtual Chief Information Security Officer" or "vCISO"

means strategic cybersecurity advisory services provided by IMPACT on a fractional basis, including but not limited to security program development, governance, risk advisory, board reporting, and policy guidance, as expressly described in an executed Order.

2. SCOPE OF CYBERSECURITY SERVICES

2.1 Service Categories

Cybersecurity Services may include, as expressly described in an executed Order, any combination of the following:

(a) Managed Detection & Response (MDR) — continuous monitoring, threat detection, behavioral analytics, threat hunting, and Initial Triage;

(b) Security Operations Center (SOC) Services — 24/7 monitoring, alerting, and Initial Triage;

(c) Endpoint Detection & Response (EDR) — deployment, configuration, monitoring, and management of endpoint security agents;

(d) Email Security — phishing protection, business-email-compromise defense, mail filtering, and related email-borne threat controls;

(e) Vulnerability Management — vulnerability scanning, prioritization, remediation tracking, and reporting;

(f) Security Awareness Training & Phishing Simulation — user education programs, simulated phishing campaigns, and reporting;

(g) Vendor / Third-Party Risk Management Support — assistance with vendor risk assessments, third-party security questionnaires, and related vendor due-diligence activities;

(h) Virtual Chief Information Security Officer (vCISO) Advisory — strategic cybersecurity advisory services on a fractional basis;

(i) Incident Response Retainer — pre-positioned Incident Response capability pursuant to Section 6;

(j) Penetration Testing & Vulnerability Assessments — point-in-time security assessments, including external penetration testing, internal penetration testing, web-application testing, and vulnerability assessments;

(k) Compliance & Audit Readiness Support — services oriented to specific frameworks (HIPAA, CMMC, SOC 2, PCI-DSS, NIST, ISO/IEC 27001, NY DFS Part 500, and others), as further described in the applicable Order;

(l) Dark Web & Credential Monitoring — monitoring of dark-web sources, credential exposure feeds, and related threat-intelligence services;

(m) Security Architecture & Design Consulting — consulting on security architecture, control design, network segmentation, identity strategy, and related design activities;

(n) Risk Assessments — point-in-time cybersecurity risk assessments, gap analyses, and related advisory deliverables.

Only those Service categories expressly identified in an executed Order shall be provided under this Addendum.

2.2 Recurring Cybersecurity Services vs. Incident Response vs. Projects

For purposes of this Addendum:

  • Recurring Cybersecurity Services mean ongoing monitoring, detection, alerting, administration, advisory, and other Cybersecurity Services delivered on a continuous basis under an executed Order;

  • Incident Response is not included in Recurring Cybersecurity Services unless Client has purchased an IR Retainer pursuant to Section 6, and shall otherwise be performed as Project work pursuant to MSA Section 9;

  • Projects are governed by MSA Section 9 and may be triggered by, among other things, the conditions identified in Section 12 of this Addendum.

2.3 Service Catalog Controls Scope

The scope, inclusions, exclusions, dependencies, and limitations of Cybersecurity Services are defined in the Service Catalog. Only Cybersecurity Services expressly listed in the Service Catalog and included in an executed Order are covered under this Addendum.

2.4 Out-of-Scope Cybersecurity Services

In addition to the categories of Out-of-Scope Services identified in MSA Section 3.4, the following are deemed Out-of-Scope Cybersecurity Services unless expressly included in an executed Order:

  • Incident Response activities beyond Initial Triage where Client has not purchased an IR Retainer;

  • forensic investigation, expert testimony, or litigation-support activities;

  • regulatory notification drafting, breach-notification letter preparation, or public-relations support;

  • ransomware negotiation, cryptocurrency transactions, or threat-actor communications;

  • legal advice or representation regarding cyber events;

  • recovery, restoration, or remediation of Client systems following an Incident;

  • investigation or response involving systems or data outside the scope of the executed Order;

  • compliance attestation, audit opinions, or certification under any framework, except as expressly stated in an Order;

  • penetration testing, red-team engagements, or assessments beyond those expressly purchased;

  • security work on Client-controlled systems, Shadow IT, or Unsupported Systems beyond advisory consultation.

Out-of-Scope Cybersecurity Services shall be billable at IMPACT's then-current rates unless otherwise agreed in writing.

2.5 Stacked Engagement with Managed IT Services

Where Client also purchases Managed IT Services pursuant to the Managed IT Services Addendum:

  • the two Addendums apply additively, with each Service category governed by its applicable Addendum;

  • Required Standards under the Managed IT Services Addendum and Cybersecurity Minimum Environment Requirements under this Addendum apply concurrently, with the more restrictive provision controlling where the same system, control, or configuration is addressed by both;

  • Waiver of Standards executed under the Managed IT Services Addendum and Cyber Waivers executed under this Addendum apply only to the deviations they expressly identify, and execution of one does not waive obligations under the other;

  • Assignment Zones designations made under the Managed IT Services Addendum inform but do not control the allocation of Cybersecurity Services responsibility, which is governed by Section 5 of this Addendum.

2.6 Standalone Cybersecurity Engagement

Where Client purchases Cybersecurity Services without also purchasing Managed IT Services, this Addendum stands on its own. Client acknowledges that:

  • IMPACT's role is limited to the Cybersecurity Services expressly identified in the executed Order;

  • IMPACT does not assume responsibility for Client's overall IT environment, infrastructure operations, system administration, or general IT support;

  • responsibility for Client's IT environment remains with Client and Client's internal IT staff or third-party IT providers;

  • the effectiveness of Cybersecurity Services depends on Client's IT environment satisfying the Cybersecurity Minimum Environment Requirements set forth in Section 4.

3. CYBERSECURITY SERVICES OVERVIEW

3.1 Nature of Cybersecurity Services

Client acknowledges and agrees that:

  • cybersecurity is a continuously evolving discipline, and the threat landscape changes rapidly;

  • no security service, tool, or program can prevent all Incidents, eliminate all risk, or guarantee the security of any system, network, account, or data set;

  • Cybersecurity Services are designed to reduce risk through Detection, monitoring, advisory, and selected response activities, but do not eliminate risk;

  • the effectiveness of Cybersecurity Services depends on factors outside IMPACT's control, including Client's environment, user behavior, third-party providers, vendor tooling, and the actions of threat actors.

3.2 Shared Responsibility

Cybersecurity is a shared responsibility between IMPACT and Client. While IMPACT performs the Cybersecurity Services expressly described in the executed Order, Client retains responsibility for its business operations, users, internal policies, data governance, identity and access controls, and overall security posture.

3.3 No Guarantee of Security or Outcomes

IMPACT does not warrant or guarantee:

  • that Incidents will not occur;

  • that any Detection capability will identify every threat or every Incident;

  • that any tooling will function without false positives, false negatives, or operational disruption;

  • that any specific business outcome, regulatory result, audit outcome, insurance outcome, or financial result will be achieved through the Cybersecurity Services.

The provisions of MSA Section 14 (Warranties & Disclaimers) apply in full to the Cybersecurity Services.

3.4 Best-Effort Detection

IMPACT performs Detection activities on a commercially reasonable, best-efforts basis using the Tooling, telemetry, and procedures described in the executed Order. Client acknowledges that:

  • Detection is dependent on the data sources, log feeds, telemetry, and Tooling deployed in Client's environment;

  • threat actors continuously evolve techniques designed to evade Detection;

  • not all threats produce observable signals;

  • some Incidents may be detected only after substantial dwell time, or not at all;

  • the absence of Detection alerts does not constitute a representation that no Incident has occurred.

3.5 Reliance on Third-Party Tooling

Cybersecurity Services rely on Tooling, telemetry sources, and threat-intelligence feeds provided by Third-Party Providers. IMPACT's ability to deliver Cybersecurity Services may be affected by:

  • changes in vendor tooling capabilities, pricing, or availability;

  • vendor outages or service degradation;

  • vendor modifications to detection logic or threat-intelligence feeds;

  • vendor end-of-life or end-of-support events;

  • limitations or defects in vendor products.

The provisions of MSA Section 11 (Third-Party Providers) apply in full to Tooling and Third-Party Provider services used in connection with Cybersecurity Services.

4. CYBERSECURITY MINIMUM ENVIRONMENT REQUIREMENTS

4.1 CMER Application

Client shall maintain its environment in compliance with the Cybersecurity Minimum Environment Requirements ("CMER") set forth in Schedule H for so long as IMPACT provides Cybersecurity Services.

The CMER are designed to establish the minimum technical and operational baseline necessary for IMPACT to deliver Cybersecurity Services effectively. The CMER are not intended as comprehensive cybersecurity controls or as a complete security program; they are the minimum prerequisites for IMPACT's services to function.

4.2 CMER Content

The CMER are set forth in Schedule H, which is maintained at the URL designated by IMPACT and published at the Schedules index. The version of Schedule H in effect as of the Effective Date of an Order applies to that Order, subject to the update mechanics of MSA Section 2.4.

4.3 Stacked Engagement — Required Standards Cross-Reference

Where Client also purchases Managed IT Services pursuant to the Managed IT Services Addendum, the Required Standards set forth in Schedule A apply concurrently with the CMER set forth in Schedule H. Where the same system, control, or configuration is addressed by both the Required Standards and the CMER, the more restrictive provision shall control. For clarity:

  • compliance with Required Standards does not relieve Client of the obligation to satisfy the CMER;

  • compliance with the CMER does not relieve Client of the obligation to satisfy the Required Standards under the Managed IT Services Addendum;

  • a Waiver of Standards under the Managed IT Services Addendum (Acknowledgment G.7) does not waive any CMER under this Addendum, and a Cyber Waiver under this Addendum (Acknowledgment G.23) does not waive any Required Standards under the Managed IT Services Addendum. Where a single condition deviates from both a Required Standard and a CMER, both Acknowledgments shall be invoked, and each applies to the full extent of its terms per Schedule G Section 1.3.

4.4 Standalone Engagement — Client IT Provider Coordination

Where Client purchases Cybersecurity Services without also purchasing Managed IT Services, Client shall be responsible for ensuring that Client's internal IT staff and any third-party IT providers:

  • maintain Client's environment in compliance with the CMER;

  • cooperate with IMPACT in good faith on tooling deployment, telemetry access, integration configuration, and incident-related activities;

  • promptly implement reasonable cybersecurity recommendations made by IMPACT or, where Client elects not to implement, promptly notify IMPACT and invoke Acknowledgment G.16 (Declination of IMPACT Recommendation), or, where the recommendation addresses a CMER, invoke a Cyber Waiver;

  • coordinate changes affecting the Cybersecurity Services with IMPACT in advance.

IMPACT shall not be responsible for the acts or omissions of Client's internal IT staff or third-party IT providers, and Client acknowledges that the effectiveness of Cybersecurity Services depends on the cooperation and competence of such personnel.

4.5 Updates to CMER

Schedule H may be updated from time to time. Updates, including material updates and Client's associated notice and termination rights, are governed by MSA Section 2.4.

4.6 Consequences of CMER Non-Compliance

Failure to comply with the CMER may result in any combination of the following, at IMPACT's discretion:

  • suspension of Service Level Targets applicable to affected Services;

  • requirement to invoke a Cyber Waiver;

  • classification of resulting work as Out-of-Scope Cybersecurity Services or Project work;

  • triggering of Project work pursuant to Section 12;

  • limitation, suspension, or termination of affected Cybersecurity Services pursuant to MSA Section 4;

  • limitation of IMPACT's responsibility and liability for Incidents arising from or related to the non-compliant condition.

4.7 Cyber Waiver of Standards

Where Client elects not to comply, or is unable to comply, with one or more CMER, IMPACT may, in its sole discretion, require Client to invoke a Cyber Waiver as a condition of providing or continuing Cybersecurity Services covering the affected system, account, data source, or environment. A Cyber Waiver is effected solely by invoking Acknowledgment G.23 in accordance with Section 1.3 of this Addendum and Schedule G Section 1.1.

The effects of a Cyber Waiver are those set forth in Acknowledgment G.23 and in Schedule G Section 1.4, which include Client's assumption of risk and liability for the Waived Requirements, suspension of Service Level Targets for affected Services and for any Incident caused or contributed to by the deviation, classification of resulting remediation as Out-of-Scope Cybersecurity Services or Project work, and Client's indemnification obligation.

IMPACT may decline to accept a Cyber Waiver where the non-compliant condition poses material risk to IMPACT's staff, systems, or other clients, or where the condition prevents IMPACT from delivering the Cybersecurity Services. A Cyber Waiver is not a negotiation of the CMER; it is Client's documented acceptance of risk arising from a deviation from the CMER. A Cyber Waiver applies only to the CMER it expressly identifies, does not waive any other CMER, and does not constitute a Waiver of Standards under the Managed IT Services Addendum.

4.8 Security Recommendations Are Advisory

Recommendations regarding cybersecurity controls, configurations, tooling, processes, or remediation provided by IMPACT in connection with the Cybersecurity Services are advisory in nature. Client retains ultimate responsibility for accepting or rejecting such recommendations, subject to the consequences set forth in this Section 4 and MSA Section 7.

Where Client declines, defers, or does not act on a recommendation that is not a CMER, Acknowledgment G.16 (Declination of IMPACT Recommendation) shall be invoked. Where the recommendation addresses a CMER, a Cyber Waiver is required pursuant to Section 4.7.

The provisions of MSA Section 7.6 (Security Recommendations Are Advisory) apply in full to recommendations provided in connection with Cybersecurity Services.

5. CYBERSECURITY RESPONSIBILITY ALLOCATION

5.1 Allocation Framework

The allocation of cybersecurity responsibility between IMPACT and Client under this Addendum is determined by reference to:

the Service categories expressly identified in the executed Order;

the scope of Tooling, telemetry, and systems covered under the executed Order;

the operational responsibilities described in this Section 5; and

the Service Catalog descriptions applicable to the purchased Services.

Where Client also purchases Managed IT Services, Assignment Zones designated under the Managed IT Services Addendum inform the allocation but do not control allocation under this Addendum, which is governed by the Service-specific scope of cybersecurity engagement.

5.2 IMPACT Responsibilities

Within the scope of Services purchased under an executed Order, IMPACT shall be responsible for:

  • delivering the specific Cybersecurity Services purchased, in accordance with the Service Catalog and applicable Order;

  • deploying, configuring, monitoring, and managing the Tooling identified in the Order, subject to Client cooperation and CMER compliance;

  • performing Detection and Initial Triage activities as described in the Order;

  • providing the advisory, reporting, and review activities described in the Order;

  • notifying Client of Detected events in accordance with the Order's notification procedures;

  • coordinating with Client's authorized contacts regarding Cybersecurity Services delivery.

IMPACT's responsibilities are limited to the Service categories expressly purchased and shall not extend to cybersecurity functions, tools, telemetry sources, or systems outside the scope of the executed Order.

5.3 Client Responsibilities

Within and outside the scope of Services purchased under an executed Order, Client shall be responsible for:

  • maintaining the CMER and any applicable Required Standards (where Managed IT Services are also purchased);

  • operating Client's overall IT environment, infrastructure, and systems (where Managed IT Services are not purchased from IMPACT);

  • managing Client's identity, authentication, and access-management programs, including provisioning and deprovisioning of user accounts and access rights;

  • security awareness, user behavior, and acceptable-use policy enforcement among Client's personnel;

  • physical security of Client's facilities, devices, and assets;

  • vendor and third-party risk management for vendors not within IMPACT's scope;

  • data governance, data classification, data retention, and backup administration (where not within IMPACT's scope);

  • incident-related business decisions, including legal, regulatory, customer, and public-relations decisions;

  • ransomware and cyber-extortion decisions, including whether to engage in ransom negotiations or make ransom payments (which IMPACT does not perform);

  • regulatory notification, breach reporting, and compliance obligations under applicable law;

  • maintaining cyber liability insurance pursuant to MSA Sections 7.4 and 19.2.

5.4 Out-of-Scope Cybersecurity Functions

For clarity, the following cybersecurity functions are not IMPACT's responsibility under this Addendum unless expressly purchased in an executed Order:

  • security functions performed by other vendors, internal IT staff, or specialized third parties not engaged by IMPACT;

  • security tools deployed by Client outside the scope of Tooling provided under the Order;

  • network segments, cloud accounts, applications, or systems not identified within the scope of the Order;

  • physical security, OT/ICS security, IoT security, or cyber-physical systems unless expressly included;

  • application-level security testing or remediation beyond the scope expressly purchased;

  • security operations on systems Client elects to retain as Unsupported Systems or Shadow IT.

5.5 No Assumption of Client Cybersecurity Function

Nothing in this Addendum shall be construed as IMPACT assuming the duties, obligations, or liabilities of Client's internal cybersecurity function, internal IT department, employees, or third-party providers, except as expressly stated in the executed Order. Engagement of vCISO services does not transfer the role of Client's Chief Information Security Officer to IMPACT or to any IMPACT individual; vCISO services are advisory, not custodial.

5.6 Coordination with Client's Other Vendors

Where Client engages other vendors with cybersecurity-relevant roles (including without limitation IT providers, cloud providers, software vendors, and other security vendors), Client shall:

  • inform IMPACT of the existence and scope of such engagements;

  • facilitate reasonable coordination between IMPACT and such vendors;

  • ensure that no such vendor takes actions that interfere with IMPACT's Cybersecurity Services or Tooling.

IMPACT shall not be responsible for the acts or omissions of Client's other vendors, and IMPACT's obligations are not expanded by virtue of Client's engagement of such vendors.

6. INCIDENT RESPONSE & IR RETAINER

6.1 Incident Response Framework

Incident Response under this Addendum is structured as follows:

(a) Initial Triage is included in Recurring Cybersecurity Services where expressly stated in the applicable Order, and consists solely of the activities defined in Section 1.8 (verification, preliminary scoping, notification);

(b) Incident Response activities beyond Initial Triage are not included in Recurring Cybersecurity Services and shall be performed only:

  • under an executed Incident Response Retainer pursuant to Section 6.2; or

  • as Project work pursuant to MSA Section 9 and Section 12 of this Addendum.

For clarity, Detection of an Incident does not obligate IMPACT to perform Incident Response activities beyond Initial Triage. Client's election of whether and how to engage IMPACT in Incident Response remains a Client decision, subject to Section 6.4.

6.2 IR Retainer

Where Client purchases an Incident Response Retainer as expressly identified in an executed Order, IMPACT shall pre-position Incident Response capability for Client's benefit, subject to the terms set forth in this Section and the applicable Order.

(a) Retainer hours. The IR Retainer shall include a specified number of pre-paid Incident Response hours, response time targets, and engagement terms as set forth in the applicable Order. Unused hours expire at the end of the retainer term unless otherwise stated in the Order.

(b) Hours consumption. Retainer hours are consumed by Incident Response activities, including investigation, containment, eradication, recovery support, forensic analysis, communications support, coordination with Client's incident response team, retained forensic firm, cyber insurer, regulator, or legal counsel, and related activities. Retainer hours may also be consumed, at IMPACT's discretion and subject to terms in the Order, by tabletop exercises, IR plan development, or pre-incident readiness activities.

(c) Hours exhaustion. When retainer hours are consumed in connection with an active Incident, IMPACT shall continue Incident Response activities subject to Client authorization for additional hours at IMPACT's then-current Incident Response rates. IMPACT shall not be obligated to continue Incident Response work without authorized funding.

(d) Response time targets. Response time targets associated with the IR Retainer represent operational objectives, not contractual commitments. The no-remedy character of Service Level Targets established in MSA Section 15.8 applies in full to IR Retainer response time targets. Failure to meet a response time target shall not constitute a breach of this Addendum.

(e) Standalone or stacked. The IR Retainer may be purchased standalone (as Client's only Cybersecurity Service) or stacked with other Cybersecurity Services. Where stacked, the IR Retainer covers Incident Response activities beyond the Initial Triage included in the underlying Cybersecurity Services.

6.3 Project-Based Incident Response (Without IR Retainer)

Where Client has not purchased an IR Retainer and an Incident occurs, Client may engage IMPACT to perform Incident Response activities as Project work pursuant to MSA Section 9 and Section 12 of this Addendum, subject to:

  • IMPACT's availability and resource capacity;

  • Client's authorization of Project work, scope, and fees in writing;

  • Payment of any required retainer or advance fee at IMPACT's discretion;

  • IMPACT's then-current Incident Response rates.

Client acknowledges that IMPACT cannot guarantee availability or response time for Project-based Incident Response, and that pre-purchase of an IR Retainer is the only mechanism by which IMPACT pre-positions capability for Client's Incidents.

6.4 Client Authority and Decision-Making During Incidents

During any Incident, Client retains sole authority and decision-making responsibility for:

  • engagement and scope of Incident Response activities;

  • engagement of legal counsel, forensic firms, public-relations advisors, and other third parties;

  • communications with regulators, customers, employees, business partners, and the public;

  • regulatory notifications, breach reporting, and compliance with notification obligations under applicable law;

  • decisions regarding ransomware, cyber-extortion, and ransom-payment negotiations, which IMPACT does not perform;

  • recovery, restoration, and business-continuity decisions;

  • insurance claim management and coordination with Client's cyber insurer.

IMPACT may provide advisory input on the foregoing within the scope of purchased Cybersecurity Services, but Client is the decision-maker. IMPACT does not act as Client's legal counsel, regulatory advisor, public-relations advisor, or insurance representative.

6.5 Cooperation During Incidents

In addition to the cybersecurity cooperation obligations set forth in MSA Section 5.6, during any Incident in which IMPACT is engaged in Incident Response (whether under an IR Retainer or as Project work), Client shall:

  • provide immediate access to systems, accounts, logs, backups, credentials, telemetry, and personnel necessary for IMPACT's Incident Response activities;

  • preserve evidence and refrain from altering affected systems without IMPACT's direction;

  • promptly authorize Incident Response actions reasonably recommended by IMPACT;

  • promptly authorize additional retainer hours or Project work where IMPACT advises that available hours are insufficient for the Incident scope;

  • maintain accurate and current emergency contact information;

  • not engage other Incident Response providers in a manner that interferes with IMPACT's work without prior coordination with IMPACT.

IMPACT shall not be liable for damages, delays, increased Incident scope, regulatory exposure, or other harm caused by Client's lack of cooperation, delayed authorization, or interference with IMPACT's Incident Response activities.

IMPACT recognizes that Incidents frequently involve coordination with Client's cyber insurer, panel counsel, retained forensic firm, regulator, or legal advisor. Where such coordination is required:

  • IMPACT shall reasonably cooperate with Client's designated representatives, subject to the scope of purchased Services and IMPACT's confidentiality, intellectual property, and privilege protections;

  • where Client's cyber insurer has approved-vendor or panel-counsel requirements that conflict with engagement of IMPACT, Client is responsible for resolving such conflicts with the insurer;

  • where Incident Response work is performed under direction of Client's legal counsel for purposes of preserving applicable privileges, the Parties shall reasonably coordinate to support such privilege claims, without IMPACT thereby assuming the role of legal advisor;

  • IMPACT does not represent that work performed under this Addendum will be covered by Client's cyber insurance, qualify for panel-counsel privilege, or satisfy any insurer-specific procedural requirements.

6.7 Forensic Activities and Evidence Handling

  • To the extent IMPACT performs forensic activities or evidence handling in connection with an Incident:

  • IMPACT shall use commercially reasonable methods consistent with the scope of purchased Services and applicable Tooling;

  • IMPACT does not represent that evidence collected, preserved, or analyzed will satisfy chain-of-custody, evidentiary, or admissibility standards required for litigation, regulatory proceedings, or law-enforcement matters unless such standards are expressly addressed in the Order;

  • where Client requires forensically rigorous evidence handling for litigation or regulatory purposes, Client should engage a specialized digital forensics firm and notify IMPACT of such engagement so that IMPACT's activities can be coordinated accordingly.

6.8 Limitation of Incident Response Liability

Incident Response activities are inherently uncertain, time-pressured, and dependent on factors outside IMPACT's control, including the actions of threat actors, the scope and dwell time of the Incident, the availability and integrity of Client's logs and backups, and Client's cooperation and decisions.

IMPACT does not warrant or guarantee:

  • the success of Incident Response activities;

  • complete eradication of threat actor presence;

  • prevention of data exfiltration that has already occurred;

  • recovery of encrypted, deleted, or compromised data;

  • prevention of regulatory exposure or insurance-coverage outcomes;

  • any specific business, financial, or operational result.

The provisions of MSA Section 14 (Warranties & Disclaimers), MSA Section 15 (Limitation of Liability), and Section 11 of this Addendum apply in full to Incident Response activities.

7. VIRTUAL CHIEF INFORMATION SECURITY OFFICER (vCISO) ADVISORY

7.1 Nature of vCISO Services

Where vCISO services are expressly identified in an executed Order, IMPACT shall provide strategic cybersecurity advisory services on a fractional basis, which may include:

  • security program development and governance support;

  • risk advisory and risk-register guidance;

  • policy and standards review and recommendations;

  • cybersecurity roadmap development;

  • board reporting and executive communications support;

  • regulatory and framework alignment advisory (HIPAA, CMMC, SOC 2, PCI-DSS, NIST, ISO/IEC 27001, NY DFS Part 500, and others);

  • incident-related strategic advisory;

  • cybersecurity awareness for Client leadership;

  • coordination with Client's internal IT, security, legal, and compliance personnel.

The specific scope, deliverables, hours, and engagement model shall be set forth in the applicable Order.

7.2 vCISO is Advisory Only

vCISO services are advisory in nature. Client retains all decision-making authority, operational responsibility, and accountability for cybersecurity program execution, control implementation, regulatory compliance, and security outcomes.

Engagement of vCISO services does not:

  • transfer the role, duties, or fiduciary obligations of Client's Chief Information Security Officer (or equivalent role) to IMPACT or to any IMPACT individual;

  • make IMPACT or any IMPACT individual a custodian, steward, or officer of Client;

  • constitute legal, regulatory, accounting, or insurance advice;

  • transfer responsibility for Client's compliance with applicable laws, regulations, or contractual obligations;

  • guarantee any specific cybersecurity outcome, audit result, regulatory result, or insurance-coverage outcome.

7.3 No Implied Operational Authority

vCISO advisory does not authorize IMPACT to make operational changes to Client's environment, execute security controls, or take action on Client's behalf except where expressly authorized by Client and within the scope of separately purchased operational Services.

7.4 Confidentiality, Privilege, and Sensitive Information

vCISO engagements frequently involve sensitive information, including security weaknesses, incidents, regulatory exposure, vendor performance issues, and personnel matters. The Parties shall:

  • treat vCISO communications and deliverables as Confidential Information under MSA Section 12;

  • coordinate, where appropriate, with Client's legal counsel to support applicable privilege claims, without IMPACT thereby assuming the role of legal advisor;

  • recognize that aggregated, anonymized, or derivative knowledge from vCISO engagements may be retained by IMPACT as Background IP under MSA Section 13.

7.5 vCISO Deliverables

vCISO deliverables (including reports, assessments, roadmaps, policies, and other written work product) are deemed Work Product upon full payment of applicable fees pursuant to MSA Section 13.4, subject to the IMPACT Background IP and Intellectual Property carve-outs in MSA Section 13.4.

Client acknowledges that vCISO deliverables represent professional advisory output and not a guarantee of any particular outcome. Client should independently validate vCISO recommendations with Client's legal counsel, compliance advisors, and other professional advisors as appropriate.

8. SECURITY AWARENESS TRAINING & PHISHING SIMULATION

8.1 Scope

Where Security Awareness Training & Phishing Simulation services are expressly identified in an executed Order, IMPACT shall provide user education programs, simulated phishing campaigns, training content delivery, and reporting as set forth in the Order.

8.2 Training Effectiveness Disclaimer

Client acknowledges and agrees that:

  • security awareness training and phishing simulation are designed to reduce the likelihood of user-driven security incidents but do not eliminate human-related risk;

  • users may fail to complete training, may complete training without retention, or may be successfully phished despite training;

  • the effectiveness of training depends on factors outside IMPACT's control, including Client's enforcement of training completion, user attentiveness, and the sophistication of evolving phishing techniques;

  • IMPACT does not warrant or guarantee any specific training-completion rate, phishing-failure rate, behavior change, or reduction in user-driven security incidents.

8.3 Phishing Simulation Authorization

Phishing simulation campaigns are conducted with Client's express authorization and in coordination with Client's authorized contacts. Client represents and warrants that:

  • Client has the authority to authorize phishing simulations targeting Client's users;

  • such simulations comply with Client's internal policies and applicable law;

  • Client has provided any required notices to users and has obtained any required consents;

  • Client will not pursue claims against IMPACT for user complaints, employee-relations issues, or other consequences arising from authorized simulation activities.

Client shall defend, indemnify, and hold harmless IMPACT for any claims by Client's users, employees, or third parties arising from phishing simulations conducted with Client's authorization.

8.4 User Communications and Customization

Phishing simulation campaigns are based on templates, scenarios, and difficulty levels provided by IMPACT or by Tooling vendors. Client may request customization within the limits of available Tooling. Custom scenarios involving Client-specific branding, partner names, or sensitive subject matter are Client's responsibility to approve in advance.

8.5 Training Content

Training content is provided through Tooling vendors and may be updated, replaced, or modified by such vendors from time to time. IMPACT does not warrant that training content satisfies any specific regulatory training requirement (such as HIPAA training mandates) unless expressly stated in the Order.

9. PENETRATION TESTING & VULNERABILITY ASSESSMENTS

9.1 Scope

Where Penetration Testing or Vulnerability Assessments are expressly identified in an executed Order, IMPACT (or IMPACT's designated assessment partner) shall perform the assessment activities described in the Order.

9.2 Authorization

Penetration testing and vulnerability assessment activities are conducted only under Client's express written authorization. Client represents and warrants that:

  • Client owns or has authority to authorize testing of all in-scope systems, applications, and networks;

  • testing of any third-party-hosted system has received any required authorization from the third-party provider;

  • testing complies with Client's contractual obligations to third parties, including without limitation cloud-provider terms of service that may restrict penetration testing;

  • Client has notified relevant internal personnel and authorized contacts of the testing window.

  • Client shall defend, indemnify, and hold harmless IMPACT from claims arising from Client's failure to obtain required authorizations or notifications in connection with testing activities.

9.3 Testing Risk Acknowledgment

Client acknowledges that penetration testing and vulnerability assessment activities involve inherent risks, including but not limited to:

  • service disruption or system instability;

  • data integrity issues;

  • triggering of security alerts at Client's organization or third parties;

  • temporary impact on system performance;

  • discovery of vulnerabilities that, once known, create disclosure and remediation obligations.

IMPACT shall use commercially reasonable methods to minimize disruption, but IMPACT does not warrant that testing activities will not result in disruption. Client agrees to maintain backups, recovery capability, and operational readiness during testing windows.

9.4 Reporting and Findings

Assessment findings are delivered in written reports that represent the assessment team's observations and conclusions as of the assessment date. Client acknowledges that:

  • findings represent a point-in-time view and do not warrant the absence of vulnerabilities outside the scope, timing, or methodology of the assessment;

  • absence of a finding does not constitute a representation that no vulnerability exists;

  • vulnerabilities may exist that were not discovered during the assessment due to scope, time constraints, methodology, evasion, or evolving threats;

  • remediation of findings is Client's responsibility unless expressly purchased as additional Project work.

9.5 Confidentiality of Findings

Assessment reports are highly sensitive Confidential Information of Client. The Parties shall handle assessment reports in accordance with MSA Section 12 (Confidentiality). Client shall control distribution of assessment reports and shall not redistribute IMPACT's reports to third parties (other than Client's legal counsel, auditors, regulators, insurers, or advisors subject to confidentiality obligations) without IMPACT's prior written consent.

9.6 No Compliance Certification

Penetration testing and vulnerability assessments do not constitute compliance certification, audit opinions, or attestation under any framework unless expressly stated in the Order. Where Client requires framework-specific testing (such as PCI-DSS ASV scans, HIPAA security risk assessments, or CMMC assessment activities), the Order shall expressly identify the applicable framework requirements.

10. CYBERSECURITY-SPECIFIC INDEMNIFICATION TRIGGERS

10.1 Additive Client Indemnification Obligations

In addition to the indemnification obligations set forth in MSA Section 16, and in addition to any indemnification obligations under any other Addendum, Client shall defend, indemnify, and hold harmless the IMPACT Indemnitees from and against any and all claims, demands, causes of action, damages, losses, liabilities, penalties, fines, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to:

  • Client's failure to comply with the Cybersecurity Minimum Environment Requirements;

  • Client’s invocation of a Cyber Waiver by Client;

  • Client's deployment, use, or retention of Shadow IT, Unsupported Systems, or other systems outside the scope of Cybersecurity Services;

  • failure of Client's internal IT staff or third-party IT providers to cooperate with IMPACT, to maintain the CMER, or to implement reasonable cybersecurity recommendations;

  • Client's decisions during an Incident, including without limitation legal, regulatory, customer, public-relations, ransomware, ransom-payment, recovery, restoration, business-continuity, and insurance-coordination decisions;

  • Client's authorized phishing simulation activities and any user, employee, or third-party claims arising therefrom;

  • Client's authorization of penetration testing or vulnerability assessment activities, including failure to obtain required authorizations from third parties or to comply with applicable terms of service;

  • Client's failure to maintain cyber liability insurance pursuant to MSA Sections 7.4 and 19.2;

  • Client's failure to identify an applicable regulatory framework or to request execution of a required supplemental agreement under MSA Sections 5.8 and 8.3 prior to disclosing regulated data or engaging IMPACT in services subject to such framework;

  • Client's reliance on IMPACT's advisory output, including vCISO recommendations, security recommendations, assessment findings, or Detection alerts, in lieu of independent verification or professional advice from Client's legal, compliance, audit, or insurance advisors;

  • ransomware payments, cryptocurrency transactions, or sanctions-related exposure arising from Client's decisions during an Incident.

This indemnification obligation shall apply regardless of whether such claims arise from alleged negligence, except to the extent caused by IMPACT's gross negligence or willful misconduct.

10.2 Coordination with MSA

The indemnification obligations set forth in this Section 10 are additive to, and do not replace, the indemnification obligations set forth in MSA Section 16 and any other applicable Addendum. The procedural requirements, indemnity allocations, subrogation provisions, insurance coordination, and limitation-of-liability coordination set forth in MSA Sections 15 and 16 apply to the indemnification obligations set forth in this Addendum.

11. CYBERSECURITY-SPECIFIC LIABILITY ALLOCATIONS

11.1 Additional No-Liability Categories

In addition to the no-liability categories set forth in MSA Section 15.9 and any other applicable Addendum, and subject to the uncapped liability carve-outs set forth in MSA Section 15.2(c), IMPACT shall have no liability for claims, damages, or losses arising from or related to:

  • Incidents that occur, are exacerbated, or evade Detection due to Client's non-compliance with the CMER;

  • Incidents that occur, are exacerbated, or evade Detection due to Shadow IT, Unsupported Systems, or systems outside the scope of Cybersecurity Services;

  • Incidents that occur, are exacerbated, or evade Detection due to acts or omissions of Client's internal IT staff, third-party IT providers, or other vendors not engaged by IMPACT;

  • Client's election not to purchase an Incident Response Retainer, or unavailability of Project-based Incident Response capacity;

  • IR Retainer hours exhaustion where Client does not authorize additional hours or Project work;

  • Client's decisions or delays during Incidents, including without limitation authorization delays, legal/regulatory decisions, ransomware decisions, recovery decisions, and insurance-coordination decisions;

  • ransom payments made by Client, sanctions-related exposure arising from such payments, or any consequences of cryptocurrency transactions;

  • regulatory fines, penalties, or coverage outcomes arising from Client's compliance posture, notification timing, or insurer-relations decisions;

  • losses recoverable under Client's cyber liability insurance, subject to the Insurance Offset set forth in MSA Section 16.5(b);

  • Detection failures arising from Tooling vendor defects, vendor outages, vendor configuration changes, or evolution of threat-actor evasion techniques;

  • false positives, false negatives, or operational disruption arising from cybersecurity Tooling;

  • assessment findings (or absence of findings) that fail to identify a particular vulnerability that subsequently contributes to an Incident;

  • security awareness training outcomes, including users who fail simulations or training assessments and subsequently contribute to user-driven Incidents;

  • penetration testing outcomes, including service disruption, data integrity issues, or post-test exposures arising from disclosed vulnerabilities prior to remediation;

  • forensic findings, evidence-handling outcomes, or admissibility outcomes where IMPACT was not expressly engaged for litigation-grade forensics;

  • Client's reliance on vCISO advisory output without independent professional validation;

  • cybersecurity outcomes affected by parallel engagement of other cybersecurity vendors, internal IT staff, or third-party IT providers operating outside coordination with IMPACT.

11.2 Coordination with MSA

The no-liability categories set forth in this Section 11 are additive to, and do not replace, the limitation of liability provisions set forth in MSA Section 15. The Default Cap, Super-Cap, and uncapped categories set forth in MSA Section 15.2 apply to all claims subject to this Addendum.

11.3 Allocation of Cybersecurity Risk

Client expressly acknowledges and agrees that:

  • the fees charged by IMPACT for Cybersecurity Services reflect the limited and defined scope of Services purchased and the allocation of cybersecurity risk set forth in this Addendum and the MSA;

  • cybersecurity damages may significantly exceed the fees paid for Cybersecurity Services, and the limitations of liability set forth herein represent a deliberate, negotiated allocation of risk between the Parties;

  • Client is in the best position to insure against cybersecurity risk through cyber liability insurance and through internal risk-management practices;

  • the allocation of risk set forth in this Addendum and the MSA is a material inducement for IMPACT to provide Cybersecurity Services;

  • IMPACT would not provide Cybersecurity Services without the limitations of liability set forth herein.

12. CYBERSECURITY-SPECIFIC PROJECT TRIGGERS

12.1 Conditions That Trigger Project Work

In addition to the Project examples and authorization mechanics set forth in MSA Section 9, the following conditions shall trigger Project work pursuant to MSA Section 9 and a separate SOW or Order:

  • onboarding of Cybersecurity Services, including Tooling deployment, integration, baseline configuration, and tuning beyond routine implementation included in Recurring Cybersecurity Services;

  • environment remediation required to bring Client into compliance with the CMER;

  • migrations, upgrades, or platform changes affecting Tooling or systems within the scope of Cybersecurity Services;

  • Incident Response activities beyond Initial Triage where Client has not purchased an IR Retainer (per Section 6.3);

  • Incident Response activities exceeding available IR Retainer hours where Client authorizes additional work (per Section 6.2(c));

  • forensic investigation, evidence preservation, or litigation-support activities beyond Initial Triage;

  • recovery, restoration, or business-continuity remediation following an Incident;

  • compliance and audit readiness preparation, evidence-gathering, or attestation support beyond Recurring vCISO advisory;

  • penetration testing, vulnerability assessments, red-team engagements, or specialized assessments beyond those expressly purchased in Recurring Services;

  • security architecture or design consulting beyond routine vCISO advisory;

  • significant changes to Client's environment, headcount, regulatory posture, or business operations that materially affect the scope of Cybersecurity Services;

  • remediation following a Cyber Waiver where Client elects to bring the previously waived condition into compliance;

  • work necessitated by Client-caused conditions, third-party-vendor changes, Shadow IT discovery, or Unsupported Systems remediation.

12.2 No Implied Project Authorization

The conditions set forth in Section 12.1 identify when Project work may be required; they do not constitute authorization to perform Project work. Project work shall be authorized only pursuant to MSA Section 9.2.

12.3 Coordination with MSA

The Project triggers set forth in this Section 12 are additive to, and do not replace, the Projects framework set forth in MSA Section 9. All Project authorization, scope control, billing, and termination provisions of MSA Section 9 apply to Projects performed under this Addendum.

13. SERVICE LEVEL TARGETS

13.1 Schedule B Application

Service Level Targets applicable to Cybersecurity Services are set forth in Schedule B, which is structured as a global Service Level Targets schedule with sections corresponding to specific service lines. The Cybersecurity Services section of Schedule B applies to Services delivered under this Addendum, subject to the conditional-application provisions of Section 13.3 of this Addendum.

13.2 No Remedy

Service Level Targets are advisory operational objectives only and do not constitute contractual commitments, performance warranties, or guaranteed outcomes. The no-remedy character of Service Level Targets established in MSA Section 15.8 applies in full to all Service Level Targets set forth in Schedule B, including those applicable to Cybersecurity Services and including any IR Retainer response time targets identified in an Order. Failure to meet any Service Level Target shall not constitute a breach of this Addendum or the MSA, shall not give rise to service credits, refunds, damages, termination rights, or any other remedy, and shall not be asserted as a basis for any claim against IMPACT.

13.3 Conditional Application

Service Level Targets applicable to Cybersecurity Services apply only to:

  • Cybersecurity Services expressly included in an executed Order;

  • systems, accounts, and data within the scope of the executed Order;

  • environments in compliance with the Cybersecurity Minimum Environment Requirements;

  • environments not subject to a Cyber Waiver or any other Acknowledgment invoked under Schedule G that suspends Service Level Targets;

  • where Managed IT Services are also purchased, environments in compliance with the Required Standards set forth in Schedule A;

  • engagements where Client is providing the cooperation, access, telemetry, and authorization required for IMPACT to deliver the Services.

Where any of the foregoing conditions is not satisfied, Service Level Targets are suspended for the affected Services, environments, or systems.

13.4 Detection-Specific SLT Limitations

Client acknowledges that Detection-related Service Level Targets (such as alert review timing, notification timing, or triage timing) are operational objectives subject to the limitations set forth in Section 3.4 (Best-Effort Detection). Compliance with Detection-related Service Level Targets does not constitute a representation that all Incidents have been detected, that Detection is comprehensive, or that the absence of alerts means no Incident has occurred.

13.5 IR Response Time Targets

Where an IR Retainer is purchased, response time targets associated with the IR Retainer are operational objectives subject to the no-remedy character of Service Level Targets established in MSA Section 15.8. Response time targets:

  • represent the time within which IMPACT will use commercially reasonable efforts to engage in Incident Response activities;

  • are dependent on Client's prompt notification, authorization, and cooperation;

  • may be affected by concurrent Incidents, IR resource availability, and circumstances outside IMPACT's reasonable control;

  • do not guarantee containment, eradication, recovery, or any specific Incident-related outcome.

14. CYBERSECURITY-SPECIFIC TERMINATION CONSIDERATIONS

14.1 General Termination Framework

Termination of Cybersecurity Services is governed by MSA Section 4. The provisions of this Section 14 supplement, and do not replace, MSA Section 4.

14.2 Tooling Removal and License Termination

Upon termination or expiration of an Order for Cybersecurity Services:

  • IMPACT may remove, deactivate, or transfer Tooling deployed in Client's environment as appropriate, subject to vendor terms and Client cooperation;

  • Tooling licenses procured by IMPACT for Client's use shall terminate or transition in accordance with the applicable vendor terms;

  • Client is responsible for any vendor-imposed transition fees, license-transfer fees, or early-termination fees imposed by Tooling vendors;

  • Client acknowledges that removal of Tooling may result in a degradation of Client's cybersecurity posture and that Client is responsible for arranging replacement security capability prior to termination.

14.3 Detection Data, Logs, and Telemetry

Detection data, logs, telemetry, alerts, reports, and related operational records generated in connection with Cybersecurity Services are subject to the data-retention provisions of MSA Section 4.9. Client acknowledges that:

  • IMPACT's standard retention practices apply, and IMPACT is not obligated to retain Detection data beyond such practices for Client's benefit unless Client has separately purchased an extended-retention Service;

  • post-termination access to Detection data is subject to MSA Section 4.10 (Post-Termination Forensic Cooperation);

  • Detection data is provided in IMPACT's standard format and IMPACT is not obligated to provide Detection data in proprietary, normalized, or specialized export formats unless expressly purchased.

14.4 Active Incident at Termination

Where Client has terminated this Addendum or an applicable Order while an Incident is active or under investigation:

  • IMPACT may, in its discretion, continue Incident Response activities under the existing IR Retainer or Project authorization until the immediate Incident is contained, subject to continued payment;

  • Client acknowledges that termination during an active Incident may impair IR effectiveness, and IMPACT shall have no liability for IR outcomes affected by termination timing;

  • IMPACT may, in its discretion, decline to continue any Incident-related work past the effective date of termination if outstanding balances are not paid in full;

  • post-termination Incident-related cooperation is subject to MSA Section 4.10 (Post-Termination Forensic Cooperation).

14.5 Suspension of Cybersecurity Services

In addition to the suspension grounds set forth in MSA Section 4.5, IMPACT may suspend Cybersecurity Services if:

  • Client's CMER non-compliance materially impairs IMPACT's ability to deliver Services;

  • Client fails to maintain cyber liability insurance pursuant to MSA Sections 7.4 and 19.2;

  • Client engages in actions that materially interfere with Tooling operation or Detection capability;

  • Client refuses to cooperate with Incident-related activities reasonably required to contain risk to IMPACT, Client, or third parties.

Suspension shall not excuse Client's payment obligations.

15. SURVIVAL

The provisions of this Addendum shall survive termination or expiration of the MSA to the extent necessary to enforce rights, obligations, and remedies arising during the term, including provisions relating to:

  • CMER compliance and Cyber Waiver consequences;

  • Client decisions and authority during Incidents;

  • ransomware, ransom-payment, and sanctions-related risk allocation;

  • IR Retainer hour consumption, exhaustion, and post-termination obligations;

  • forensic activities, evidence handling, and litigation-grade engagement disclaimers;

  • vCISO advisory output and reliance;

  • phishing simulation authorization and indemnification;

  • penetration testing authorization and indemnification;

  • assessment findings and confidentiality of reports;

  • cybersecurity-specific indemnification triggers;

  • cybersecurity-specific liability allocations;

  • cybersecurity-specific Project triggers;

  • Tooling removal, license transition, and active-Incident termination handling;

  • post-termination cooperation pursuant to MSA Section 4.10.

The survival provisions set forth in MSA Section 23.11 apply to this Addendum.

16. EXECUTION AND EFFECTIVENESS

This Addendum becomes effective on the Order Effective Date of the first Order referencing it and requires no separate signature page. Where this Addendum is delivered as a supplemental document with an Order executed by Client, Client's execution of that Order constitutes Client's execution of this Addendum. This Addendum binds the Parties with the same force and effect as if separately executed.

End of Addendum