SERVICES AGREEMENT
This Services Agreement (“Agreement”) is entered into as of this June 27, 2024 (the “Effective Date”), by and between:
Deep Seas, LLC, a California limited liability company having a principal place of business at 12121 Scripps Summit Drive, Suite #320, CA 92131 (“DeepSeas”) and City of Murrieta (“Customer”), having a principal place of business at 1 Town Square Murrieta, CA 92562 WHEREAS, DeepSeas renders specialized and highly confidential managed security services and technology to a variety of customers; and WHEREAS, Customer desires to purchase such specialized managed security services provided by DeepSeas in accordance with the terms and conditions contained herein.
NOW, THEREFORE, in consideration of the mutual promises and covenants contained herein, and other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the parties, DeepSeas and Customer, hereby agree as follows:
SERVICES
DeepSeas agrees to perform for Customer the managed security services described in Exhibit B (the “Services”), and Customer agrees to pay the fees and compensation described in Exhibit B for DeepSeas’ performance of the Services.
Unless otherwise agreed herein, DeepSeas, in connection with its performance of the Services, shall have no duty and shall not be responsible for:
retaining any data except as deemed necessary by DeepSeas, in its reasonable discretion, for performance of the Services; maintaining chain of custody of any Customer information, data, or findings for any purpose, including, but not limited to, pending or future litigation or investigation; implementing any recommended remediation tasks related to an Incident or arising from standard viruses, malware, or other issues unrelated to an Incident; or implementing any identified or recommended improvements to prevent future Incidents that are not part of DeepSeas’ commitment under the Services as described in Exhibit B.
DeepSeas shall have the right to unilaterally modify or discontinue any Service covered by this Agreement upon ninety (90) days written notice to the Customer. In such case, the fees for the modified or discontinued Service shall be reduced proportionately.
The Services, deliverables and pricing set forth in this Agreement are based upon the following assumptions and dependencies, and if any of the assumptions or dependencies prove to be incorrect or are not achieved in whole or in part, or if DeepSeas is requested to deviate from or add services or deliverables to this Agreement, then the parties will agree to appropriate and equitable adjustments to the Services, Deliverables, and/or pricing:
DeepSeas will conduct the Services remotely, with reimbursable travel to Customer’s offices as needed or requested, in which case Customer will permit DeepSeas personnel to visit its on-site facilities and meet with necessary Customer personnel. Travel will be subject to DeepSeas’ travel/expense policy and hourly rate.
If any member of DeepSeas’ team has performed work for twelve (12) months onsite at Customer’s offices, through performance under this Agreement, travel and expenses reimbursement will be considered taxable wages under IRS regulations, and therefore any tax gross-ups will also be submitted for reimbursement by DeepSeas and paid by Customer.
Differences of opinion relative to DeepSeas’ findings, conclusions and recommendations based upon its professional judgment and the information available to it shall not serve as the basis for rejection of DeepSeas’ work or the withholding of any payments otherwise due.
No hardware, equipment, software or licenses shall be purchased by DeepSeas for the performance of the work, other than the items described in this Agreement. If additional equipment, such as network taps, aggregators or span ports are required to complete the deployment, Customer shall be responsible for procuring that equipment. In addition, Customer will be invoiced for the cost of shipping Appliances and any additional equipment.
The Services may be completed, and analysis performed, using open source material. “Open source” material is defined as publicly available information without restriction, data or information licensed by DeepSeas, or other information that has been obtained by DeepSeas and which DeepSeas is authorized to retain and use in its analytic processes and products. DeepSeas makes no guarantee regarding the fitness of open source information for these tasks, nor can it guarantee that sufficient information or information of adequate quality will be available for all tasks. DeepSeas does not assume responsibility to independently verify the accuracy or completeness of the open source material. DeepSeas will not be obligated to procure additional information from any other sources.
TERM AND TERMINATION
The initial term of this Agreement shall extend from the Effective Date and continue in full force and effect for twelve (12) months (the “Initial Term”). The Initial Term and each Renewal Term shall be referred to herein as the “Term.” This SOW will terminate upon the natural expiration of the Term and will not otherwise automatically renew.
Either party shall have the right to terminate this Agreement for convenience at any time and for any reason upon sixty (60) days prior written notice to the other party.
Either party may terminate this Agreement immediately upon written notice to the other party in the event that: (i) the other party commits a material breach of any obligation imposed upon it by this Agreement (including without limitation the failure to make any payment when due hereunder) and such breach is not cured within thirty (30) days after notice thereof, or in the case of a failure to make any payment, the due date thereof; (ii) the other party becomes insolvent, subject to a petition in bankruptcy filed by or against it or placed under the control of a receiver, liquidator or committee of creditors; or (iii) the other party dissolves, ceases to function as a going concern or to conduct its operations in the normal course of business.
Termination in accordance with this Agreement, regardless of cause or nature, shall be without prejudice to any other rights or remedies of the parties and shall be without liability for any loss or damage occasioned thereby. Termination of this Agreement for any cause shall not release either party hereto from any liability, which at the time of termination has already accrued to the other party hereto or which thereafter may accrue in respect to any act or omission prior to termination, or from any obligation which is expressly stated herein to survive termination.
Notwithstanding anything herein to the contrary, (i) within thirty (30) days of termination of this Agreement by Customer pursuant to Section 2.2 or by DeepSeas pursuant to Section 2.3, Customer shall pay the amount of all unpaid fees, charges and Expenses incurred through the effective date of termination, plus any recurring fees and charges that would have been due through the remainder of the Term had the Agreement not been terminated early; and (ii) within thirty (30) days of termination of this Agreement by DeepSeas pursuant to Section 2.2 or by Customer pursuant to Section 2.3, Customer shall pay the amount of all unpaid fees, charges and Expenses incurred through the effective date of termination.
Within thirty (30) days of the effective date of termination of the Agreement, regardless of the cause or nature of the termination, Customer shall pay DeepSeas for any non-refundable purchases made, and/or non-refundable fees paid, by DeepSeas on behalf of Customer in connection with the Services, including third-party license fees paid by DeepSeas.
PRICING AND BILLING
Customer hereby consents to DeepSeas conducting a credit check of Customer.
The fees charged by DeepSeas for the Services shall be set forth in Exhibit B. All fees shall be paid in U.S. dollars. In addition to the fees for any Services, DeepSeas shall invoice and Customer shall pay for all expenses incurred by DeepSeas in connection with its delivery of the Services, including but not limited to, reasonable travel, meal and lodging expenses, as well as all shipping, delivery, messenger, materials and any other expenses directly related to the Services which are reasonably and properly incurred by DeepSeas in the course of providing the Services herein (the “Expenses”), and for which DeepSeas, upon request, provides invoices or other supporting documentation.
DeepSeas shall provide an annual upfront invoice to Customer for fees and Expenses beginning on the Effective Date. Expenses incurred after the Effective Date shall be invoiced on the last day of the month in which the Expenses were incurred. Customer shall pay DeepSeas within thirty (30) days from the date any invoice is received for all Services and Expenses. Any amount not so paid shall incur a late payment charge of one and one-half percent (1.5%) per month, or the highest amount allowed by law, whichever is less, until paid.
DeepSeas reserves the right to suspend Services if payment for such Services is not received from Customer within sixty (60) days from the date the invoice is received by Customer, except for amounts subject to a good faith dispute, as described below. Customer shall be liable for the outstanding balance owed plus interest and any other damages owed as a result of a breach of its payment obligations, including reasonable collection costs incurred by DeepSeas. In addition to the late payment charges specified in Section 3.3, Customer shall pay a reinstatement fee equal to ten percent (10%) of the amount past due for any such suspended Services (the “Reinstatement Fee”). Services shall only be reinstated upon DeepSeas’ receipt of the Reinstatement Fee and all other sums due (including late payment charges).
If Customer, in good faith, disputes any invoiced amount, it shall notify DeepSeas in writing to advise it of the disputed invoice and provide documentation identifying the fees and Expenses which are in dispute and the reason for such dispute. Such notice must be provided to DeepSeas within thirty (30) days of receipt of the disputed invoice. The parties shall investigate the matter and upon mutual agreement, either a credit against future invoices will be issued by DeepSeas, or the disputed amount shall be promptly paid to DeepSeas. Any invoice dispute not raised by Customer within thirty (30) days of the date of the invoice is waived.
DeepSeas reserves the right to modify the fees and charges assessed to Customer during a Renewal Term by providing sixty (60) days advance written notice to Customer; provided, however, that any year-to-year increase to pricing in excess of 5% shall require ninety (90) days advance written notice to Customer.
All fees, Expenses and other charges due hereunder are exclusive of all applicable taxes, including value added taxes, sales taxes, and duties or levies imposed by any authority, government or government agency (except income tax or other corporate taxes attributable to DeepSeas), all of which shall be paid promptly, and Customer agrees to indemnify and hold DeepSeas harmless from any liability thereof.
All invoices and payments shall be sent to the following respective address:
Invoices shall be sent to:
Payments shall be sent to:
City of Murrieta
DeepSeas, LLC
12121 Scripps Summit Drive
Suite #320
San Diego, CA 92131
Attention:
Address: 1 Town Square, Murrieta, CA 92562
Email Address:
Is a Purchase Order required? ☐ YES ☐ NO
Any Purchase Order “PO” issued by Customer and applicable to the services listed in this Service Agreement shall be used for processing payment only, and any terms and conditions included in such PO shall not apply
CONFIDENTIALITY AND PROPRIETARY INFORMATION
Both parties acknowledge that, during the Term of this Agreement, each party may provide the other with or otherwise expose them to confidential and/or proprietary information, including but not limited to data, information, ideas, materials, specifications, procedures, software, technical processes and formulas, product designs, sales, cost and other unpublished financial information, product and business plans, usage rates, marketing data or other relevant information clearly intended to be confidential (collectively, “Confidential Information”).
Each party shall protect all such Confidential Information of the other with at least the same degree of care it uses to protect its own confidential information, but not less than a reasonable degree of care, and shall not disclose to any third party or use such Confidential Information in any manner not authorized herein. Neither party shall use, disclose, provide, or permit any person to obtain any such Confidential Information in any form, except for its employees, agents or independent contractors whose access is required to carry out the purposes of this Agreement and who have agreed to be subject to the same restrictions as set forth herein. The obligations of this Section 4 shall survive the termination or expiration, for whatever reason, of this Agreement, and will continue to apply as long as the confidential nature of the Confidential Information is maintained.
Confidential Information shall not include information which: (i) is or becomes known publicly through no fault of the receiving party; (ii) is learned by the receiving party from a third party entitled to disclose it; (iii) is already known to the receiving party before receipt from the disclosing party; (iv) is independently developed by the receiving party without reference to the Confidential Information; or (v) must be disclosed by legal process or governmental request. The receiving party shall promptly notify the disclosing party of any such request for disclosure in order to allow the disclosing party full opportunity to seek the appropriate protective orders.
All Confidential Information shall remain the property of the party releasing it, and such Confidential Information shall be returned to the other party or destroyed, upon request and upon the expiration or termination of this Agreement.
The parties agree and recognize that disclosure or use of any Confidential Information of the other may cause irreparable harm to the non-disclosing party, which would be inadequately compensable in damages. Accordingly, the non-disclosing party may seek injunctive relief, without the necessity of a bond, against the breach or threatened breach of these provisions, in addition to any other legal remedies which may be available.
COMPLIANCE WITH LAWS
In performing this Agreement, each party shall comply with all laws and regulations applicable to this Agreement or the transactions contemplated hereby.
Customer acknowledges that DeepSeas has entered into this agreement with Customer in material reliance on the following representations and covenants made by Customer:
Neither this Agreement, the relationship created hereby nor the performance hereof is contrary to the current material laws, rules, or regulations of each jurisdiction in which the Services will be performed; and Customer has obtained all necessary licenses, permits and other governmental approvals required for Customer’s activities pursuant to this Agreement, and Customer shall cause such licenses, permits and approvals to remain in full force and effect during the Term.
WARRANTY, LIMITATION OF LIABILITY AND INDEMNIFICATION
The parties recognize that the field of information security is one in which the risks and threats change daily, neither DeepSeas nor Customer can anticipate each and every threat which can develop in the future and, as such, the Services cannot prevent or defend against every possible threat. The parties acknowledge and agree that the following disclaimers and limitations of liability represent bargained for allocations of risk, and that the economics, terms and conditions of this Agreement are based upon and reflect such allocations.
DEEPSEAS MAKES NO REPRESENTATION OR WARRANTY OF ANY KIND, WHETHER EXPRESS OR IMPLIED, WITH RESPECT TO THE SERVICES, INCLUDING WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE, AND INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES ARISING BY STATUTE OR OTHERWISE AT LAW OR FROM A COURSE OF DEALING, USAGE OR TRADE. THE SERVICES ARE PROVIDED “AS IS.” DEEPSEAS DOES NOT WARRANT THAT THE SERVICES OR ANY PART THEREOF WILL OPERATE ERROR-FREE OR UNINTERRUPTED.
EXCEPT IN THE CASE OF A BREACH OF CONFIDENTIALITY OBLIGATIONS, NO PARTY SHALL BE LIABLE TO THE OTHER FOR ANY CONSEQUENTIAL, INCIDENTAL, INDIRECT, SPECIAL, PUNITIVE OR EXEMPLARY DAMAGES (INCLUDING LOST PROFITS AND LOST SAVINGS) SUFFERED OR INCURRED BY SUCH OTHER PARTY IN CONNECTION WITH THE SERVICES OR ANY OTHER MATTER COVERED BY THIS AGREEMENT, REGARDLESS OF THE FORM OR THEORY OF THE ACTION (INCLUDING NEGLIGENCE), EVEN IF SUCH OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. EACH PARTY’S TOTAL LIABILITY TO THE OTHER IN CONNECTION WITH THIS AGREEMENT SHALL NOT EXCEED THE AMOUNTS ACTUALLY PAID BY CUSTOMER TO DEEPSEAS IN THE PRIOR SIX MONTHS, PROVIDED THAT THIS LIMITATION OF LIABILITY SHALL NOT APPLY TO AMOUNTS DUE FROM CUSTOMER UNDER THE SPECIFIC TERMS OF THIS AGREEMENT.
Notwithstanding any of the foregoing, DeepSeas shall not be responsible for any damages resulting from any inaccurate or incomplete information provided by Customer or its agents. DeepSeas shall also not be responsible for the consequences of any work performed, modifications made to the Services, or for any hardware or software provided by Customer, its agents or any third parties.
DeepSeas’ obligations under this Agreement shall be void and invalidated to the extent the Services are modified in any manner not authorized by DeepSeas and that adversely affects the performance or reliability of the Services. DeepSeas has the right to modify the Services as DeepSeas sees fit for best operation of the Services as determined by DeepSeas.
In no event will DeepSeas be liable to Customer or other third parties for any (i) damages caused by Customer’s failure to perform its covenants and responsibilities, (ii) damages caused by repairs, maintenance, or alterations done without DeepSeas’ prior written approval; (iii) damages due to any inaccurate or incomplete information provided by Customer, its employees, or agents; or (iv) loss of data, profits, or use of the Services. Customer shall indemnify, defend and hold harmless DeepSeas (and its affiliates, employees, agents, directors and officers) from and against any and all third-party liabilities, costs, damages and expenses, including attorney’s fees and litigation expenses (collectively, “Damages”), resulting from Customer’s (or its employees, agents, directors or officers) gross negligence, material breach of any provision in this Agreement, willful misconduct, violation of any applicable law or regulation, misrepresentation of the Services or any and all illegal acts.
DeepSeas shall indemnify, defend, and hold harmless Customer (and its affiliates, employees, agents, directors and officers) from and against any and all Damages resulting from DeepSeas’ (or its employees, agents, directors or officers) gross negligence, material breach of any provision in this Agreement, willful misconduct, violation of any applicable law or regulation, illegal acts, or fraudulent misrepresentation of the Services.
CUSTOMER OBLIGATIONS AND RESPONSIBILITIES
Access to Customer’s Computer Systems. Customer shall facilitate necessary access to its computer systems, documentation, and networks as needed to perform and deliver the Services.
Full Cooperation. Customer shall provide all information, access and full, good faith cooperation reasonably necessary for the delivery and provisioning of the Services. In the event Customer fails to comply with the foregoing, DeepSeas shall be relieved of its obligations hereunder to the extent such obligations are dependent on Customer’s performance of its obligations. In such an event, Customer’s payment obligations are still in full force and effect.
Customer Premise Equipment. If Customer is provided with any premise equipment for use while receiving the Services, Customer shall return such hardware to DeepSeas at the address provided for in Section 3.8 upon the expiration or termination of this Agreement. Customer shall be responsible for adequately packing and shipping with insurance the hardware to DeepSeas within fifteen (15) business days. If such hardware is not returned or is not returned in good working order, Customer will be liable for its full replacement costs.
Return or Destruction of Confidential Information. Upon termination of this Agreement, Customer shall immediately cease use of all DeepSeas Confidential Information and third-party software not otherwise licensed by Customer. Within thirty (30) days after any termination, Customer shall irretrievably destroy or, upon reasonable request, deliver to DeepSeas all copies of the DeepSeas Confidential Information and the DeepSeas materials in every form, except to the extent that Customer is legally authorized or required to keep it for a longer period, in which case such return or destruction shall occur at the end of such period, and during such period, Customer shall continue to be bound by any and all confidentiality obligations associated with such Confidential Information. Upon request, Customer shall certify in writing that it and each of its affiliates has performed the foregoing.
Use of Certain Customer Data. Customer grants DeepSeas the right to retain a copy of any data identified by DeepSeas, in its sole discretion, as malware or forensic data related to malware, including any data which contains embedded malware or is related to any Compromise or Incident. Customer also grants to DeepSeas and its successors and assigns a worldwide, perpetual, irrevocable, non-exclusive, royalty-free license to duplicate, sell, transmit, publish, modify, distribute, publicly display, summarize, alter, compile, and create derivative works of any such data. Customer agrees that DeepSeas may sublicense or transfer any and all of these rights to third parties provided either (a) such data is scrubbed to remove any identifiable connection to Customer; or (b) if the retained data contains Confidential Information, such third parties agree in writing to the provisions of the Agreement regarding the treatment of Confidential Information.
General Responsibilities. Customer is solely responsible for:
Any response and/or remediation recommended by DeepSeas in the course of performing the Services; Appointing, and keeping updated, a primary contact that is reachable by DeepSeas at all times and possesses decision-making authority, to handle all communications involved with the Services; Promptly providing all information and access requested by DeepSeas in connection with the Services, including, but not limited to: (a) access to offices, sites, buildings, and facilities during normal business hours in accordance with Customer’s security standards, and suitable workspace to accommodate DeepSeas consultants, infrastructure, and systems; (b) a description of the size of the system environment (number of employees, computers, servers, proxies, routers and networks); (c) an overview of all system environment architecture/ components; (d) logs, including those tracking proxy, firewall, IDS/IPS, NetFlow, email, and DNS activity; and (e) all other information requested by DeepSeas in connection with the Services; Promptly authorizing DeepSeas to take all actions deemed, in its sole discretion, necessary to perform the Services, including but not limited to: (a) installing and maintaining Appliances and Endpoint Software as well as any updates required by DeepSeas in a prompt manner; (b) installing network taps/sniffers and/or Software (e.g., at Customer Internet gateways); (c) installing file system scanners; (d) imaging hard drives and/or other memory; (e) collecting malware/forensic artifacts; (f) reconstructing adversarial activity; (g) assessing end points for infection; (h) assessing network communications for malicious activity; and (i) collecting any data or forensic information related to the Services including Internet browsing histories, registries, process monitoring, and file system usage; Obtaining all necessary rights and permissions from Users; Executing in a prompt manner any other agreement, including licensing agreements, DeepSeas requires Customer to execute in order to enable DeepSeas to perform the Services; Ensuring the accuracy, quality, integrity, legality, reliability, appropriateness, completeness, creation, maintenance, and updating of all Customer information; and Providing its own connection to the Internet through one or more Internet services providers of its choice in order to access the Services.
Notification of Changes. The configuration of Customer’s environment, such as use of third-party spam filters or software, may require DeepSeas to alter the standard deployment of its Services and may affect the effectiveness or accuracy of the Services. Customer shall promptly notify DeepSeas of any change to its software, hardware, or configuration of the environment that may impact DeepSeas’ performance of the Services.
Backup and Alternatives Systems. Customer acknowledges and agrees that DeepSeas’ access to and use of any of Customer’s systems, networks and applications as may be reasonably necessary for the purpose of DeepSeas’ performance of the work described herein, including but not limited to tests, simulations or scans conducted by DeepSeas, could result in disruptions to, including the unavailability of such systems, networks and applications. Customer shall at all times during the performance of this Agreement maintain alternative communication systems and back up or archival versions of all current data and applications contained on its information systems, which systems may be tested or otherwise used by DeepSeas and maintain and fully comply with prudent storage and backup processes and procedures for its systems, networks, data, and applications. Customer represents and warrants that Customer has the full power and right and authority to permit DeepSeas to access and use the systems, networks and applications necessary to perform the work described herein. DeepSeas shall not be responsible for any losses, claims, or liabilities, including but not limited to loss of data, resulting from its access to and use of such systems, networks and applications in accordance with this Agreement or Customer’s failure to fully comply with any back up processes and procedures.
Third-Party Hardware and Software. The parties understand that DeepSeas’ successful performance of the Services, and/or any work product delivered under this Agreement, may include and/or require use by Customer of certain third-party hardware and/or software products. Unless otherwise agreed in writing, Customer shall be solely responsible for procuring, obtaining, installing, configuring, testing and making operational such third-party hardware and/or software and any rights or licenses to use and/or incorporate into its systems such third-party hardware and/or software, including without limitation the right to make such third-party hardware and/or software available to DeepSeas as necessary to enable DeepSeas to perform the Services; and DeepSeas shall undertake no obligation to procure or provide to Customer or to install, configure, test or make operational such third-party hardware and/or software. The quality, capabilities, operations, performance and suitability of any third-party hardware and/or software lies solely with Customer and the vendor of such third-party hardware and/or software.
Additional Hardware, Equipment, Software and Licenses. If hardware, equipment, software or licenses, other than as indicated herein, is required to complete the deployment of the Service, Customer shall be responsible for procuring such hardware, equipment, software or licenses.
Sublicences. Customer shall not sublicense any rights under this Agreement to any third party (including its parent, affiliates or subsidiaries) without the prior written permission of DeepSeas.
APPLIANCES
Disclaimers.
DeepSeas shall not be liable to Customer or any third party for: (i) any damage that Customer or any Authorized User may suffer arising out of the use of or the inability to use the Appliances unless such damage is caused by willful misconduct or a grossly negligent act of DeepSeas; (ii) the content of information or data provided or transmitted by Customer or any Authorized User; (iii) Appliance service impairments caused by acts within the control of Customer, its employees or authorized agents; (iv) interoperability of specific Customer applications; (v) Customer’s inability to access or interact with other providers or their services through the internet provided such inability is not directly caused by DeepSeas; and/or (vi) performance impairments caused on the internet provided they are not directly caused by DeepSeas.
DeepSeas does not warrant that the Appliances or Appliance software (“Appliance Software”) will be free from impairments, disruption, viruses, errors, interruption, or failure, or that monitoring of such Appliances, or Appliance Software will protect Customer against all possible security threats, including willful misconduct by third parties or by Customer or Customer’s employees or agents. DeepSeas does not warrant that the Appliances, monitoring of such Appliances, or Appliance Software will meet Customer’s requirements or that they will be interoperable with Customer’s or any third party’s solutions, services, software, or applications.
DeepSeas makes no warranties, express or implied with respect to the Appliances or any Appliance Software provided by DeepSeas to Customer and used in connection with the Services. Specifically, but without limitation, DeepSeas disclaims and makes no warranty to Customer whether express, implied, or statutory as to the merchantability, freedom from infringement, or fitness for any particular purpose of any Appliance or Appliance Software. Furthermore, DeepSeas shall not be liable to the extent that any breach results from any act/omission of Customer, its employees, or agents.
Intellectual Property of Appliances. The Appliances and associated monitoring services incorporate and include certain intellectual property rights of DeepSeas, its affiliates and its licensors, embodied in hardware, Appliance Software and Appliance documentation, support, and employee expertise (“Appliance Intellectual Property”). In addition to any other rights of Customer under the Agreement and licenses granted to Customer under the Agreement, and without limiting such rights or licenses in any way, for the Term and purposes of this Agreement, Customer shall have a limited, non-exclusive, non-transferable license to this Appliance Intellectual Property for Customer’s use of the Appliances and associated monitoring services, including without limitation, for use in connection with work product and Deliverables as contemplated elsewhere in this Agreement. Customer will not, or knowingly permit any third party to: (i) decompile, reverse engineer, copy, or disassemble the Appliance or Appliance Software; (ii) modify, destroy, rent, lease, loan, sell, or distribute all or any part of the Appliance Intellectual Property, Appliance manuals, or Appliance documentation; (iii) create derivative works – excluding Deliverables, reports and work product – based in whole or in part upon the Appliance Intellectual Property; or (iv) assist in the development of competing Appliances or Appliance Software and/or monitoring services of a third party utilizing Appliance Intellectual Property.
Safeguarding Appliances.
Customer shall safeguard the Appliance(s) and prevent damage to, or loss of, the Appliance(s). Customer assumes and shall bear the risk of theft, loss, destruction, or damage to the Appliance(s) from the time the Appliance is in its possession until this Agreement is terminated or expires or DeepSeas removes the Appliances after an Incident as part of the normal course of providing Services during the Term or at the request of Customer (whichever is sooner), and DeepSeas has obtained or received possession of the Appliance(s) in the same condition as they were in when DeepSeas provided them to Customer, except for normal wear and tear, as determined by DeepSeas in its sole judgment and discretion (“Acceptable Condition”). Customer will not make any modifications to the Appliances without the written permission of DeepSeas and will pay the cost of any repairs necessitated by unauthorized work.
DeepSeas will appropriately maintain all DeepSeas-installed Appliances through the duration of the Services covered by this Agreement. Customer shall not modify, remove, or relocate any Appliance(s) without the written permission of DeepSeas, and Customer shall pay all costs of any repairs or service work necessitated by unauthorized modification, or removal or relocation from the Customer’s premises or place of business where the Appliance is located. In the event an Appliance is stolen, lost, misplaced, damaged, or becomes nonfunctional, Customer shall notify DeepSeas of such event promptly after it becomes aware of such event. Customer will permit DeepSeas access to all Appliances on Customer’s premises used to provide the Services hereunder.
Delivery, Inspection, Acceptance and Returns.
Appliances and any related Appliance products (“Products”) will be shipped to delivery destination identified by the Customer. Shipping charges will be added to the invoice and paid by the Customer.
Customer shall inspect Products upon delivery and notify DeepSeas of any damaged Appliances received within fifteen (15) days of delivery. DeepSeas will exchange or replace damaged Appliances at DeepSeas’ sole discretion. DeepSeas may accept the return of new, unopened, unconfigured Appliances in accordance with the DeepSeas Returns Policy. Custom-made products, special order items and cables cannot be returned. Appliance Software shall be deemed accepted by Customer upon delivery.
Appliance Security Interest. DeepSeas hereby reserves a purchase money security interest in the Appliances and Products to secure payment of the purchase price, license fees and any related installation charges for such Products. The security interest shall continue in effect until such amounts are paid in full by Customer.
Appliance License. DeepSeas hereby grants Customer a non-exclusive, non-sublicensable, and non-transferable right to allow its Authorized Users to access an administrative interface to the Appliance and associated services during the Term solely for Customer’s internal purposes and not for the benefit of any third party except as may be otherwise provided for in the Agreement. Administrative access to the Appliance is limited to the Authorized Users to access and use the administrative components of the Appliance and Services. Customer acknowledges and agrees that Customer is solely responsible for ensuring that Authorized Users comply with this Agreement, and Customer shall be solely responsible for any breach of this Agreement due to the willful misconduct or gross negligence of any Authorized User (except DeepSeas). Customer shall make no attempt to, and shall not permit any affiliate, Authorized User, or third party to make any attempt to: (a) remove or modify any markings or any notice of DeepSeas or its licensors’ proprietary rights; (b) make the Appliances or Appliance Software, or any materials thereof available in any manner to any third party for use in the third party’s business operations; (c) alter, adapt, modify, improve, or reverse engineer any part of the Appliances; (d) interfere in any manner with the installation, maintenance, or continued operation of the Appliances; (e) license, sell, rent, lease, transfer, assign, distribute, host, outsource, permit timesharing, or otherwise commercially exploit the Appliances or Appliance Software; or (f) otherwise use the Appliances or Appliance Software not in accordance with this Agreement. Customer acknowledges that, except as expressly set forth herein, DeepSeas has no delivery obligation and will not ship or otherwise transfer any copies of the Appliance Software to Customer as part of the Appliance or services unless requested by Customer.
Appliance Software Licenses. All Appliance Software distributed or licensed by DeepSeas is subject to applicable Software license agreements (i.e., Appliance Software licenses) between the software publisher (including, as applicable, DeepSeas, its affiliates, or third parties) and Customer. DeepSeas shall license or cause its affiliates to license, to Customer the requisite license rights and terms and conditions with respect to such distributed Appliance Software as applicable. Customer’s compliance with any publisher’s software licenses of such distributed Appliance Software is Customer’s responsibility. Customer agrees to comply with and be bound by the terms and conditions of the applicable distributed Appliance Software in exchange for its use of such Appliance Software under this Agreement. If any such software is subject to shrink-wrap, click-through, on screen or similar license agreements that must be accepted during any installation or configuration service performed for Customer by DeepSeas, Customer authorizes DeepSeas to accept the terms of such agreements on behalf of Customer.
Appliance Warranties. The Appliance warranties in this Section do not cover services required to repair damages, malfunctions or failures caused by (i) Customer’s failure to follow DeepSeas’ or the Appliance manufacturers’ instructions; (ii) Customer’s unauthorized repair, modifications or relocation of Appliance equipment used to provide monitoring services hereunder or the attachment to such equipment of non-DeepSeas authorized equipment; or (iii) Customer’s abuse, misuse, or negligent acts.
Return of Appliances. No later than fifteen (15) days after termination of this Agreement for any reason, Customer shall return to DeepSeas all Appliances provided to it by DeepSeas that were provided to a domestic U.S. address. If Customer fails to return such Appliance(s) within this time period, or if DeepSeas determines that returned Appliance(s) are not in acceptable condition at the time of return, Customer shall pay the cost to replace the unreturned or damaged Appliance(s).
NOTICE
All notices, requests, or other communications hereunder shall be in writing, addressed to the parties as follows:
If to Customer:
If to DeepSeas:
City of Murrieta
DeepSeas, LLC
12121 Scripps Summit Drive
Suite #320
San Diego, CA 92131
Attn: Legal Department
Email: [email protected]
Attention:
Address: 1 Town Square, Murrieta, CA 92562
Phone/Email:
If either party wishes to alter the address to which communications to it are sent, it may do so by providing the new address in writing to the other party.
USE OF DEEPSEAS LOGOS
DeepSeas grants Customer a non-exclusive, non-transferable, revocable license to use DeepSeas logos (the “Logos”), all pursuant to the terms and conditions set forth in this Agreement. Customer acknowledges that it is granted no rights with respect to DeepSeas’ trademarks, including the Logos, except as expressly set forth herein.
DeepSeas may modify any of the Logos from time to time, and Customer agrees to stop using any prior version of a Logo following any such modification. Upon reasonable notice from DeepSeas, Customer shall promptly modify its use of any Logo to conform to any such changed Logo or related guidelines.
Prior to its use of any Logo, Customer must submit a proposal to DeepSeas setting forth the design of the Logo that Customer wishes to use, as well as the proposed context for its usage. DeepSeas will review any such proposal and provide written notice of its consent to or rejection of such proposal. Under no circumstances shall Customer use any Logo unless and until DeepSeas has provided written consent for its use. If at any time DeepSeas determines that Customer’s use of a Logo is not in compliance with this Agreement or DeepSeas’ quality standards, Customer shall promptly modify or discontinue its use of the Logo as directed by DeepSeas.
Customer shall not use the Logos in any manner that (i) misrepresents its relationship with DeepSeas or is otherwise misleading, (ii) reflects negatively on DeepSeas, or (iii) could cause confusion as to DeepSeas’ ownership of the Logos. Customer shall not alter, modify, or change the Logos in any way without the prior written consent of DeepSeas. Customer agrees not to use the Logos or potentially confusing variations of the Logos as a part of any of Customer’s trademarks, product names or service names.
This license may be terminated by DeepSeas at any time and for any reason upon written notice to Customer. Upon termination of the license, Customer shall immediately cease all use of the Logos.
Customer agrees to indemnify, defend, and hold harmless DeepSeas from any and all claims, damages, expenses and liabilities arising out of or in any way related to Customer’s use of the Logos.
DEFINITIONS
In this Agreement, the following words and phrases shall bear the following meanings unless the context indicates otherwise “Affiliate” is any legal entity which directly or indirectly, holds more than fifty percent (50%) of the shares or voting rights of a party. Any such legal entity shall be considered an Affiliate for only such time as such equity interest is maintained. “Appliance” shall refer to hardware device which may be pre-loaded with Software and installed on Customer’s environment to enable DeepSeas’ performance of the Services. This includes, but is not limited to the network sensors, collectors or other hardware provided under this Agreement. “Associated Parties” shall refer to a party’s Affiliates, directors, officers, employees, agents, licensors, vendors, or subcontractors. “Authorized User” shall refer to any employee or third-party user that requires access to the Software or Services and has been identified in writing by Customer to DeepSeas as being authorized to use the administrative components of the Software or Services. “Availability” shall mean the percentage of time a specific component of the Services is Available to the Customer during a given month, subject to certain exceptions.
TOTAL NUMBER OF MINUTES PER MONTH SERVICE AVAILABLE TO CUSTOMER AVAILABILITY = ------------------------------------------------------------------------------------------------------------
TOTAL NUMBER OF MINUTES IN THE MONTH
Example: If total number of minutes the Software was unavailable to the Customer (for reasons not set forth in the list of exceptions) was 120 minutes and the total number of minutes in the month is 43,200, then the Availability calculation for that month would be as follows: 43080/43200 = 99.72% “Compromise” shall refer to an Incident ranging from an individual/small-scale operation (e.g., insiders, suppliers and activists) to large-scale, organized efforts (e.g., perpetrated by criminal networks and/or foreign governments). “Covered Device” shall refer to Customer log device or data source specified within this Agreement and any exhibit hereto and including information describing the log source such as the device’s manufacturer, vendor, Device Type, and specified use case. “Custom Log Source” or “Custom Device” shall refer to any log source that requires development of software code to parse log data for the Analytics Platform. Examples include the following: Application logs, web server logs, database logs, or any devices as defined by DeepSeas. “Customer Information” shall refer to any information, records, data, or any other materials (in whatever form) entered into the Software or Endpoint Software by Customer or any User or any Authorized User. “Customer Portal (CP)” shall refer to the internet-based web portal designed to provide log data, alerts, reports, graphs, dashboards, analysis tools, Customer tickets, notifications, and other related information applicable to the Services. “DeepSeas” includes its subsidiaries and Affiliates, and their respective directors, officers, employees, agents, attorneys, representatives, subcontractors, and suppliers. “DeepSeas Materials” includes (a) any Software, hardware, documentation, and/or other materials including, without limitation, the following: (i) Software and Appliances; (ii) computer software (object and/or source codes and/or scripts), programming techniques and programming concepts, methods of processing and use, and system designs embodied in the software; (iii) benchmark results, manuals, program listings, data structures, flow charts, logic diagrams, functional specifications, file formats; and (iv) Intellectual Property Rights, including but not limited to, discoveries, inventions, concepts, designs, documentation, product specifications, application program interface specifications, techniques and processes relating to the software; (b) the research and development or investigations of DeepSeas; (c) product offerings, content partners, product pricing, product availability, technical drawings, algorithms, processes, ideas, techniques, terms and conditions of this Agreement, formulas, data, schematics, trade secrets, know-how, improvements, marketing plans, Customer lists, financial information, forecasts and strategies; (d) any information about or concerning any third party (which information was provided to DeepSeas subject to an applicable confidentiality obligation to such third party); and (e) any enhancements, modifications or derivatives of such materials. DeepSeas Materials shall be considered Confidential Information. “Device Type” shall refer to the category name used to classify a Covered Device for purposes of determining the pricing category specified within this Agreement. DeepSeas may at its own discretion update, refine, add, remove, and re-categorize Device Types at its sole and complete discretion. “Enablement” shall refer to work undertaken by DeepSeas to set up, configure, implement, and provision the Services. “Endpoint Software” shall refer to the Endpoint Detection & Response software provided by DeepSeas for Customer use and in accordance with the terms of this Agreement and the Endpoint EULA included in the Service Description. “Engagement Period” shall start upon the Effective Date and shall end upon completion or other termination of this Agreement. “Events per Second (EPS)” shall refer to total quantity of Log Events received in aggregate from all Covered Devices during any 24-hour period converted to seconds. “Host/Network Log Source” shall refer to the Device Type name that refers to a defined category of devices including windows and Linux servers, PCs, routers, switches, wireless access points, and other similar devices as defined by DeepSeas and that DeepSeas may update or change from time to time. “Incident” shall refer to the presence of malicious software such as Trojans, worms, viruses, and spyware; password phishing; cyber-attack; cyber-intrusion; hacking; data breach; unauthorized access; denial of service; malware; bots; system Compromise or other computer security breach. “Log Analytics Platform” shall refer to a system that collects and analyzes log data feeds from the Customer’s network and security devices with the purpose of identifying activity, patterns and behaviors that are an indicator of a security threat. “Log Collector” shall refer to DeepSeas’ hardware Customer Premise Equipment (CPE) or software placed within the Customer’s network or virtual environment for delivering the Service to the Customer. The Log Collector collects, aggregates, and/or analyzes the Customer’s log data sent to it from the Covered Devices. “Log Collector Type” shall refer to DeepSeas’ Log Collector, which will be specified as either a “Physical” Log Collector, or a “Virtual” Log Collector. A Physical Log Collector is a PC server-based hardware appliance, and a Virtual Log Collector is a software image, agent, or application prepared for installation into a Customer’s virtual infrastructure, server, or workstation. “Log Event” shall refer to log data output in the form of a common syslog formatted data stream received from a Covered Device by the Log Collector. “Managed Detection and Respond Services” includes validation of alerts generated by the Endpoint Software and Software, delivering notification to Customer of any legitimate threats identified from an alert, monitoring of all Endpoint Software and Software to ensure it is up to date, running and operating as expected. Identification of legitimate threats without the aid of an alert is considered Threat Hunting. Response that requires reverse engineering, Customer threat research, on-site support at a Customer location, coordination of remediation activities across multiple systems or response to a historic embedded attack is considered Advanced Incident Response. “Private Information” includes information comprising personally identifying (e.g., PHI, ePHI, PPI, PCI, PHP) or proprietary network information related to Customer and third parties which interact with Customer. Private Information may also include network, equipment, files, databases, logs, and other sources of information which may support the Services. “Provisioning Document” shall refer to a document provided by DeepSeas which contains requested information and documentation from the Customer needed to properly set-up and configure the Services. Information to be provided by the Customer within the Provisioning Document include the placement of Log Collectors in the Customer network, power, rack and cabling requirements, IP address assignments, device weighting, zone information, location, network segments, DMZs, etc. “Services Charge” is the sum of the labor fees, the travel related expenses, and other actual expenses/costs described in this Agreement. “Service Level” shall refer to the scope of the services provided by the DeepSeas to the Customer, which include the pre-defined responsibilities, duties, tasks, and obligations of DeepSeas. “Service Option” shall refer to an optional service component that offers coverage for an additional specified capability for an additional cost to the Customer and further defined within DeepSeas’ Scope of Work. “Services” shall refer to services, including monitoring services and access to the Software, provided by DeepSeas as identified in this Agreement. “Software” shall refer to the software provided by DeepSeas as identified in this Agreement other than Endpoint Software. “SOC” shall refer to the Security Operations Center where DeepSeas’ security operators, analysts, engineers, and other personnel perform analysis and triage of logs, Alerts, Security Events, and provide response or communications with the Customer as appropriate. “Threat Hunting” shall refer to the proactive service designed to identify attacks independent of an alert generated from any other service. “Threat Notification” shall refer to the information provided by DeepSeas in response to a Security Event or other event requiring Customer notification as determined by DeepSeas. Security Event Notifications are provided via a phone call or in the form of a Threat Notification, which is DeepSeas’ Customer notification template. “User” shall refer to any individual affiliated with Customer, including Customer’s Authorized Users, that gains access to the Software or Services or that transmits any data to or through the Software or Services because of this Agreement.
GENERAL PROVISIONS
This Agreement and Exhibit B attached hereto constitute the full and entire understanding and agreement between the parties with respect to the subject hereof, and supersede any and all prior agreements and understandings, whether oral or written pertaining to this subject. This Agreement in its entirety shall not be varied, supplemented, qualified, or interpreted by any prior course of dealing between the parties hereto or by any usage of trade. This Agreement may be amended or modified only by a written document executed by DeepSeas and Customer.
This Agreement shall be governed by and will be interpreted and construed in accordance with the laws of the State of California, without regard to conflicts of law principles, and the parties consent to the sole and exclusive jurisdiction of the federal and state courts of the State of California in San Diego County for all actions arising hereunder.
This Agreement is not an exclusive contract for the provision of services of the type that make up the Services or any part of them. Without limiting the generality of the foregoing, DeepSeas acknowledges that Customer might engage other service providers or procure services or products from any third party substantially the same as or identical to the Services or any products herein at any time and by any means.
The terms, rights, and obligations under this Agreement, which by their nature should survive, will remain in effect after termination or expiration of this Agreement.
The failure of either party to enforce at any time any provision of this Agreement shall not be construed to be a waiver of any such provision and shall not affect the validity of this Agreement or any part thereof or the right of either party to, in the future, enforce such provision. No waiver of any breach hereof shall be construed to be a waiver of any other breach. All rights and remedies hereunder shall be cumulative, may be exercised singularly or concurrently and, unless otherwise stated herein, shall not be deemed exclusive.
Neither party shall be liable for any default or delay in performance of its obligations hereunder (excluding any obligation to make timely payments as provided hereunder) to the extent the same is attributable to events beyond the reasonable control of such party, including, without limitation, acts of God, acts of public enemies, civil commotions, embargoes, epidemics, quarantine restrictions, floods, fires, earthquakes, unusually severe weather conditions, strikes, labor disputes, accidents, mechanical breakdowns and governmental actions.
Customer may not assign or transfer all or any part of its rights or obligations under this Agreement without the prior written consent of DeepSeas, which consent will not be unreasonably withheld. This Agreement shall be binding upon, and shall inure to the benefit of, the parties and their respective successors and permitted assigns. Notwithstanding the above, Customer shall have the right to assign or transfer all of its rights and obligations under this Agreement in connection with the sale of all or substantially all of its assets in a bona fide third party sale.
The invalidity or non-enforceability of any provision of this Agreement shall not affect the validity or enforceability of any other provision of this Agreement.
The captions contained herein are for convenience and in no way define, limit or enlarge the scope of this Agreement or any of its Sections.
This Agreement may be executed in one or more counterparts, each of which shall be deemed to be an original, but all of which shall together constitute one and the same Agreement.
IN WITNESS WHEREOF, the parties hereto have caused two (2) originals of this Services Agreement to be executed by their duly authorized representatives.
Deep Seas, LLC City of Murrieta
By: By:
Name: Name:
Title: Title:
Date: Date:
EXHIBIT A
SUPPORT TERMS
For the on-going services, DeepSeas will provide the level of services as described in this Exhibit A. Support shall only be provided to Customer’s technical staff members, and only in accordance with the DeepSeas Standard Customer Support Policies and Procedures set forth as follows:
Service Hours
Managed Detection and Response (MDR) Services will be provided 24x7x365.
All the other Services will be performed Monday through Friday, excluding designated DeepSeas holidays (“Normal Business Hours”), unless otherwise noted herein.
Designated Holiday
Date Observed
New Year’s Day
January 1
Martin Luther King Jr Day
3rd Monday of January
Memorial Day
Last Monday in May
Independence Day
July 4
Labor Day
1st Monday in September
Thanksgiving Day
4th Thursday in November
Day after Thanksgiving
4th Friday in November
Christmas Eve
December 24
Christmas Day
December 25
Service Maintenance Windows
DeepSeas will utilize Scheduled Maintenance Windows to upgrade equipment, software, and facilities which may add capacity, new features, resiliency, improvements, and bug fixes.
DeepSeas may perform scheduled maintenance during the Scheduled Maintenance Windows as defined below (Table 2), with or without prior written notice.
The scheduled maintenance windows for infrastructure upgrades and software releases will occur according to the following schedule defined below (Table 2).
DeepSeas may need to perform emergency or non-scheduled maintenance from time to time and therefore reserves the right to perform maintenance at any time should emergency maintenance be necessary. In such an event, DeepSeas will attempt to provide 24-hour advance written notice or as soon as practicable for the maintenance event.
Scheduled Maintenance Table 2
Region
Times
Primary Data Centers
Every Sunday – From 12:00 a.m. until 4:45 a.m. Pacific Standard Time Every 3rd Sunday* - 9:00 p.m. until 4:45 a.m. Pacific Standard Time Secondary Data Centers
Every Saturday – From 12:00 a.m. until 4:45 a.m. Pacific Standard Time 4th Saturday* - 9:00 p.m. until 4:45 a.m. Pacific Standard Time If the day falls on a DeepSeas designated holiday or other special day, DeepSeas may reschedule the monthly maintenance window.
Service Availability and Service Levels
AVAILABILITY CATEGORIES
If, in a given month, the Availability of a particular Availability Category drops below the Minimum Availability % set forth in the table below, then DeepSeas will have created one (1) Service Level Default in that category. Under no circumstance can there be more than one Service Level Default per Availability Category per month.
AVAILABILITY CATEGORIES AND MINIMUM AVAILABILITY %
Availability Category
Minimum Availability %
Network Security Traffic MDR
99.9999%
SOC Resources
99.9999%
AVAILABILITY DETAILS
A Network Security Traffic MDR Availability default occurs when Customer's network traffic is not being delivered or flowing as a result of a DeepSeas provided Network Security appliance, provided such failure to deliver is not the result of any of the exceptions captured in the SLA Exception table below.
A SOC Resource Availability default occurs when the DeepSeas Security Operations Center staff is not available to perform the Services, provided such failure to deliver is not the result of any of the exceptions captured in the SLA Exception table below.
THREAT NOTIFICATION ALERT DEFAULT THRESHOLDS
The following table describe DeepSeas’ Threat Notification Alert Default Thresholds, Target and Minimum Notification Times, and Target and Minimum Service Level Agreements (SLAs):
THREAT NOTIFICATION ALERT DEFAULT THRESHOLDS
THREAT SEVERITY
DESCRIPTION
TARGET NOTIFICATION TIME*
TARGET SERVICE LEVEL
MINIMUM NOTIFICATION TIME
MINIMUM SERVICE LEVEL
Level 1
Critical
Could cause severe business impact/service disruption to critical services/systems Risk potential includes financial, reputational, regulatory, legal, etc.
Targeted attack / attempts by internal or external parties Repeated attempts to obtain or export unauthorized information or access Generates public interest
<15 minutes
99.99%
30 minutes
99.5%
Level 2
High
Major impact to multiple critical systems or services
Major impact to sensitive data
Multiple malware infections on internal network – 5 hosts and up – or suspected ransomware Potential for public interest
<15 minutes
99.99%
30 minutes
99.5%
Level 3
Moderate
Any infection beyond potentially unwanted program/adware Malware infection on 1-4 hosts
Potential for service disruption on users
<1 hour
99.99%
2 hours
99.5%
Level 4
Low
Impacts a single system or service
Impacts a non-critical enterprise system or service
Potential unfriendly or unintentional activity by internal or external parties <1 hour
99.99%
4 hours
99.5%
* Notification Time commences upon formal determination that an alert is a validated threat and input into the validated threat system.
SERVICE LEVEL PENALTIES FOR FAILURE TO PERFORM
The following service level agreements shall be effective from the date the Service is placed in live use. Service credits will be owed to Customer based on the following table, subject to the Grace Period set forth thereafter:
SERVICE LEVEL AGREEMENT DEFAULTS
# OF SERVICE LEVEL DEFAULTS
CUSTOMER CREDIT
0-1
0% of monthly recurring charges for the Services
2-4
5% of monthly recurring charges for the Services
5-6
10% of monthly recurring charges for the Services
7 or more
15% of monthly recurring charges for the Services
Customer is entitled to a credit if DeepSeas has two (2) or more Service Level Defaults in any month.
Maximum cumulative penalties shall not exceed 15% of the total monthly fees for the Services. **Outages associated with the Customer’s environment would preclude the declaration of a Service Level Default.
CREDIT GRACE PERIOD
In the event that DeepSeas owes any service credits under this section, DeepSeas will have the opportunity to earn back those credits. If the one-month immediately following the issuance of any service credit(s) does not contain any Service Level Defaults, 100% of the credits will be forgiven. Service credits shall only be issued to Customer after this one-month grace period.
SLA EXCEPTIONS
If Customer is unable to access the Services for any of the reasons set forth below, such event shall not constitute an "Outage" for any portion of the time period of the inaccessibility.
SLA EXCEPTIONS
ITEM #
REASON
DEFINITIONS
1 External Support Callback
Accessibility issue that requires third party resources (not including DeepSeas contract work) to resolve, such as those that require the engagement of a third-party vendor to make repairs and those associated with equipment that is not covered by a 24x7x365 maintenance agreement. 2 Third Party
Accessibility issues associated with the actions or inactions of third parties not affiliated with DeepSeas and for which DeepSeas has no control or ability to remedy. 3 Customer Availability
Accessibility issues DeepSeas is unable to resolve because it is unable to contact Customer in order to resolve the problem. 4 Facility Access Issue
After-Hour access issue where Customer cannot control building access and entry cannot be granted through other means. 5 Force Majeure
Accessibility issues caused by any incident of force majeure, as defined in this Statement of Work (SOW) and/or a governing Master Services Agreement (MSA). 6 Connectivity
Accessibility issues caused by telecommunications or internet failures between DeepSeas and Customer or by telecommunications or internet connectivity issues on Customer side. 7 Scheduled
Scheduled events at the request of any authorized Customer resource. 8 Planned Maintenance
Accessibility issues caused by planned maintenance downtime, provided that: (i) such planned maintenance; (ii) DeepSeas provides Customer with at least forty eight (48) hour advanced notice; and (iii) such planned maintenance is planned for non-core business hours as much as practicable 9 Facilities
Accessibility issues caused by facilities issues such as problems related to power, air handlers etc. 10 Responsibilities
Accessibility issues caused by any agent, contractor, or employee of Customer. 11 Customer-Provided Maintenance
Customer’s lack of hardware and/or software maintenance after any applicable vendor warranty period expires. 12 Breach
Any accessibility issue caused by Customer’s breach of this SOW or Customer's breach of any other SOW between Customer and DeepSeas.
EXHIBIT B
SERVICES AND PRICING
DeepSeas will perform managed services on an annual fee basis, plus out-of-pocket expenses and the applicable administrative fees, installation fees, applicable taxes, and shipping fees outlined in Table 1.
Services and Pricing
DeepSeas shall provide the selected Scope of Services as defined below in Table 1 for the total Annual Charge of $57,600.00 USD Scope of Services (Table 1)
DEEPSEAS Service(s)
Description of Service(s)
Scope Elements
Monthly Recurring Charge
Non-Recurring Charge
Protect
Endpoint MDR
24x7x365 endpoint threat detection, analysis, and response to validated cybersecurity threats.
Endpoint Count: 600
Customer Provided License(s): Defender P2
$4,800.00
n/a
In the event Customer exceeds the endpoint count, the authorized endpoint quantity will automatically be increased in increments of 50 and will increase the fee for the current Term by ($8.00 x Y) x (Z), where Y is the number of additional number of endpoints (increments of 50) and Z is the number of months remaining in the then current Term. Customer will be invoiced for the additional endpoints as they are authorized.
Subtotal
$4,800.00
n/a
Approval/Acceptance:
For Services:
DeepSeas shall validate the process steps to achieve acceptance of the Services in consultation with Customer during the implementation period for the Services. If the Customer begins receiving the Services, they shall be deemed “Accepted,” unless otherwise noted by the Customer. If a problem develops, or if Customer notifies DeepSeas in writing of identifiable operational concerns, DeepSeas shall use commercially reasonable efforts to resolve the problem promptly. Once the problem has been resolved to the reasonable satisfaction of the Customer, DeepSeas may seek acceptance which shall promptly be provided.
For Deliverables:
Customer shall have five (5) business days from its receipt of a Deliverable provided by DeepSeas to review and evaluate such Deliverable to determine whether the Deliverable substantially conforms with the specifications for the particular Deliverable as set forth herein, if any; and if no written acceptance or rejection is received by DeepSeas within such five (5) business day period, the Deliverable shall be deemed to be accepted.
EXHIBIT C
SERVICE DESCRIPTION(S)
Endpoint MDR – Service Description
SERVICE OVERVIEW
DeepSeas’ Managed Detection & Response services (MDR) provide monitoring, detection, analysis, and response to validated security threats within client environments enrolled in one or more DeepSeas’ MDR offerings. The DeepSeas Cyber Defense Team evaluates alerts generated by security monitoring technologies deployed within Customer environments. When DeepSeas determines that an alert is a legitimate threat to the security of the Customer's environment, a threat notification report will be delivered that provides detailed information associated with the threat and recommended courses of action. DeepSeas can also perform response actions, as necessary, in support of responding to threats.
DeepSeas’ Endpoint Managed Detection and Response service (Endpoint MDR) delivers 24x7x365 endpoint threat detection, analysis, and response to validated cybersecurity threats within a customer’s environment. Endpoint monitoring is a critical component of detecting and validating the severity and origination of a threat. Threat detection includes monitoring of alerts by DeepSeas cyber defense analysts who triage, examine, and categorize alerts generated from a specified endpoint detection and response (EDR) technology. DeepSeas, through its subject matter experts and technological capabilities, also provide threat hunting and detailed forensic investigation in support of the monitoring, detection, and response mission.
DeepSeas’ Cyber Defense Team identifies potential security threats in Customer environments using a combination of alert enrichment and review, open and closed source cyber threat intelligence, enterprise data search, and targeted cyber threat hunting. When DeepSeas identifies and validates a potential security threat in a monitored Customer environment, a Threat Notification report is documented and delivered to the Customer in alignment with a scaled threat severity model. Should a threat be identified on an endpoint within the Customer’s network environment, a Validated Threat Notifications report will be sent to the Customer and will include severity level, vector information, and recommended response actions to mitigate the threat. Threat Notification reports are created in the form of a case event in the DeepSeas customer portal. Depending on the threat severity, direct contact is made in accordance with the Customer-provided notification escalation order, per the Customer MDR Runbook that DeepSeas and Customer will mutually agree upon during kickoff.
Our MDR program includes the following service elements:
Threat Detection - DeepSeas threat detection provides review of alerts from, proactive enterprise search of, and targeted threat hunting using Customer security monitoring tools to identify and prioritize cyber threats.
Threat Notification - Threat Notification reports are generated by DeepSeas cyber defense analysts to describe the nature, context, and severity of a validated threat along with remediation recommendations.
Threat Response - DeepSeas cyber defense analysts provide Customers with response guidance and/or response actions for resolving threats. Response actions are defined in a mutually approved Customer MDR Runbook document.
Curated Threat Intelligence – DeepSeas applies curated detection logic and analytics to security monitoring tools deployed in customer networks to improve the effectiveness of threat detection and response.
DeepSeas XDR Cyber Defense Platform - DeepSeas XDR Cyber Defense Platform provides customers with a cloud-hosted technology architecture that supports data collection, analysis, automated response, and reporting capabilities across multiple attack surfaces.
Supported EDR Products & Licensing Options
DeepSeas supports both on-premises and cloud-based EDR solutions (see “List of Supported Endpoint Products” below).
LIST OF SUPPORTED ENDPOINT PRODUCTS
Platform
SUPPORT TYPE
LICENSING + TOOLING
Cloud
Version
On-Prem Version
Licensing Options
Minimum License(s)
Required
Additional Software/Hardware (Highly Recommended)
Carbon Black™
Yes
No
Bring Your Own License
Purchase Through DeepSeas
Enterprise EDR
Endpoint Standard
CROWDSTRIKE Falcon™
Yes
N/A
Bring Your Own License
Purchase Through DeepSeas2
(Falcon X and NGAV)
MSSP Protect
MSSP Defend
SentinelOne™
Yes
N/A
Bring Your Own License
Purchase Through DeepSeas2
Complete
FireEye HX™
Yes
Yes
Bring Your Own License
Cloud: HX Cloud
On-Prem or OT: must be scoped
Cloud Collection Appliance
Microsoft Defender for Endpoint™
Yes
N/A
Bring Your Own License
Defender for Endpoint P2
Entra Free ID
E3, Business Premium, or Entra P1 (or higher)
Palo Alto Cortex XDR™
Yes
N/A
Bring Your Own License
Cortex XDR Pro
Sophos
Yes
N/A
Bring Your Own License
Intercept X Advanced with XDR
Intercept X Advanced for Server with XDR
Tanium™
Yes
Yes
Bring Your Own License
Threat Response Module
Cloud Collection Appliance
THREAT RESPONSE
During onboarding, DeepSeas will work closely with Customer stakeholders to jointly develop a Customer MDR Runbook, which will detail individual responsibilities for responding to Threat Notifications delivered by DeepSeas. Response actions are typically categorized as one of the following:
RESPONSE TYPE
DESCRIPTION
GUIDED RESPONSE
Guided Threat Response provides customers with recommended response actions that the Customer’s internal team should complete to contain, mitigate, or remove a threat identified in a DeepSeas Threat Notification.
PROACTIVE RESPONSE
DeepSeas will perform specific threat containment response actions based upon a defined MDR runbook. Active Response actions may be combined with Guided Response actions to facilitate incident resolution. Example proactive response capabilities include endpoint system containment, proxy modification, firewall modification, and custom API integrations.
BREACH RESPONSE
Upon activation of a pre-negotiated Incident Response retainer, DeepSeas will provide dedicated and (as needed) on-site investigation, triage, recovery, and remediation.
CURATED THREAT INTELLIGENCE
DeepSeas MDR customers benefit from continuous technical threat intelligence updates that are applied to tools and platforms managed by DeepSeas. DeepSeas’ cyber threat intelligence research team employs a rigorous methodology to generate, curate and publish threat intelligence analytics and detection signatures that are used to enhance the detection technologies deployed within Customer networks. The application of cyber threat intelligence improves threat detect and response through timely identification of adversary techniques and indicators and provides increased threat context during response activities.
DEEPSEAS’ CYBER DEFENSE PLATFORM
DeepSeas MDR customers integrate their security technology tools and have secure access to the DeepSeas XDR Cyber Defense Platform, a cloud hosted technology architecture that provides data collection, analysis, response, and reporting capabilities across multiple attack surfaces (e.g. endpoints, networks, and operations technology).
The following features and capabilities are included as part of the DeepSeas XDR Cyber Defense Platform:
Service Orchestration Appliance
The DeepSeas Service Orchestration Appliance is used to collect relevant data from the Customer-deployed security tools platforms or applications and to enable specified response actions using API (Application Programming Interface) communications. The appliance can be deployed physically or virtually. During service initiation, DeepSeas and Customer will agree upon the required number of Service Orchestration Appliances and the location(s) where deployment is required.
Cyber Threat Analysis and Response Framework
The DeepSeas Threat Analysis and Response Framework is a collection of automated capabilities that are used by the DeepSeas Cyber Defense Team to enrich, analyze, and respond to security alerts and threats within a customer environment.
Customer Portal
The DeepSeas Customer Portal provides validated threat notification information, threat details, remediation support recommendations, and other information related to the level of service stipulated in the Statement of Work. The Customer Portal provides:
Threat Notification and Case Management tracking solution which provides visibility into case activities such as real-time threat investigation information, case status, and other actionable information that the Customer can use to review and mitigate a validated threat.
Metrics and Reporting Insights that quantify the status of Customer’s MDR services.
Knowledge Management Documentation describing the MDR service features and common Customer questions.
The Ability to Submit questions and Support Requests to the DeepSeas Cyber Defense Team 24x7x365 24x7 Customer Hotline
The DeepSeas MDR Customer Hotline allows Customers to contact the DeepSeas Cyber Defense Team 24 hour a day, 365 days per year through a dedicated customer telephone number.
SERVICE ONBOARDING TIMELINE
The following table describes the typical steps DeepSeas undertakes together with the Customer to onboard and initialize our Endpoint MDR service STEP
DESCRIPTION
Estimated DURATION (Weeks)
Kick-Off
DeepSeas and the Customer participate in a joint call to confirm services, service orchestration appliance placement (if required), shipping information, definition of a Customer MDR Runbook and other key details regarding the Services that shall be provided. During the Kick-Off, the Customer is introduced to their Technical Support Engineer (TSE) / Service Delivery Manager (SDM). <1 week
EDR Deployment
The Customer will deploy the EDR controller and EDR agents to endpoints as applicable and appropriate per the specific software solution and SOW. 1-3 weeks
Service Orchestration Appliance(s) Deployment
If needed, appliances are shipped within the continental United States with an estimated delivery time of 2-3 days (International shipping schedules will vary).
Integration is confirmed when telemetry data flow from the EDR controller to the appliance is established and from the appliance(s) to DeepSeas. 2-3 weeks
Baseline
DeepSeas will begin monitoring the EDR platform alerts and begin notifying the Customer of validated threats while creating a baseline for priorities, focus, and response. 1 week
Service Optimization & Go- Live
DeepSeas services are fully operational and adjusted as needed to meet Customer needs, as defined in the Statement of Work. DeepSeas will provide reports and on-going communication to the Customer. 4+ weeks
2 Bring Your Own License - Customer can elect to purchase EDR through supplier of their choice. Customer owns licensing and associated fees.
Purchase Through DeepSeas - Customer can elect to purchase certain EDRs through DeepSeas who will provide as a cloud-hosted, third party EDR software platform as defined in a separate SaaS Agreement.