Item No.
TO: HONORABLE MAYOR AND MEMBERS OF THE CITY COUNCIL
FROM: OFFICE OF THE CITY MANAGER
BY: ALVIN LAM, IT MANAGER
DATE: NOVEMBER 12, 2024
SUBJECT: APPROV AL OF ARCTIC WOLF CYBER SECURITY SUBSCRIPTION
RENEWAL
EXECUTIVE SUMMARY
The City Council will consider approving the renewal of a one-year contract for Arctic Wolf Cyber Security (MDR) Manage, Detection, and Response services and end-user online security awareness training services. The City I.T. Division has utilized Arctic Wolf Cyber Security monitoring and training services since 2022 and has been satisfied with the quality of the service and knowledge of the support staff.
RECOMMENDATION
The City Council:
Authorize the City Manager, or his designee, to execute the renewal contract for a one-year term with Arctic Wolf Cyber Security Services subscription through CDW -G (a reseller) for $80,657.
BACKGROUND
The City’s Information Technology (IT) division has contracted with Arctic Wolf since 2022 to: provide Cyber Security services and monitoring 24/7 for all City computer workstations, laptops, and servers; monthly assessment and vulnerability reviews; regular phishing email testing for City staff; and Security Awareness training for all City employees.
Arctic Wolf Security experts provide an added layer of protection to the City by monitoring 24/7 of all City computer systems (servers, workstations and laptops) for any security breach such as malware, trojan viruses or ransomware outbreak. Alerting of any security breach of our critical systems, and alerting I.T. staff of high-risk vulnerable devices in the City’s network, which require security patching and or upgrade. One of the weakest links of any organization is an employee unknowingly clicking on email links and opening attachments. Arctic Wolf, offers multiple online training videos per month with very short
RENEW ARCTIC WOLF CYBER SECURITY SUBSCRIPTION
NOVEMBER 12, 2024
PAGE 2
2 5 to 10-minute video clips on common security issues that employees should and need to know about.
ANALYSIS
Staff recommends renewing the subscription service with Arctic Wolf, it has provided valuable services to the City for the past two years and have helped maintain and support its security posture. Before Arctic Wolf, the City’s Information Technology (IT) Division utilized another vendor called SecureWorks from 2020 to 2022; however, its subscription services pricing was increasingly expensive and the online Security Awareness training videos averaged 25 to 30 minutes in length This made it difficult for City Staff to allocate enough time to watch the training videos. Arctic Wolf provides competitive pricing and offers much shorter and more entertaining Security Awareness training videos, ensuring that staff will be able to benefit from them.
Arctic Wolf is constantly adding new services and integration to many other security vendor products making it an easy vendor to interface with and sharing of security information.
Arctic Wolf product distribution model is that they sell their subscription services directly and or through resellers, many times manufacturers utilize resellers and provide steeper discounts to cut down on their own sales force and have a larger market reach. Therefore, for this renewal, Staff has obtained three quotes consistent with the City’s Purchasing Policy for the Artic Wolf product from the following resellers: Techrefresh (reseller) quoted: $236,369.11, Arctic Wolf (direct) quoted: $181,982, and CDW -G (reseller) quoted: $80,656.86, staff went with CDW -G being the lowest bidder.
CITY COUNCIL PRIORITIES
Fiscal Responsibility
Efficiency & Adaptability
FISCAL IMPACT
Approval of the recommended action will result in an expenditure of $80,657 from the Fiscal Year (FY) 2024-2025. This amount is included as part of the adopted FY 2024- 2025 Operating Budget. As a result, there is sufficient funding available for the recommended action.
ATTACHMENTS
Attachment A: Arctic Wolf Master Agreement
Last Updated: 08/01/2021
Manaqed Detection and ResponseSolution Terms
This Managed Detection and Response – Solution Terms sets forth the terms and conditions of the Managed Detection and Response Solution (the “Solution”). The Solution, if purchased by Customer as evidenced by Customer’s election on an Order Form, will be provided in accordance with the terms set forth herein and the Solutions Agreement (the “Agreement") made by and between Customer and Arctic Wolf Networks, Inc. (“Arctic Wolf”). Any capitalized terms not otherwise defined herein shall have the meaning set forth in the Agreement.
The Solution is delivered by the Security Services team (which was formerly referred to generally as the Concierge Security Team) which as of the “Last Updated” date above, is comprised of two (2) teams: (1 ) the Concierge Security Team (“CST”), and (2) the Security Operations Center (“SOC").
The Solution:
Specific features and functionality provided as part of the Solution include:
collection of Solutions Data1, including Customer’s system logs, from Customer’s systems using Equipment,
analysis by Arctic Wolf Security Services of both Equipment and log data through the correlation of Solutions Data with threat and vulnerability information, scanning of Customer’s internal and external systems,
escalation of Security Incidents (as defined below) in need of attention by Customer as set forth •
•
•
•
herein
advisory recommendatIons to intended to improve Customer’s security robustness, calculation of Customer’s Security Score, as more fully described below, Log Search capabilities, if purchased by Customer, as evidenced on an Order Form, Host Containment functionality (as more fully described below), and regular summary Executive Dashboard reports, as described herein and the Documentation.
NOTE: The performance of the Solution, includinq specifically, notification of Emerqencies or Security Incidents, as defined below, will not commence until after onboardinq is complete. The performance of {i) remediation services for Security Incidents {as defined below), (ii) the re-imaqinq of Customer’s systems, or (iii) chanqe of policy settinqs is outside the scope of the Solution.
Data Transfer. Any Equipment provided by Arctic Wolf to Customer is physically or virtually deployed to monitor Customer's system traffic. Such system traffic is augmented with additional sources of log data, as required, to deliver Managed Detection and Response. All such system traffic information is deemed Solutions Data. Essential log sources will be determined by Customer and Arctic Wolf during the onboarding process preceding the Order Form Effective Date Any Solutions Data will be securely transmitted to Arctic Wolf. The Solution operates redundantly with Customer’s High Availability (HA) specifications in order to minimize potential service interruptions. Hosting providers used by Arctic Wolf to deliver the Solution may experience service interruptions and service outages outside the control of Arctic Wolf. If such a hosting provider issues an outage notice that could materially impact delivery of the Solutions, Arctic Wolf will use commercIally reasonable efforts to promptly notify Customer about the outage and communicate the planned recovery time provided by the hosting provider
Solutions Data may include personal or confIdential information. Customer will provide any such persona or confidential information in accordance with the terms of the Agreement. ' Solutions Data also may be referred to in the Agreement as Customer Data
ATTACHMENT A
Data Retention. Arctic Wolf will store Solutions Data for the Data Retention period specified in Customer’s then-current Order Form. Solutions Data may be returned to Customer in accordance with the terms of the Agreement.
Updates & Upgrades. Automated maintenance and update cycles to the Equipment will be performed remotely by Arctic Wolf Security Services. Arctic Wolf will provide any services related to the replacement or upgrades of the Equipment. Any costs related to such Equipment replacement or upgrades will be in accordance with the Agreement.
Security Incidents. The CST supporting Customer is available 8:00 am to 5:00 pm (based on the time zone within which the CST is located), Monday through Friday (excluding holidays). The SOC is available 24 hours a day, 7 days a week, including holidays. Customer may schedule specific activities with their CST by contacting the Arctic Wolf SOC at security(a2arcticwolf.com. Arctic Wolf Security Services will acknowledge any schedule request submitted by Customer to [email protected] .within one (1 ) hour of receipt of such request. Arctic Wolf Security Services will provide an estimate of response time determined by scope, size, and urgency.
Arctic Wolf Security Services will notify and escalate to Customer any Security Incidents, the definition of which will be agreed upon by Customer and Arctic Wolf during onboarding or subsequently thereafter during the SubscrIption Term, discovered by Arctic Wolf within two (2) hours of Arctic Wolf's discovery of such Security Incident. Arctic Wolf standard Security Incident notification process is through a ticket to the Customer; however, during onboarding or subsequently thereafter during the Subscription Term, Arctic Wolf and Customer may agree to alternate notification processes. Security Incident notifications will include a description of the Security Incident, the level of exposure, and a suggested remediation strategy Customer is responsible for implementing, in its sole discretion, any remediation strategies identified by Arctic Wolf. Customer may request validation by Arctic Wolf that any such implemented remediation strategies are working as expected.
Emergencies. During onboarding and subsequently thereafter during the Subscription Term, Arctic Wolf and Customer will agree on and document which Security Incidents will be defined as an “Emergency”.
Emergencies will typically include the discovery of ransomware and other alerts that could cause degradation/outage to Customer’s infrastructure security. Arctic Wolf will escalate Emergencies to Customer within thirty (30) minutes of Arctic Wolf's discovery of the Emergency.
Any Emergency identified by Customer can be escalated to Arctic Wolf’s Security Services by calling: 888- 272-8429, option 2. Customer must describe the Emergency in the initial call and Arctic Wolf will respond within 5 minutes. In addition, with respect to any urgent inquiries, Customer may contact Arctic Wolf’s Security Services by calling: 888-272-8429, option 2.
Scans. On a monthly basis, Arctic Wolf will use the Solution to conduct external vulnerability assessment scans of Customer’s environment. As part of these scans, vulnerability and exploit information will be normalized and correlated with other data sources in order to determine Customer's Security Score and prioritization of any identified remediation strategies. Arctic Wolf will deliver to Customer a summary security report that includes Security Incident and Emergency notification activities on a monthly and quarterly basis.
Security Score. Customer's Security Score is provided as part of the Solution is for illustrative and informational purposes only and may be used by Customer for internal benchmarking purposes. The Security Score is based on certain information related to the results of the Solution within Customer’s environment and is compiled using the Solutions Data made available to Arctic Wolf in conjunction with its delivery of the Solution. Customer's Security Score will be communicated in Customer’s summary reports in addition to being available on Customer’s online Executive Dashboard . Customers may elect to compare their Security Score against industry averages from organizations in the same industry vertical to assess how Customer is performing against industry norms.
Host Containment. Based upon the agreed upon escalation process and provided that the Arctic Wolf Agent is deployed by Customer, Arctic Wolf’s Security Services team will remotely isolate a Customer endpoint device(s) that shows evidence of compromise or other suspicious activity. When the Security Services team identifies certain indicators of attack on an endpoint, the containment action will be initiated systematically, in accordance with the agreed upon escalation process, to rapidly quarantine the suspected compromised system.
The indicators of attack that may drive containment actions include those relating to ransomware (and other types of advanced malware), malicious command-and-control (C2) activity, or active data exfiltration attempts. When an endpoint is in a contained state, only essential control traffic between the Arctic Wolf Agent and the Arctic Wolf server will be allowed in order to enable forensics investigations.
The endpoints under containment will receive a containment notification and the contaInment action will be detailed in an incident ticket. The customer portal will display the Customer endpoints that are currently in a contained state. Security Services team is available to Customer to answer questions or provide detailed information on the contained endpoints.
Last Updated: 05/01/2021
Managed Security Awareness
Solution Terms
These Managed Security Awareness – Solution Terms set forth the terms and conditions of the Managed Security Awareness Solution (the “Solution"). The Solution, if purchased by Customer as evidenced by Customer’s election on an Order Form, will be provided in accordance with the terms set forth herein and the Solutions Agreement (the “Agreement”) made by and between Customer and Arctic Wolf Networks, Inc. {“Arctic Wolf"). Any capitalized terms not otherwise defined herein shall have the meaning set forth in the Agreement.
The Solution:
The Solution provides Customers with security awareness training using Content. Such training and Content addresses current threat concepts to assist in the prevention of system attacks within Customer’s environment.
Specific features and services provided as part of the Solution include:
• Microlearning awareness sessions that address deception tactics used, common red flags that should be recognized, escalation and response duties, and leadership responsibilities;
• Comprehension quizzes to track basic security posture and Customer’s users’ comprehension of the Content;
• Managed phishing simulation built to represent threat vectors that Customer’s users are likely to encounter;
• Gamification point earning system for Customer’s users; • Calculation of Customer’s Secure Culture Score, as more fully described below; • Send alerts via the Administrator Dashboard,
• Secure Administrator Dashboard to provide access to reporting and account rnanagernent;
• Advisory recommendations intended to improve Customer’s culture of security; • Dark web monitoring of Customer’s domains,
• Access to the Content, including all learning materials and additional resources contained in the Administrator Resource Library within the Solutions, by Customer and Customer’s users.
Data Storage. Notwithstanding anything contrary in the Agreement or Order Form, Customer’s Confidential Information, as defined in the Agreement, is stored on servers located in the United States.
Tracking. Arctic Wolf will track participation rates, assessment scores, follow up completion rates, and phishing simulation click rates for Customer’s users. This data will be used to
calculate Customer’s Secure Culture Score, as further described below, and identify remediation strategies for users.
Secure Culture Score. Customer’s Secure Culture Score provided as part of the Solution is for illustrative and informational purposes only and may be used by Customer for internal benchmarking purposes. The Secure Culture Score is compiled using information related to Customer’s and its users’ participation in the Solution. Customer’s Secure Culture Score is a live number that is calculated every time the Administrator Dashboard is loaded. Customer can download activity reports on demand through the Administrator Dashboard. Customer’s Secure Culture Score will be available on Customer’s online Administrator Dashboard Product Support. Customer can contact Arctic Wolf for assistance at [email protected] or 888-272-8429 x2. Arctic Wolf will evaluate the request and collect related information from Customer. Customer is responsible for providing requested information to Arctic Wolf and implementing, in Customer’s sole discretion, any remediation strategies identified by Arctic Wolf
Arctic Wolf agrees to provide Customer with email access to the Arctic Wolf Support Center during standard support hours of Monday – Friday, 9:00 AM – 6:00 PM (Eastern Time) except for standard U.S. Business Holidays. If Customer has more than one Solution login, Customer may appoint no more than five (5) contacts who are authorized to contact Arctic Wolf directly on behalf of Customer’s Solution users. Customer may purchase additional contacts on an Order Form for a Fee
Updates & Upgrades. Any automated maintenance and update cycles to the Solution will be performed remotely by Arctic Wolf.
Arctic Wolf may perform statistical analysis of all of the Solution and its hosting systems to measure the effectiveness of the Solution, optimize Solution performance, and ensure Customer’s license compliance
SOLUTIONS AGREEMENT
(via Authorized Partner)
This Solutions Agreement (the “Agreement' ) is a legal agreement entered into by and between the Customer identified in the signature block below ('Customer"\ and Arctic Wolf Networks, Inc. (" Arctic WoP) and governs any order forms, quotes, or other ordering document executed by the Customer (“ Order Form") that reference this Agreement. An Order Form will be issued to Customer by an Arctic Wolf authorized partner (' Authorized Partner"). This Agreement is effective on the date last executed in the signature block below (the “ Effective Date"). This Agreement permits Customer to purchase subscriptions to the Solutions, as defined below, identified in the Order Form from its Authorized Partner and sets forth the terms and conditions under which those Solutions will be delivered. The Agreement consists of the terms and conditions set forth below, any attachments or exhibits identified herein and any Order Forms that reference this Agreement. If there is a conflict between the terms below, the Order Form, or the terms set forth in an URL referenced herein (such URL terms, the " Terms"), the documents will control in the following order: the Order Form, this Agreement, and the Terms.
In consideration of the mutual covenants and agreements contained herein, and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:
1 . Scope
1.1 Solutions. Customer will purchase and Arctic Wolf, together with its Affiliates (as defined below), will provide the specific products and services (each a " Solution" or collectively, " Solutions”) as specified in the applicable Order Form. A Solution may consist of equipment, which may be virtual or physical appliances {"Equipment'), software, including any add-ons offering enhanced features and functionality made generally available to Arctic Wolf customers from time-to-time (collectively, the " Software") , a cloud service offering, online access to all available learning content within the Administrator Dashboard by Customer’s identified users (the “ Content), metrics related to the Content (the " Hosting Environment), support, onboarding services, and concierge services, all as more fully defined in the Solutions Terms (as defined below) (collectively, “Services"), Beta Solutions (as defined in Section 1,3), and/or additional professional services as defined below {“Professional Services”). The Solutions are provided on a subscription basis for a set term designated on the Order Form (each, a “ Subscription Term") for the one-time costs and subscription fees set forth therein (the “Fees"). Customer may access and use the Solutions, and any Documentation associated therewith, solely for its own internal business purposes and in accordance with the terms and conditions of this Agreement, such associated Documentation, any scope of use restrictions and license counts designated in the applicable Order Form, and the Solutions Terms found at https://arcticwolf.com/terms/solutionsterms/ , as may be updated from time to time by Arctic Wolf in accordance with Section 15 herein (the “Solutions Terms”). " Documentation" means user manuals, training materials, product descriptions and specifications, and other printed information relating to the Solution, as in effect and generally available from Arctic Wolf, but expressly excluding marketing and sales collateral and materials. For purposes of this Agreement, “Affiliate” means any company or other entity, which directly or indirectly controls, is controlled by or is under joint control with Arctic Wolf.
1.2 Future Functionality. Customer agrees that it has not relied on the availability of any future functionality of the Solutions or any other future product or service in executing this Agreement or any Order Form. Customer acknowledges that information provided by Arctic Wolf regarding future functionality should not be relied upon to make a purchase decision. Should Arctic Wolf offer additional optional functionality in the future that complement the Solutions, Customer may elect to subscribe to and obtain a license to the optional functionality for an additional fee
1.3 Except as otherwise provided herein, Customer understands and agrees that the Authorized Partner may not modify this Agreement or make any commitments related to the delivery or performance of the Solutions on Arctic Wolf’s behalf.
1.4 Beta Solutions,
1.4.1 From time-to-time Arctic Wolf may invite Customer to try, at no charge, Arctic Wolf products, features, or functionality that are not generally available to Arctic Wolf’s customers ("Beta Solutions”). Customer may accept or decline any such trial in its sole dIscretion. Any Beta Solutions will be clearly designated as beta, pilot, limited release, developer preview, non-production or by a description of similar import,
1.4.2 Restrictions and Disclaimers. Beta Solutions are provided for evaluation purposes and not for production use, are not supported, may contain bugs or errors, and may be subject to additional terms. Beta Solutions are not considered Solutions hereunder and are provided solely and exclusively "AS IS” with no express or implied warranty of any kind. CUSTOMER ASSUMES AND UNCONDITIONALLY RELEASES ARCTIC WOLF FROM ALL RISKS ASSOCIATED WITH THE USE OF ANY BETA SOLUTIONS. Arctic Wolf may discontinue the Beta Solutions at any time in its sole discretion and Arctic Wolf will make reasonable efforts to provide Customer with advanced notice of any such discontinuance.
Arctic Wolf does not promise or represent that Beta Solutions will be made generally available.
1.4.3 NO DATA RETENTION. ANY CUSTOMER DATA ENTERED INTO THE BETA SOLUTIONS MAY BE PERMANENTLY LOST UNLESS CUSTOMER: (i) PURCHASES A SUBSCRIPTION TO THE COMMERCIALLY AVAILABLE VERSION OF THE BETA SOLUTIONS AS MAY BE MADE AVAILABLE BY ARCTIC WOLF; OR (ii) TO THE EXTENT POSSIBLE, EXPORTS SUCH DATA PRIOR TO TERMINATION OF THE BETA SOLUTIONS.
1.4.4 LIMITED LIABILITY. ARCTIC WOLF’S ENTIRE LIABILITY IN CONNECTION WITH ANY USE OF THE BETA SOLUTIONS WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY. WILL NOT. AS TO ANY INDIVIDUAL CLAIM OR IN THE AGGREGATE, EXCEED $50. 1F CUSTOMER DOES NOT AGREE TO THE ALLOCATION OF RISK IN THIS SECTION, ITS SOLE RECOURSE
IS TO IMMEDIATELY DISCONTINUE THE USE OF THE BETA SOLUTIONS
1.4.5. Despite anything to the contrary in this Agreement, Customer acknowledges that (a) Beta Solutions may not be supported and may be changed at any time, including in a manner that reduces functionality, (b) Beta Solutions may not be available or reliable, and (c) Beta Solutions may not be subject to the same security or audits as the Solutions
2. Equipment. If the Order Form specifies that Customer will receive Equipment, then Customer is responsible for installing the Equipment at the location(s) specified by Arctic Wolf and for the implementation of appropriate data protection practices related to the protection of any Arctic Wolf Networks –SOlutIons Agreement
Last Updated: 08/01/2021 Page 1 of 9
information included on such Equipment while the Equipment is located within Customer's environment. The Equipment is a part of the Solutions and included with the subscription to the Solutions for use by Customer during the Subscription Term. If Customer attempts to install or use the Equipment at a location other than the location determined by Customer and communicated to Arctic Wolf during onboarding or at any time thereafter, the Solutions may fail to function or may function improperly. In the event Customer installs, uses, or relocates the Equipment, Customer will promptly notify Arctic Wolf so that Equipment deployment information can be updated within Customer’s account. Other than normal wear and tear, Customer is directly responsible for loss, repair, replacement and other costs, damages, fees and charges to repair the Equipment.
If applicable, Arctic Wolf will ship Equipment to Customer and will pay the freight costs associated with shipping the Equipment to Customer’s designated locations. Customer is responsible for all additional costs and expenses associated with shipping the Equipment to its designated locations and for the return of the Equipment to Arctic Wolf upon termination of the Subscription Term. Such additional costs and expenses may be reflected on an Order Form, from time-to-time following shipment of the Equipment and will be invoiced by Authorized Partner pursuant to Section 7 herein. Customer understands and agrees if the Equipment is shipped outside of the United States or Canada (or such other locations identified by Arctic WoID, Customer is responsible for acting as the importer of record
3. Professional Services. In the event Arctic Wolf SolutIons require Professional Services, any such Professional Services shall be specified on an applicable Order Form and described in a statement of work which shall reference this Agreement
4. Software and Services. Provided Customer is in compliance with the terms of this Agreement, including payment of Fees, Arctic Wolf grants to Customer a limited, non-transferable, non-sublicensable, non-exclusive right and/or license during the Subscription Term to, to the extent applicable given the Solution: (i) install the object code form of the Software (including any related to virtual Equipment, if applicable), but only in connection with Customer’s use of the Solutions and otherwise in accordance with the Documentation and this Agreement, and/or access and use the Solutions, including any Content and Hosting Services, for up to the number of licenses set forth on an Order Form, (ii) obtain and use Arctic Wolf’s Services in conjunction with Customer’s use of the Solution, (iii) obtain onboarding services from Arctic Wolf to install the Equipment, (iv) load Customer’s users and associated information into the applicable Solution for delivery of Content and training, and (v) access the Arctic Wolf Customer Portal and/or Administrator Dashboard , subject to the Privacy Policy located at https://arcticwolf.com/privacy-policy-for- customer-portal-users/, as may be updated from time-to-time in accordance with Section 15 below (the “Privacy Policy’). Solutions Data, as defined in Section 10,1 herein, will be retained for the retention period as described in the Solutions Terms. Customer may be required to implement Software and Services in order to enable features of the Solutions. Customer acknowledges that any changes Customer makes to its infrastructure or the configuration of the Solutions after initial deployment may cause the Solutions to cease working or function improperly and that Arctic Wolf will have no responsibility for the impact of any such Customer changes. Customer understands that depending on the Solution deployed, a Solution may consume additional CPU and memory in Customer’s environment while running in production
5. Reservation of Rights and Ownership. Arctic Wolf owns or has the right to license the Solutions and any associated Documentation (" Arctic Wolf Technology”). Customer acknowledges and agrees that: (a) the Arctic Wolf Technology is protected by United States and international copyright, trademark, patent, trade secret and other intellectual property or proprietary rights laws; (b) Arctic Wolf retains all right, title and interest (including, without limitation, all patent, copyright, trade secret and other intellectual property rights) in and to the Arctic Wolf Technology, excluding any rights, title, and interest in any Third Party Products (as defined in Section 12.3 below) which shall be retained by its third party licensor(s), any other deliverables, know-how, databases, developed programs, and registered or unregistered intangible property rights; (c) there are no implied licenses and any rights not expressly granted to Customer hereunder are reserved by Arctic Wolf; (d) the Solution, excluding Professional Services, is licensed on a subscription basis, not sold, and Customer acquires no ownership or other interest (other than the license rights expressly stated herein) in or to the Arctic Wolf Technology; and (e) the Solution is offered as an on-line, hosted solution, and Customer has no right to obtain a copy of the Software
6.Restrictions, Responsibilities, and Prohibited Use.
6.1 Restrictions. Customer agrees not to, directly or indirectly: (i) modify, translate, copy or create derivative works of the Arctic Wolf Technology; (ii) reverse engineer, decompile, disassemble, or otherwise seek to obtain the source code or non-public APIs to the Solutions, except to the extent expressly permitted by applicable law (and then only upon advance notice to Arctic Wolf); (iii) interfere with or disrupt the integrity or performance of the Solutions or the data and information contained therein or block or disrupt any use or enjoyment of the Solutions by any third party; (iv) attempt to gain unauthorized access to the Arctic Wolf Technology or related systems or networks; (v) remove or obscure any proprietary or other notice contained in the Arctic Wolf Technology, including on any reports or data printed from the Arctic Wolf Technology; or (vi) unless Customer is an Authorized MSP Partner of Arctic Wolf, use the Solutions in connection with a service bureau, service provider or like activity whereby Customer operates or uses the Solutions for the benefit of a third party. Customer agrees to abide by the terms of the Acceptable Use Policy at https://arcticwolf.com/terms/acceptable-user-policy/ , as may be updated from time-to-time in accordance with Section 15 below. If Arctic Wolf, in its reasonable discretion, determines that Customer's use of or access to the Solutions imposes an actual or imminent threat to the security or stability of Arctic Wolf’s infrastructure or that Customer is abusing its use of the Solutions in contravention with the terms of this Agreement, Arctic Wolf may, in addition to any other right herein, temporarily suspend Customer’s access to the Solutions until such activity is rectified. If commercially practicable, Arctic Wolf shall provide Customer with notice prior to any such suspension and shall work with Customer in good faith to reinstate the Solutions promptly
6.2 Arctic Wolf Responsibilities. Arctic Wolf shall provide the Solutions Customer subscribes to as set forth on an Order Form in accordance with the terms of this Agreement, as further described in the Solutions Terms. The Solutions provided under this Agreement shall include any updates, upgrades, bug fixes, version upgrades or any similar changes that are made generally available to Arctic Wolfs customers free of charge from time to time during the Subscription Term
6.3. Customer Responsibilities. Customer must identify the administrative users for its account which may include Customer’s authorized (email authorization sufficient) third party service providers and agents (" Administrators"). Each Administrator will receive an administrator ID and password and will need to register with Arctic Wolf. Customer is responsible for notifying Arctic Wolf about changes to Administrators, including but not limited to termination, change of authority, and the addition of Administrators. Customer acknowledges and agrees that Administrators will be able to view all Solutions Data and other traffic and activities that occur on Customer’s network and that Customer is responsible for all activities that occur under Administrator accounts. Administrator IDs are granted to individual, named persons and cannot be shared or used by more than one Administrator but may be reassigned from time-to-time to new Administrators Arctic Wolf Networks –Solutions Agreement
Last Updated: 08/01/2021 Page 2 of 9
6.4 Prohibited Use. Customer represents and warrants that Customer is not a Prohibited Person nor owned or controlled by a Prohibited Person. "ProhIbited Persons" shall mean a person or entity appearing on the IIsts published by the U.S. Department of Commerce, the U.S Department of State, the U.S. Department of Treasury or any other list that may be published by the U.S. Government, as amended from time to time, that is prohibited from acquiring ownership or control of items under this Agreement, or with which Arctic Wolf is prohibited from doing business. Customer further represents that the Solutions shall not be used in violation of United States economic sanctions laws. Customer agrees to promptly notify Arctic Wolf, and terminate its use of the Solutions, if Customer discovers that any of the foregoing conditions apply Arctic Wolf may suspend any use of the Solutions it reasonably believes Customer may be (or is alleged to be) in violation of the foregoing.
6.5 Export/Import Compliance. Customer agrees to comply with all applicable export and import laws and regulations. Without limiting the foregoing: (i) Customer represents and warrants that it is not listed on any U.S. government list of prohibited or restricted parties or located in (or a national on a country that is subject to a U.S. government embargo or that has been designated by the U.S. government as a “terrorist supporting” country, (ii) Customer will not (and will not permit any of its users to) access or use the Solutions in violation of any U.S. export contracts, economic sanctions, embargos, or other trade prohibitions or restriction, and (iii) Customer will not directly or indirectly export, re- export, or release the Solutions to, or make the Solutions accessible from, any country, jurisdiction, or person to which export, re-export, or release is prohibited by applicable law; and (iv) Customer will not submit to Arctic Wolf, directly or through the Solutions, any information that is controlled under the U.S. International Traffic in Arms Regulations. Customer will comply with all applicable laws and complete all required undertakings (including obtaining any necessary export license or other governmental approval) prior to exporting, re-exporting, releasing, or otherwise making the Solutions available outside the United States.
7. Fees, Payment, Taxes, and Audit.
7.1 Fees, Payment, Taxes. Customer will purchase the Solutions through the Authorized Partner. The Order Form containing terms related fees, payment, taxes, audit, and any other related terms shall be between Customer and the Authorized Partner. Customer will pay any owed amounts to the Authorized Partner, as agreed between Customer and Authorized Partner. Customer agrees that Arctic Wolf may suspend or terminate Customer’s use of the Solutions upon ten (10) days’ written notice to Customer if Arctic Wolf does not receive payment of Fees from the Authorized Partner. The amounts paId by Authorized Partner to Arctic Wolf for Customer’s use of the Solutions under this Agreement will be deemed the amount actually paid or payable under this Agreement for purposes of calculating Arctic Wolf’s liability under Section 13. Customer’s renewal pricing will be communicated to Customer by the Authorized Partner in accordance with the terms Customer has with the Authorized Partner or by Arctic Wolf prior to the renewal Subscription Term.
7.2 Audit. During the term of this Agreement and for one year thereafter, Customer shall provide Arctic Wolf, or its designated representative, promptly upon request with appropriate records requested by Arctic Wolf to verify Customer’s compliance with the Agreement, including specifically its license counts as set forth on an Order Form. Arctic Wolf, at its option, may require that an executive officer of Customer certify in writing to Customer’s compliance with this Agreement and disclose the scope of use of the Solutions by Customer. If, because of such audit, Arctic Wolf determines that Customer has exceeded the number of licenses subscribed to by Customer on an Order Form, Arctic Wolf will notify Customer of the number of additional licenses, along with the associated Subscription Fees prorated through the end of the then-current Subscription Term, and Customer will remit payment for such Subscription Fees in accordance with this Section 7.
8. Compliance with Laws. Each party represents and warrants that, during the term of this Agreement, it will comply with all foreign, provincial, federal, state and local statutes, laws, orders, rules, regulations and requirements, including those of any governmental (including any regulatory or quasi-regulatory) agency applicable to such party as it pertains to its obligations herein
9. Confidentiality. Either party (as a "Discloser”) may disclose confidential and proprietary information, orally or in writing (" Confidential Information") to the other party (as a “Recipient’). Confidential Information shall be marked confidential or proprietary and/or with a restrictive legend of the Discloser expressly indicating the confidential nature of the document . Confidential Information of Arctic Wolf includes the following any trade secrets, know-how, inventions (whether or not patentable), techniques, ideas, or processes related to the Arctic Wolf Technology; the design and architecture of the Arctic Wolf Technology; the computer code, and design and functional specifications of the Arctic Wolf Technology; and any intellectual property and know-how included in the problem reports, analysis, and performance information related to the Arctic Wolf Technology. Confidential Information of Customer may include the following:
(i) if the Managed Awareness Solution is deployed: Customer’s tracking metrics as described in the Solutions Terms, Personal Information (as defined in Section 10.2 below), Customer created content, any test response data; and (ii) if the MDR or MR Solutions are deployed: Personal Information (as defined in Section 10.2 below) and Solutions Data (as defined in Section 10.1 below).
Each party agrees to hold the other party's Confidential Information which is marked in the manner set forth above in strict confidence, not to disclose such Confidential Information to third parties not authorized by the Discloser to receive such Confidential Information, and not to use such Confidential Information for any purpose except as expressly permitted hereunder or if by Arctic Wolf, also as set forth in the Privacy Policy Each party agrees to take commercially reasonable steps to protect the other party’s Confidential Information and to ensure that such Confidential Information is not disclosed, distributed or used in violation of the provisions of this Agreement. The Recipient may disclose Confidential Information only: (a) with the Discloser’s prior written consent; or (b) to those employees, officers, officials, attorneys, agents, consultants, and advisors with a clear and well-defined “need to know” purpose as determined by the Recipient who are informed of and bound by the obligations of this Agreement. Notwithstanding the foregoing, the Recipient may disclose Confidential Information to the extent required by law, by court order or subpoena; however, the Recipient will give, to the extent legally permissible and reasonably practical, the Discloser prompt notice to allow the Discloser a reasonable opportunity to obtain a protective order and such Confidential Information disclosed to the extent required by law shall otherwise remain confidential and subject to the protections and obligations of this Agreement. To the extent legally required, Arctic Wolf may report any violations of law pertaining to any Customer Confidential Information and/or Customer’s use of the Solutions. The Discloser agrees that the foregoing obligations shall not apply with respect to any information that the Recipient can document is: (i) rightfully in its possession or known to it prior to receipt from the Discloser without an obligation of confidentiality; (ii) or has become public knowledge through no fault of the Recipient; (iii) rightfully obtained by the Recipient from a third party without breach of any confidentiality obligation; or (iv) Arctic Wolf Networks –SOlutIons Agreement
Last Updated: 08/01/2021 Page 3 of 9
independently developed by employees of the Recipient who had no access to Discloser's Confidential Information. Upon expiration or termination of this Agreement for any reason, and except as otherwise provided in Section 16 below, each party shall promptly destroy all copies of the other party's Confidential Information and copies, notes or other derivative material relating to the Confidential Information. Notwithstanding the foregoing, and subject to the Privacy Policy, Arctic Wolf may retain Customer’s name, contact names, email address, and such other necessary contact information following termination of this Agreement for its internal business purposes.
10. Solutions Data
10.1 Solutions Data. " Solutions Data" means, depending on the Solution deployed, the operational system log data and any other information provided by Customer in furtherance of its use of the Solutions and which Customer may elect to submit to Arctic Wolf through the Solutions, including, but not limited to operational values, event logs, and network data such as flow, HTTPS, TLS, DNS metadata, cursory inventory data, operating systems and versions, users and groups from Active Directory, system level inventory, event data, and network vulnerability data. As between the parties, Customer shall retain all right, title and interest (including any and all intellectual property rights) in and to the Solutions Data (excluding any Arctic Wolf Technology used with the Solutions Data). Customer hereby grants Arctic Wolf, during the term of the Agreement, a non-exclusive, worldwide, royalty-free right to collect, use, copy, store, transmit, modify and create derivative works of the Solutions Data solely to the extent necessary to provide the Solutions to Customer. If Arctic Wolf is compelled by law to disclose Solutions Data or its summary reports related thereto, it shall provide prior notice of such compelled disclosure (to the extent legally permitted) and reasonable assistance, at Customer's cost, if Customer wishes to contest the disclosure. Customer understands Arctic Wolf will aggregate Solutions Data with Arctic Wolf s other data so that results are non-personally identifiable (individual identities have been removed and are not linked or reasonably linked to any individual, including via a device, or could be reasonably linked, directly or indirectly, with a particular consumer or household) and collect anonymous technical logs and data regarding Customer’s use of the Solutions (“ Aggregate/Anonymous Data"). Such Aggregate/Anonymous Data is Arctic Wolf Technology, which Arctic Wolf may use for its business purposes during or after the term of this Agreement
10.2 Personal Information. Confidential Information and Solution Data may include information that identifies, relates to, describes, is reasonably capable of being associated wIth or linked to a particular individual, whether directly or indirectly {"Personal Information"). Customer is responsible for the lawfulness of any such Personal Information and the receipt, use, and processing of it under the Agreement. Customer represents and warrants that, where it provides Personal Information to Arctic Wolf or requests Arctic Wolf collect or process such information, it (1 ) has complied with any applicable laws relating to the collection or provision of such information, (2) possesses any consents, authorizations, rights and authority, and has given all required notices to individual data subjects as are required to transfer or permit Arctic Wolf to collect, receive, or access any Personal Information for the Solutions, and (3) to the extent required by applicable law, informed the individuals of the possibility of Arctic Wolf processing their Personal Information on Customer’s behalf and in accordance with its instructions
10.3 European Union and United Kingdom General Data Protection Regulation. If and to the extent Customer submits to Arctic Wolf personal data (as that term is defined under the General Data Protection Regulation (''GDPR")) of individuals located in the European Economic Area or United Kingdom, the Arctic Wolf Data Processing Agreement available at https://arcticwolf.com/terms/dpa/ , as may be updated by Arctic Wolf from time-to-time in accordance with its terms (the “ DPA"), may be executed by Customer and upon execution and return to Arctic Wolf in accordance with its terms will be incorporated into this Agreement. It is Customer’s sole responsibility to notify Arctic Wolf of requests from data subjects related to the modification, deletion, restriction and/or objection of personal data. Customer represents and warrants that any processing of personal data in accordance with its instructions is lawful
10.4 California Consumer Privacy Act. The parties acknowledge and agree that Arctic Wolf is a service provider for the purposes of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA") and may receive personal information (as defined by the CCPA) from Customer pursuant to this Agreement for a business purpose. The parties agree to comply at all times with the applicable provisions of the CCPA in respect to the collection, transmission, and processing of all personal information (as defined by the CCPA) exchanged or shared pursuant to the Agreement. Arctic Wolf shall not sell any such personal information. Arctic Wolf shall not retain, use or disclose any personal information provided by Customer pursuant to this Agreement except as necessary for the specific purpose of performing the Solutions for Customer pursuant to this Agreement or as permitted by the CCPA. The terms "personal information," "service provider," “sale," and “sell” are as defined in Section 1798.140 of the CCPA. Arctic Wolf certifies that it understands the restrictions of this Section 10.4. It is Customer’s sole responsibility to notify Arctic Wolf of any requests from consumers (as defined in the CCPA) seeking to exercise rights afforded in the CCPA with regard to personal information received or processed in connection with the Solutions. Arctic Wolf agrees to provide reasonable cooperation to Customer in connection with such requests
10.5 Canadian Privacy Laws. If and to the extent Customer submits to Arctic Wolf personal information (as that term is defined under applicable Canadian privacy laws, being all applicable federal, and provincial laws and regulations relating to the processing, protection or privacy of personal information (“Privacy Laws"), of individuals located in Canada, Customer agrees that it is solely responsible for and shall obtain from all such individuals, all required consents and/or provide all required notifications, regarding the collection, use, disclosure, and processing of their personal information by Arctic Wolf/Arctic Wolfs subcontractors/third party service providers (which may be located outside of Canada), and/or the transfer by Customer of such individual’s personal information to Arctic Wolf/Arctic Wolfs subcontractors/third party service providers (which may be located outside of Canada). Upon request of Customer, Arctic Wolf will inform Customers of the locations to which the personal information is transferred and processed by Arctic Wolf and/or its subcontractors/third party service providers, Customer retains control of the personal information and remains solely responsible for its compliance with Privacy Laws and for the processing instructions it gives to Arctic Wolf. The Parties agree that this Agreement, together with Customer’s use of the Solution in accordance with this Agreement, constitutes Customer’s instructions to Arctic Wolf in relation to the processing of such personal informatIon. Subject to Section 10.1 of this Agreement, Arctic Wolf will only process the personal information to the extent, and in such a manner, as is necessary for the performance of the Solutions. Arctic Wolf will reasonably assist Customer with meeting the Customer’s compliance obligations under applicable Privacy Laws, considering the nature of Arctic Wolfs processing and the information available to Arctic Wolf.
Arctic Wolf shall:
Arctic Wolf Networks –Solutions Agreement
Last Updated: 08/Oln021 Page 4 of 9
Comply with its obligations as a third party service provider/mandatory under applicable Privacy Laws, including bY implementIng appropriate technical, physical and organizational measures to safeguard the personal information; Periodically conduct audits of its information security controls for facilities and systems used to deliver the Solutions and make relevant audit reports available to Customer for review. The Customer will treat such audit reports as Arctic Wolf's Confidential Information; Within seventy-two (72) hours of discovery notify Customer of any unauthorized or unlawful access to or processing of the personal information:
Limit access to those employees who require the personal information access to meet Arctic Wolf s obligations under this Agreement and ensure that all employees are informed of the personal information's confidential nature; Notify Customer if it receives any complaint, notice, or communication that directly or indirectly relates to the personal information processing or to either party’s compliance with Privacy Laws, and provide its full co-operation and assistance in responding to such complaint, notice or communication; and
Upon Customer’s request, provide the Customer a copy of or access to all or part of the Customer's personal information in its possession or control in the format reasonably agreed to by the parties
11.Indemnity.
11.1 Arctic Wolf’s Indemnity. Subject to Section 11.3, Arctic Wolf will defend and indemnify Customer from any unaffiliated third partY claim or action to the extent based on the allegation that the Solutions infringe any intellectual property right (patents, utility models, design rights, copyrights and trademarks or any other intellectual property right) having effect in the United States and Canada and Arctic Wolf will paY anY settlements that Arctic Wolf agrees to in a writing signed by an authorized officer of Arctic Wolf or final judgments awarded to the third partY claimant by a court of competent jurisdiction. The foregoing obligations do not apply with respect to the Solutions, or portions or components thereof, that are: (a) not provided by Arctic Wolf; (b) combined with other products, processes or materials that are not reasonabIY contemplated by the Documentation where the alleged infringement relates to such combination; (c) modified other than with Arctic Wolfs express consent; (d) used after Arctic Wolf’s notice to Customer of such activity’s alleged or actual infringement; or (e) not used by Customer in strict accordance with this Agreement or the published Documentation. The indemnification obligations set forth in this Section 11.1 are Arctic Wolfs sole and exclusive obligations, and Customer’s sole and exclusive remedies, with respect to infringement or misappropriation of third-party intellectual propertY rights of any kind
11.2 Customer Indemnity. Subject to Section 11.3, Customer agrees to defend any third-party claim or action brought against Arctic Wolf to the extent based on Customer’s alleged breach of Sections 6 or 10 and Customer agrees to pay any settlements that Customer agrees to in a writing signed by an authorized officer of Customer or final judgments awarded to the third party claimant by a court of competent jurisdiction
11.3 Procedures. Each party's indemnification obligations are conditioned on the indemnified party: (a) providing the indemnifYing partY with prompt written notice of any claim, provided that the failure to provide such notice shall only limit the indemnifying party’s obIIgation to indemnify to the extent that the failure prejudices the indemnifying party in its defense of the claim; (b) granting the indemnifying party the sole control of the defense or settlement of the claim; and (c) providing reasonable information and assistance to the indemnifying partY in the defense or settlement of the claim at the indemnifying party’s expense. Notwithstanding the foregoing, the indemnifying party (i) may not make an admission of fault on behalf of the other party without written consent, (ii) any settlement requiring the party seeking indemnification to admit liability requires prior written consent, not to be unreasonably withheld or delayed, and (iii) the other party may join in the defense with its own counsel at its own expense
11.4 Options. If Customer's use of the Solutions has become, or in Arctic Wolfs opinion is likely to become, the subject of any claim of infringement, Arctic Wolf may at its option and expense: (a) procure for Customer the right to continue using and receiving the Solutions as set forth hereunder; (b) replace or modify the Solutions to make them non-infringing; (c) substitute an equivalent for the Solutions; or (d) if Arctic Wolf, in its sole discretion, determines that options (aF(c) are not reasonably practicable, terminate this Agreement and refund any pre-paid unused Fees as of the effective date of termination.
12. Warranty and Warranty Disclaimer.
12.1 Solutions Warranty. ARCTIC WOLF WARRANTS THAT DURING THE SUBSCRIPTION TERM AND PROVIDED THAT CUSTOMER IS NOT IN BREACH OF THIS AGREEMENT THAT: (1) THE SOLUTIONS PROVIDED UNDER THIS AGREEMENT DO NOT INFRINGE OR MISAPPROPRIATE ANY INTELLECTUAL PROPERTY RIGHTS OF ANY THIRD PARTY'; AND (I1) THE SOLUTIONS SHALL SUBSTANTIALLY PERFORM AS DESCRIBED IN THE DOCUMENTATION. IN THE EVENT OF ANY BREACH OF THIS SECTION 12.1, ARCTIC WOLF SHALL, AS ITS SOLE LIABILITY AND CUSTOMER’S SOLE REMEDY. REPAIR OR REPLACE THE SOLUTIONS THAT ARE SUBJECT TO THE
WARRANTY CLAIM AT NO COST TO CUSTOMER OR IF ARCTIC WOLF IS UNABLE TO REPAIR OR REPLACE, THEN ARCTIC WOLF WILL REFUND ANY PRE-PAID FEES FOR THE SOLUTIONS. OR PARTS THEREOF. SUBJECT TO THE WARRANTY CLAIM. EXCEPT FOR THE WARRANTY DESCRIBED IN THIS SECTION. THE SOLUTIONS ARE PROVIDED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED INCLUDING. BUT NOT LIMITED TO. THE IMPLIED WARRANTIES OR CONDITIONS OF DESIGN, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE. AND ANY WARRANTIES OF TITLE. CUSTOMER ACKNOWLEDGES THAT THE SOLUTIONS ARE PROVIDED “AS IS" AND FURTHER ACKNOWLEDGES THAT ARCTIC WOLF DOES NOT WARRANT: (A) THE OPERATION OF THE SOLUTIONS WILL BE UNINTERRUPTED, OR ERROR FREE; (B) THE SOLUTIONS ARE NOT VULNERABLE TO FRAUD OR UNAUTHORIZED USE; (C) THE FEATURES OR FUNCTIONALITIES OF THE SOLUTIONS WILL BE AVAILABLE AT ANY TIME IN THE FUTURE; AND (D) THE SOLUTIONS WILL IDENTIFY OR DETECT EVERY VULNERABILITY OR SECURITY ISSUE. CUSTOMER IS
RESPONSIBLE AND ARCTIC WOLF SHALL HAVE NO RESPONSIBILITY FOR DETERMINING THAT THE USE OF THE SOLUTIONS COMPLIES WITH APPLICABLE LAWS IN THE JURISDICTION(S) IN WHICH CUSTOMER MAY DEPLOY AND USE THE SOLUTIONS.
12.2 Open Source Warranty. The Software may include Open Source Software. To the extent included in the Software, Open Source Software is governed solely by the applicable open source licensing terms, if any, and is provided “AS IS”, and Arctic Wolf herebY disclaims all copyright interest in such Open Source Software, Arctic Wolf provides no warranty specifically related to any Open Source Software or anY applicable Open Source Software licensing terms, Any fees paid by Customer to Arctic Wolf are for Arctic Wolf's proprietarY Software onIY, and not for any Open Source Software components of the Software. Any license assocIated with an Open Source Software component applies onIY Arctic Wolf Networks –SOlutIons Agreement
Last Updated: 08/01/2021 Page 5 of 9
to that component and not to Arctic Wolf’s proprietary Software or any other third-party licensed software. The foregoing language is not intended to limit Arctic Wolf's warranty obligation for the Solutions set forth in Section 12.1. “Open Source Software" means software with its source code made available pursuant to a license by which, at a minimum, the copyright holder provides anyone the rights to study, change, and/or distribute the software to anyone and for any purpose.
12.3 Third Party Product. Third Party Product (as defined in this Section 12.3) may carry a limited warranty from the third-party publisher, provider, or original manufacturer of such Third Party Products. To the extent required or allowed, Arctic Wolf will pass through to Customer or directly manage for the benefit of Customer’s use of the Third Party Products as part of the Solutions (such decision to be made in Arctic Wolf’s discretion), the manufacturer warranties related to such Third Party Products. "Third Party Product” means any non-Arctic Wolf branded products and servIces (including Equipment, and any operating system software included therewith) and non-Arctic Wolf-licensed software products, including Open Source Software,
12.4 Customer Warranties. Customer represents and warrants that it shaH: (i) be responsible for ensuring the security and confidentiality of all Administrator IDs and passwords; (ii) use commercially reasonable efforts to prevent unauthorized access to, or use of, the Solutions; (iii) notify Arctic Wolf promptly upon discovery of any unauthorized use of the Solutions or any breach, or attempted breach, of security of the Solutions; (iv) not use the Solutions in a manner that would violate applicable laws or regulations; (v) not use the Solutions and transfer any Solutions Data to Arctic Wolf for any fraudulent purposes; and (vi) implement safeguards within Customer’s environment to protect the Solutions, including specifically, the Equipment, from the introduction, whether intentional or unintentional, of (1 ) any virus or other code, program, or sub- program that damages or interferes with the operation of the Equipment or halts, disables, or interferes with the operation of the Solutions; or (2) any device, method, or token whose knowing or intended purpose is to permit any person to circumvent the normal security of the Solutions
13. Limitation of Liability. FOR ANY CAUSE RELATED TO OR ARISING OUT OF THIS AGREEMENT, WHETHER IN AN ACTION BASED
ON A CONTRACT, TORT (INCLUDING NEGLIGENCE AND STRICT LIABILITY) OR ANY OTHER LEGAL THEORY, HOWEVER ARISING, ARCTIC WOLF WILL IN NO EVENT BE LIABLE TO CUSTOMER OR ANY THIRD PARTY FOR: (A) DAMAGES BASED ON USE OR ACCESS, INTERRUPTION. DELAY OR INABILITY TO USE THE SOLUTIONS. LOST REVENUES OR PROFITS. LOSS OF SOLUTIONS, BUSINESS OR
GOODWILL, LOSS OR CORRUPTION OF DATA, LOSS RESULTING FROM SYSTEM FAILURE, MALFUNCTION OR SHUTDOWN, FAILURE
TO ACCURATELY TRANSFER, READ OR TRANSMIT INFORMATION, FAILURE TO UPDATE OR PROVIDE CORRECT INFORMATION,
SYSTEM INCOMPATIBILITY OR PROVISION OF INCORRECT COMPATIBILITY INFORMATION, BREACHES BY AN AUTHORIZED PARTNER, OR BREACHES IN CUSTOMER’S SYSTEM SECURITY; OR (B) ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES; OR (C) ANY AMOUNTS THAT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER FOR THE SOLUTIONS THAT ARE THE SUBJECT OF THE CLAIM DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRIOR TO THE EVENT WHICH GIVES RISE TO SUCH DAMAGES. THESE LIMITATIONS SHALL APPLY WHETHER OR NOT ARCTIC WOLF HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY. BOTH
PARTIES UNDERSTAND AND AGREE THAT THE LIMITATIONS OF LIABILITIES FOR EACH PARTY SET FORTH IN THIS AGREEMENT ARE REASONABLE AND THEY WOULD NOT HAVE ENTERED INTO THE AGREEMENT WITHOUT SUCH LIMITATIONS.
14. Term and Renewal. This Agreement shall be in effect for the Subscription Term specified in the Order Form. The Order Form or other equivalent transaction document containing the terms related to the length of the Subscription Term and any renewal thereof, and any other related terms, as may be applicable, shall be between Customer and the Authorized Partner. Notwithstanding the foregoing, and unless otherwise set forth on an Order Form, the Subscription Term to the Solutions will automatically renew at the end of the initial Subscription Term for the same period of time as the initial Subscription Term, but in no event mor than a twelve (12) month term and subject to the termination for non-funding in Section 16 below; provided, however, if either party would like to opt out of automatic renewal of the Subscription, then such party must notify the other party no less than thirty (30) days prior to the expiration of the then-current Subscription Term. Arctic Wolf will use commercially reasonable efforts to provide Customer with notice of expiration seventy-five (75) days prior to expiration of the then https://arcticwolf.com/terms/ website, or such other written communication method implemented by Arctic Wolf from time-to-time of any such changes. Customer may notify Arctic Wolf within 30 days after the effective date of the change of its rejection of such change. If Customer notifies Arctic Wolf of its rejection during such thirty (30) day period, then Customer will remain governed by the terms in effect immediately prior to the change until the end of Customer’s then-current Subscription Term. However, any subsequent renewal of the Subscription Term will be renewed under the then-current terms, unless otherwise agreed in writing by the parties.
16. Termination. Either party may terminate this Agreement for cause if the other party commits a material breach of this Agreement, provided that such terminating party has given the other party ten (10) days advance notice to try and remediate the breach. Customer may terminate this Agreement effective as of the end of the then current prepaid Subscription Term if Client’s budget (funding) is eliminated and Customer provides written evidence to Arctic Wolf of the elimination of Customer’s budget (funding), such evidence to be in the form and substance reasonably requested by Arctic Wolf. Either party may terminate this Agreement if either party is declared bankrupt, admits its inability to satisfy its debts, or enters into any negotiation with its creditors for the settlement of its debts. Upon termination, Customer agrees to cease all use of the Solutions and Arctic Wolf Technology, installed or otherwise, and destroy all copies of any Arctic Wolf Technology that are in its possession or under its control and promptly remove and return all Equipment to Arctic Wolf. Except as otherwise required by law, Arctic Wolf will remove, delete, or otherwise destroy all copies of Solutions Data and Confidential Information in its possession upon the earlier of (i) the return of the Equipment, if applicable, to Arctic Wolf, or (ii) one hundred-twenty (120) days following termination. Notwithstanding anything contrary in this Agreement, should Customer fail to return any Equipment within ninety (90) days following termination or expiration, Customer will be liable for the replacement cost of the Equipment, which shall be due and owing upon receipt of the invoice from the Authorized Partner and paid in accordance with Section 7 herein, and Customer shall be liable for any breach of the Confidential Information, Solutions Data, and Arctic Wolf Technology contained within the Equipment. Sections 9 through 14, 16, and 17 will survive the non-renewal or termination of this Agreement.
Arctic Wolf Networks -Solutions Agreement
Last Updated : 08/01 m021 Page 6 of 9
17. Miscellaneous.
17.1 Except as otherwise provided herein, all notices, requests, consents, claims, demands, waivers and other communications hereunder shall be in writing and shall be deemed to have been given: (a) when delivered by hand (with written confirmation of receipt); (b) on the next business day after the date sent, if sent for overnight delivery by a generally recognized international courier (e.g., FedEx, UPS, DHL, etc.) (receipt requested); or (c) on the date sent by e-mail of a PDF document (with confirmation of transmission) if sent during normal business hours of the recipient, and on the next business day if sent after normal business hours of the recipient. Such communications must be sent to the respective parties at the addresses set forth on the signature page hereof (or at such other address for a party as shall be specified in a notice given in accordance with this Section 17). For contractual purposes, Customer (1 ) consents to receive communications in an electronic form via the email address it provides herein or via the Customer Portal; and (2) agrees that all agreements, notices, disclosures, and other communications that Arctic Wolf provides electronically satisfies any legal requirement that those communications would satisfy if they were on paper. This Section does not affect Customer’s non-waivable rights
17.2 [INTENTIONALLYOMITTED]
17.3 The parties to this Agreement are independent contractors. Neither party has the authority to bind the other party without the express written authorization of the other party. Nothing herein may be construed to create an employer-employee, franchisor-franchisee, agency, partnership, or joint venture relationship between the parties. Arctic Wolf shall be primarily liable for the obligations of its Affiliates and any subcontractors used in the delivery of the Solutions
17.4 This Agreement shall inure to the benefit of and be binding upon the respective permitted successors and assigns of the parties. Neither party shall not be entitled to assign, subcontract, delegate or otherwise transfer any of its rights and/or duties arising out of this Agreement and/or parts thereof to third parties, voluntarily or involuntarily, including by change of control, operation of law or any other manner, without the other party’s express prior written consent; provided, however, Arctic Wolf may, without consent, assign this Agreement to any successor or assign that has acquired all, or substantially all, of its business by means of merger, stock purchase, asset purchase, or otherwise. Arctic Wolf will provide Customer with notice of such assignment as soon as commercially possible and Customer shall have thirty (30) days following receipt of such notice to terminate this Agreement should the successor-in-interest be unable, in Customer’s commercially reasonable opinion, be unable to perform all obligatIons of Arctic Wolf under this Agreement. Any purported assignment, subcontract, delegation or other transfer in violation of the foregoing shall be null and void. No such assignment, subcontract, delegation or other transfer shall relieve the assigning party of any of its obligations hereunder.
17.5 The rights and obligations of the parties under this Agreement shall not be governed by the provisions of the 1980 U,N. Convention on Contracts for the International Sale of Goods or the United Nations Convention on the Limitation Period in the International Sale of Goods, as amended. This Agreement shall be governed by the laws of the State of California without regard to the conflicts of law provisions thereof. Any controversy or claim arising out of or relating to this Agreement, or the breach thereof, shall be settled by non-binding arbitration in Los Angeles County, California in English and in accordance with the JAMS International Arbitration Rules then in effect. Any judgment on the award rendered by the arbitrator and agreed to by both parties may be entered in any court having jurisdiction thereof. Notwithstanding the foregoing, each party shall have the right to institute an action in a court of proper jurisdiction for preliminary injunctive relief. If both parties are unable to resolve the claim or dispute, either party may commence an action in the appropriate court in Los Angeles County. In any action or proceeding to enforce rights under this Agreement, the prevailing party shall be entitled to recover costs and attorneys’ fees.
17.6 [INTENTIONALLYOMITTED]
17.7 No failure or delay by any party in exercising any right, power or privilege hereunder shaH operate as a waiver thereof nor shall any single or partial exercise thereof preclude any other or further exercise thereof or the exercise of any other right, power or privilege. The rights and remedies under this Agreement are cumulative and are in addition to and not in substitution for any other rights and remedies available at law or in equity or otherwise.
17.8 if any provision of this Agreement is held invalid or unenforceable by any court of competent jurisdiction, the other provisIons of this Agreement will remain in full force and effect. Any provision of this Agreement held invalid or unenforceable only in part or degree will remain in full force and effect to the extent not held invalid or unenforceable. The parties agree to replace such void or unenforceable provision of this Agreement with a valid and enforceable provision that will achieve, to the extent possible, the economic, business and other purpose of such void or unenforceable provision. Arctic Wolf does not accept, expressly or implledly, and rejects and deems deleted any additional or different terms or conditions that Customer presents, including, but not limited to, any terms or conditions contained Customer’s purchase order, or other such document, or established by trade usage or prior course of dealing
17.9 This Agreement (including the exhibits hereto, if any, and any BAA (as defined in Section 17.10 below)) constitutes the parties’ entire agreement by and between the parties with respect to the subject matter hereof and supersedes any prior or contemporaneous agreement or understanding by and among the parties with respect to such subject matter. Except as otherwise provided herein, this Agreement may be amended, modified or supplemented only by an agreement in writing signed by each party.
17.10 in the event that Arctic Wolf receives personal healthcare information in the delivery of the Solutions, the parties agree to comply with the BusIness Associate Addendum (“BAA”) located at https://arcticwolf.com/terms/business-associate-addendum/ or such other equivalent agreement/addendum as required under applicable health information/privacy laws. In the event the parties have entered into a BAA or equivalent agreement in relation to protected health information, the parties intend for both this Agreement and BAA or equivalent agreement to be binding upon them and the BAA or equivalent agreement is incorporated into this Agreement by reference.
17.11 The parties have participated mutually in the negotiation and drafting of this Agreement. In the event an ambiguity or question of intent or interpretation arises, this Agreement will be construed as if drafted mutually by the parties and no presumption or burden of proof will arise favoring or disfavoring any party by virtue of the authorship of any of the provisions of this Agreement.
Arctic Wolf Networks -Solutions Agreement
Last Updated: 08/ole021 Page 7 of 9
17.12 The parties have agreed that this Agreement as well as any notice, document or instrument relating to it be drawn up in English only; les parties aux pr6sentes ont convenu que la pr6sente convention ainsi que tous autres avis, actes ou documents s’y rattachant soient r6dig6s en anglais seulement.
17.13 Each party agrees that this Agreement and any other documents to be delivered in connection herewith may be electronically signed, and that any electronic signatures appearing on this Agreement or such other documents are the same as handwritten signatures for the purposes of validity, enforceability, and admissibility. This Agreement may be executed in two or more counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument
17.14. Insurance. During the Term of this Agreement, Arctic Wolf shall carry all insurance typically carried by businesses of its type and shall, upon request by Customer, provide a certificate of insurance reflecting such coverage. At a minimum, Arctic Wolf agrees to maintain the following insurance levels per occurrence: Worker’s Compensation and Employers' Liability at $1,000,000 (or, if greater, in compliance with statutory requirements), Commercial General Liability at $1,000,000 per claim, $2,000,000 in the aggregate, and E&O/Cyber Liability Insurance, with limits not less than $2,000,000, $2,000,000 excess. Coverage shall be sufficiently broad to respond to the duties and obligations as is undertaken by Vendor in this Agreement. [signature page to follow]
ArctIC Wolf Networks –SOlutIons Agreement
Last Updated: 08/Ole021 Page 8 of 9
IN WITNESS WHEREOF, the parties have caused this Agreement to be executed by their duly authorized representatives on the Effective Date
Arctic Wolf Networks, Inc.:Customer:
Signed:,/Signed:
Name: Nick Schneider Name: Claudia M. Frometa
Title: CEO Title: Mayor
D,t.: IOl 13) 20 ZI Date:
Notice Address:Notice Address:
PO Box 46390
Eden Prairie, MN 55344
Ann: General Counsel
legal@arcticwolf,com
11111 Brookshire Avenue
Downey, CA 90241
ATTEST:
Arctc Wolf Networks –SOlutIons Agreement
Last Updated : 08/01/2021 Page 9 of 9