Cyber Secure Online Service Agreement | Always-On Guard STATEMENT OF WORK

1. Introduction This Statement of Work ("SOW") is made effective as of [DATE], by and between Cyber Secure Online, LLC ("CSO") and [Client Name] ("Client"), and is incorporated into and governed by the Service Agreement between the parties dated [DATE of Service Agreement].

1.1 Purpose This SOW outlines the specific scope of services to be provided by CSO to Client under the "Always-On Guard" offering, a fully integrated cybersecurity solution comprising 14 security modules designed to provide comprehensive protection against a wide range of cyber threats. This SOW details the modules included, implementation plan, service levels, and client responsibilities to ensure the successful deployment and ongoing operation of Always-On Guard.

1.2 Always-On Guard: Fully Integrated Solution Always-On Guard is a proactive, adaptive, and comprehensive cybersecurity platform designed to provide multi-layered protection for Client's IT infrastructure. It encompasses a suite of 14 interconnected security modules that work synergistically to detect, prevent, and respond to evolving cyber threats.

These modules include:

Endpoint Detection and Response (EDR): Continuous, real-time monitoring of all endpoints (desktops, laptops, servers) for suspicious activity using behavioral analysis, threat intelligence, and machine learning. Includes automated response capabilities such as isolating infected endpoints, killing malicious processes, and restoring files to a safe state.

Firewall Management: As part of the Always-On Guard suite, CSO provides firewall management services utilizing the Application and Console to configure and maintain a robust firewall solution for the Client. CSO services is designed to prevent unauthorized network access, align with industry best practices, and maintain compliance. CSO does not collect any personal web browsing information. The client will need to provide external vendor details, such as cloud and internet service providers.

Intrusion Detection System (IDS): Real-time monitoring of network traffic for malicious activity, policy violations, and anomalous behavior. Includes signature-based and anomaly-based detection methods.

Vulnerability Scanning: Vulnerability Scanning: CSO, through the Always-On Guard Console, will conduct regular vulnerability scans of Client's systems to identify known security weaknesses. Scanning will occur on a [FREQUENCY - e.g., weekly, monthly, quarterly] basis, and will be conducted using industry-standard vulnerability scanning tools. Reports will be provided to Client, detailing identified vulnerabilities, their severity level, and recommended remediation steps. It is the Client's responsibility to address identified vulnerabilities in a timely manner. CSO does not warrant that all vulnerabilities will be detected, and is not responsible for damages resulting from unpatched vulnerabilities.

Security Information and Event Management (SIEM): Security Information and Event Management (SIEM): The Always-On Guard SIEM module provides centralized log collection, aggregation, and analysis of security events from various sources within the Client's IT environment, including network devices, servers, endpoints, and security applications. This data is correlated and analyzed to identify potential security incidents, anomalies, and policy violations. CSO will configure and maintain the SIEM module, develop custom correlation rules tailored to the Client's environment, and provide incident alerts based on pre-defined thresholds. The Client will be responsible for providing access to relevant log sources and for responding to and remediating incidents identified by the SIEM. CSO does not guarantee the detection of all security incidents and is not liable for damages resulting from undetected or unresolved incidents.

Antivirus and Anti-Malware: Antivirus and Anti-Malware: The Always-On Guard solution incorporates comprehensive antivirus and anti-malware protection designed to prevent, detect, and remove malicious software from Client's systems. This module provides real-time scanning, scheduled scans, and behavioral analysis to identify and neutralize a wide range of threats, including viruses, worms, Trojans, ransomware, spyware, and adware. CSO will configure and maintain the antivirus/anti-malware software through the Always-On Guard Console, ensuring it is up-to-date with the latest threat definitions. The Client is responsible for ensuring that all endpoints are properly configured and that users do not disable or circumvent the antivirus/anti-malware protection. CSO does not guarantee the prevention of all malware infections and is not liable for damages resulting from malware infections that occur despite the implementation of this module.

Web Filtering: The Always-On Guard solution provides VPN (Virtual Private Network) and Web Filtering capabilities to enhance Client's security posture. The Web Filtering component blocks access to malicious, inappropriate, or non-compliant websites, based on pre-defined categories and custom rules managed through the Always-On Guard Console. This helps prevent malware infections, phishing attacks, and other web-based threats. The VPN component, when enabled by the Client, encrypts internet traffic and masks the Client's IP address, providing secure remote access to corporate resources and protecting sensitive data from interception. The Client is responsible for configuring and enforcing VPN usage policies, and for ensuring that users comply with web filtering guidelines. CSO does not monitor the content of VPN traffic and is not liable for Client's failure to enforce appropriate VPN usage.

Email Security: The Always-On Guard Email Security module provides comprehensive protection against email-borne threats, including phishing attacks, malware attachments, spam, and business email compromise (BEC). This module utilizes advanced filtering techniques, threat intelligence, and behavioral analysis to identify and block malicious emails before they reach the Client's users. CSO will configure and maintain the Email Security module through the Always-On Guard Console, customize filtering rules based on the Client's specific needs, and provide regular reports on blocked threats. The Client is responsible for educating its users about phishing awareness and for reporting any suspicious emails that bypass the filtering system. CSO does not guarantee the prevention of all email-based attacks and is not liable for damages resulting from attacks that occur despite the implementation of this module. The client should provide all pertinent details of existing Email Protection solutions already in place.

Data Loss Prevention (DLP): The Always-On Guard Data Loss Prevention module is designed to protect sensitive data from unauthorized access, sharing, or exfiltration. This module monitors and controls data flows across endpoints, email systems, cloud applications, and networks to ensure compliance with regulatory requirements and internal security policies. DLP policies can be customized to detect and block the transmission of sensitive information, such as personally identifiable information (PII), financial data, or intellectual property. CSO will configure and maintain the DLP module through the Always-On Guard Console, providing alerts and reports on policy violations. The Client is responsible for defining data classification standards and ensuring employees are trained on proper data handling practices. CSO does not guarantee the prevention of all data breaches or unauthorized disclosures and is not liable for damages resulting from such events.

Mobile Device Management (MDM): The Always-On Guard Mobile Device Management (MDM) module enables secure management and control of mobile devices (smartphones and tablets) accessing Client's corporate resources. This module provides features such as device enrollment, configuration management, policy enforcement, remote wipe, and location tracking. CSO will configure and manage the MDM module through the Always-On Guard Console, ensuring compliance with Client's mobile security policies. The Client is responsible for enrolling devices in the MDM system and for communicating MDM policies to their users. CSO is not responsible for any loss of data or functionality resulting from the implementation of MDM policies, and the client must seek authorization prior to implementation.

Security Awareness Training: As part of the Always-On Guard solution, CSO will provide access to security awareness training modules designed to educate Client's employees about cybersecurity best practices and common threats. Training will cover topics such as phishing awareness, password security, malware prevention, data protection, and social engineering. CSO will make training modules available through an online platform and track employee completion rates. The Client is responsible for ensuring that all employees complete the assigned training modules and for promoting a security-conscious culture within the organization. CSO does not warrant that training will prevent all security incidents and is not liable for damages resulting from employee negligence or failure to follow security best practices. The client may have CSO perform training for an additional fee, determined at a later date.

Compliance Reporting: The Always-On Guard solution includes a Compliance Reporting module designed to assist Clients in meeting various industry and regulatory compliance requirements (e.g., HIPAA, PCI DSS, GDPR, [Add other relevant regulations]). This module generates reports and dashboards that provide visibility into the Client’s security posture and demonstrate adherence to specific compliance controls. Reports may include information on vulnerability status, security event logs, policy compliance, and user activity. CSO will configure and maintain the Compliance Reporting module through the Always-On Guard Console, customizing reports as needed to align with Client’s specific compliance needs. The Client is responsible for understanding their compliance obligations and for using the generated reports to take appropriate action to maintain compliance. CSO does not guarantee compliance with any specific regulation and is not liable for any penalties or fines resulting from non-compliance.

Threat Intelligence: The Always-On Guard Threat Intelligence module provides proactive identification and analysis of emerging cyber threats, vulnerabilities, and attack patterns. This module aggregates threat data from various sources, including commercial threat feeds, open-source intelligence, and CSO's internal research. This information is used to enhance the detection capabilities of other Always-On Guard modules, such as SIEM, Antivirus, and Intrusion Detection, and to provide Clients with actionable insights for improving their security posture. CSO will maintain the Threat Intelligence module, ensuring it is up-to-date with the latest threat data and trends. The Client is responsible for reviewing threat intelligence reports and alerts and for taking appropriate action to mitigate identified risks. CSO does not guarantee the prevention of all cyberattacks and is not liable for damages resulting from attacks that occur despite the implementation of this module. The Client should provide relevant and existing history and data if they have it available.

Breach and Attack Simulation (BAS): Breach and Attack Simulation (BAS): The Always-On Guard Breach and Attack Simulation (BAS) module allows the Client to proactively assess and improve their security posture by simulating real-world attack scenarios. This module conducts automated simulations of various attack techniques, such as malware execution, lateral movement, and data exfiltration, to identify vulnerabilities and weaknesses in the Client's defenses. CSO will configure and manage the BAS module through the Always-On Guard Console, customize simulations to reflect the Client's specific environment and threat landscape, and provide detailed reports on simulation results and remediation recommendations. The Client is responsible for reviewing simulation reports and for implementing recommended security improvements. CSO does not guarantee that simulations will identify all possible attack vectors and is not liable for damages resulting from successful attacks that bypass the simulated defenses.

2. Client Objectives

The deployment of Always-On Guard is intended to achieve the following objectives for the Client:

·       Reduced Incident Risk: Decrease the number of successful cyberattacks and data breaches by [Quantifiable Percentage, e.g., 25%] within [Timeframe, e.g., 12 months] of Always-On Guard implementation, as measured by a reduction in security incidents reported through the SIEM and incident response processes.

·       Enhanced Regulatory Adherence: Facilitate meeting industry and regulatory compliance requirements (e.g., HIPAA, PCI DSS, GDPR) by generating compliance reports through the Always-On Guard Console, demonstrating adherence to specific security controls relevant to the Client's industry and obligations. Note: CSO does not guarantee compliance; the Client remains responsible for understanding and meeting their specific compliance obligations.

·       Improved Threat Response: Reduce the mean time to detect (MTTD) and mean time to respond (MTTR) to security threats by [Quantifiable Percentage, e.g., 30%] within [Timeframe, e.g., 6 months] of Always-On Guard implementation, as measured by the SIEM and incident response data.

·       Optimized Security Operations: Streamline security operations by automating [Specific Tasks, e.g., vulnerability scanning, patch management, threat intelligence analysis] using Always-On Guard's capabilities, reducing the manual effort required by internal IT staff by [Quantifiable Metric, e.g., X hours per week].

·       Increased Security Visibility: Gain enhanced visibility into the organization's security posture by leveraging the Always-On Guard Console's reporting and dashboard features, providing real-time insights into [Specific Metrics, e.g., endpoint security status, network traffic patterns, user activity].  

3. Scope of Services

3.1 Always-On Guard: Foundational Protection Plans

·       (Included in Base Price of $129/User/Month): Provides a comprehensive suite of security measures designed to protect the Client's endpoints and network from a wide range of cyber threats. This includes [List Key Features Offered in this tier, e.g., Antivirus/Anti-Malware, Basic Firewall Management, Vulnerability Scanning, Basic Web Filtering]. CSO will configure and manage these core security features through the Always-On Guard Console, helping to prevent unauthorized access, detect and remove malware, and mitigate common security risks.

·       Note: Always-On Guard Foundational Protection Plans are subject to the limitations outlined in the Terms of Use, including the "No Warranty" and "Limitations of Liability" sections. The client is responsible for maintaining their systems and adhering to security best practices.

·       Value Proposition: Establishes a strong security foundation, reducing the risk of common cyber threats and providing peace of mind.

3.2 DataSafe: Industry Compliance & Policy Enforcement

·       (Additional Service - Requires Separate Purchase): Offers advanced data protection and compliance features designed to help the Client meet industry-specific regulatory requirements [List examples, e.g., HIPAA, CMMC, PCI DSS, GDPR]. This includes [List Key Features Offered, e.g., Data Loss Prevention (DLP), Advanced Web Filtering, Mobile Device Management (MDM), Compliance Reporting]. CSO will assist the Client in configuring and managing these features through the Always-On Guard Console, enabling them to enforce data security policies, monitor data flows, and generate compliance reports.

·       Note: DataSafe is intended to assist with compliance efforts but does not guarantee compliance with any specific regulation. The Client remains responsible for understanding and meeting their compliance obligations. Pricing for DataSafe is in addition to the base Always-On Guard Foundational Protection Plan.

·       Value Proposition: Simplifies compliance efforts, protects sensitive data, and reduces the risk of regulatory penalties.

3.3 Domain and Email Threat Alerts

·       (Additional Service - Requires Separate Purchase): Provides proactive monitoring and alerting for potential threats targeting the Client's domain and email infrastructure. This includes [List Key Features Offered, e.g., Domain Monitoring, Email Security, Threat Intelligence Feeds, Phishing Protection]. CSO will leverage threat intelligence feeds and advanced analysis techniques to identify suspicious activity and notify the Client of potential threats in a timely manner.

·       Note: CSO does not guarantee the prevention of all domain or email-based attacks. The Client is responsible for taking appropriate action to mitigate identified risks. Pricing for Domain and Email Threat Alerts is in addition to the base Always-On Guard Foundational Protection Plan.

·       Value Proposition: Reduces the risk of phishing attacks, malware infections, and other email-borne threats, protecting critical communication channels.

3.4 Dark Web Cyber Threat Surveillance

·       (Additional Service - Requires Separate Purchase): Offers continuous monitoring of the dark web for mentions of the Client's organization, sensitive data, or compromised credentials. This includes [List Key Features Offered, e.g., Dark Web Monitoring, Data Breach Detection, Credential Monitoring, Threat Intelligence Reporting]. CSO will provide regular reports on identified threats and recommend steps to mitigate potential risks.

·       Note: The effectiveness of dark web monitoring depends on the availability of data and the completeness of information on the dark web. CSO does not guarantee the detection of all compromised credentials or sensitive data. Pricing for Dark Web Cyber Threat Surveillance is in addition to the base Always-On Guard Foundational Protection Plan.

·       Value Proposition: Provides early warning of potential data breaches and compromised credentials, enabling proactive mitigation of cyber threats.

4. Implementation Plan

4.1 Initial Consultation and Needs Assessment:

·       The implementation process begins with a no-cost, personalized consultation to understand the Client's specific business objectives, security challenges, existing infrastructure, and compliance requirements.

·       During this consultation, CSO will gather information about the Client's current security posture, identify potential vulnerabilities, and discuss the Client's expectations for the Always-On Guard solution.

·       The Client will be responsible for providing accurate and complete information about their IT environment and security needs during this assessment.  

4.2 Trial Activation and Solution Configuration:

·       Upon completion of the initial consultation, the Client will be offered a 14-day free trial of the Always-On Guard platform to experience its enterprise-level cyber protection capabilities with no obligation.

·       During the trial period, CSO will collaborate with the Client's IT team to configure the Always-On Guard solution to meet their specific business requirements. This may include setting up security policies, configuring monitoring parameters, and integrating with existing IT systems.

·       The Client will be responsible for providing CSO with the necessary access and permissions to configure the Always-On Guard solution during the trial period. 1.5.3 Collaborative Customization and Training:

·       Throughout the trial period, CSO will work closely with the Client's team to ensure that the Always-On Guard solution aligns with their business needs and addresses their specific security concerns.

·       CSO will provide training and support to the Client's IT staff to enable them to effectively manage and utilize the Always-On Guard platform. The Client will need to cover any additional cost related to training.

·       The Client will be responsible for actively participating in the customization process and for ensuring that their IT staff attend the training sessions.  

4.3 Decision and Contract Agreement:

·       At the conclusion of the trial period, the Client will have the opportunity to make an informed decision about whether to proceed with a full implementation of the Always-On Guard solution.

·       If the Client chooses to proceed, a formal contract agreement will be executed, outlining the scope of services, pricing, payment terms, and other relevant details, as per the Terms of Use.  

4.4 Full Implementation and Ongoing Support:

·       Upon execution of the contract agreement, CSO will commence the full implementation of the Always-On Guard solution, including the deployment of all agreed-upon modules and features.

·       CSO will provide ongoing technical support and maintenance services in accordance with the terms of the agreement.

·       The Client will be responsible for maintaining their systems and adhering to the security policies and procedures established during the implementation process.  

5. Service Level Agreements

Customers will be entitled to receive support according to the features and benefits provided under the applicable offering, subject to the terms and conditions of this Agreement. For customers covered under Always-On Guard Foundational Protection Plans, technical support includes access to product update releases, related documentation, and knowledge articles upon general commercial release, and access to support representatives who will work with the customer to diagnose issues and provide Problem Resolutions, including escalating the issue through Level 2 Support.

Support Availability for First Response

Level 1 - Up to 1 Hour – (Business Hours)

Level 2 - Up to 2 business days

Level 3 - Up to 3 Business Days

 5.1 Service Level Procedures

When a customer makes initial contact with support, a technical representative or web service request tool will validate customer and contract information, workspace id, and gather details relevant to the issue. A unique ticket number will be assigned and delivered to the customer's designated contact via web request or email. This ticket number will be used to track the issue from initial contact to final problem resolution.

5.2 Service Level – Escalation Process and Procedure

(a) Customer-initiated Escalation: When work items (especially those associated with critical situations) need to be expedited, the customer shall notify us of the critical situation. If the support representative determines that sufficient information has been provided by the customer and the escalation is accepted, they will work with the customer on providing the appropriate solution. The escalation begins in accordance with standard business practices.

(b) Internal Escalation Process: When a support representative determines that an issue needs internal escalation, the issue receives increasing levels of engineering expertise and managerial attention in accordance with standard business practices, except for the case of a customer-initiated escalation.

(c) Management Escalation: If an issue is not resolved, or if it requires managerial attention, the customer can request the support representative to connect with the support manager or contact the support manager directly using the contact information provided at the bottom of the ticket email. Regardless of the elapsed time of the outstanding ticket, escalation should be initiated at the support representative level and then escalated to the support manager.  

6. Managed Services and Managed Detection and Response

Managed Services and Managed Detection and Response (MDR) services, powered by the Always-On Guard Platform, offer comprehensive cybersecurity solutions to protect your organization. We provide ongoing monitoring, prompt remote remediation of suspected security incidents, and multiple data sources analysis through a single platform.

6.1 Managed Services (MS) means the offer of Services provided by Cyber Secure Online for the continuous monitoring of all tickets produced by the modules you have chosen, manual remediation where relevant, and in-depth threat investigation. Managed Detection and Response services (MDR) means the specific services for our EDR solutions. This outlines the support terms and conditions

6.2 Objective: Always-On Guard Managed Services / MDR proactively detect and respond to suspected security incidents. Our Managed Services team seamlessly integrates with the team in your organization, providing expert recommendations for threat remediation and improved security.

6.3 Scope: Our Managed Services includes:

·       Monitoring and Detection: As part of our ongoing security monitoring services, our managed services continuously monitor your platform ensuring no open ticket gets overlooked.

·       Response and Remediation: In the event of a suspected security incident, our Managed Service team provides remote assistance to address vulnerabilities, eliminate threats, and restore system integrity.

·       Our team will contact You when sufficient evidence is collected to conclude that a threat is malicious, or if additional information is required from the Client.

Incident Response: Once the Client has notified us of a suspected security incident, our Managed Services team will provide the following remote incident response services for the Client’s contracted endpoints:

·       Initial incident analysis providing recommendations for effective remediation.

·       Status reporting and action tracking using the ticketing system to ensure the Client makes informed decisions.

·       Continuous monitoring and tracking of the incident until its full resolution.

·       Providing a comprehensive summary report.  

6.4 Managed Service Levels