1 Terms and Conditions Managed Security
Total Page:16
File Type:pdf, Size:1020Kb
TERMS AND CONDITIONS MANAGED SECURITY SERVICES In addition to the terms and conditions of the Master Services Agreement (or other agreement for the provision of services, each a “Master Agreement”) and applicable Statement(s) of Work (or other descriptions of services and fees under a Master Agreement, each an “SOW”) the following terms and conditions apply to any Managed Security Services (as defined in any Master Agreement or SOW), including with respect to any Customer-owned or provided device to be supported by GuideIT with respect to one or more of the Managed Security Services (each a “Supported Device”). A Master Agreement and the applicable SOW thereunder are collectively referred to as the “Agreement.” These Terms and Conditions control over conflicting terms in any Agreement solely with respect to the Managed Security Services. Capitalized terms will have the meanings ascribed thereto in the applicable Agreement unless they are otherwise defined herein. 1. Customer Responsibilities. 1.1 Customer Equipment; Maintenance; Changes. Customer will be responsible for maintaining, upgrading, and replacing its equipment, including Supported Devices, to the extent reasonably required to receive the benefits of the Managed Security Services. Further, Customer will (i) at its own expense, procure and maintain with each vendor adequate maintenance contracts and all licenses necessary for the Supported Devices to enable GuideIT to properly perform Managed Security Services; (ii) comply with Managed Security Services prerequisites and operational procedures as set forth in the applicable terms; and (iii) promptly inform GuideIT of any changes effectuated in Customer’s network and/or information technology infrastructure (“Customer Environment”) and any changes to the nomination and/or authorization level of the individuals Customer has authorized to oversee, monitor or evaluate the provision of Managed Security Services. 1.2 Interoperability. Customer acknowledges that modifications or changes to the Supported Devices (such as future releases to the Supported Device’s operating software) or to the Customer Environment may cause interoperability problems or malfunctions in a Supported Device and/or the Customer Environment. Customer acknowledges that it is Customer’s responsibility to maintain, at its sole cost and expense, the Customer Environment to ensure that the Customer Environment is interoperable with each Supported Device and the Managed Security Services . 1.3 User Interface. In connection with the provision of certain of the Managed Security Services, Customer may be provided with one or more user IDs, account numbers, personal identification numbers or codes, passwords, digital certificates or such other means of authentication (“Login”) to access a web-based portal, dashboard, or other form of user interface (“User Interface”). The User Interface and Login may be used for accessing on-line services, authorizing instructions and requests and/or ordering additional services or service tickets. Customer will at all times keep its Login strictly confidential and will take all reasonable precautions to prevent unauthorized use, misuse or compromise of its Login. Customer agrees to notify GuideIT promptly upon learning of any actual or threatened unauthorized use, misuse, or compromise of its Login. GuideIT is entitled to rely on Customer’s Login as conclusive evidence of identity and authority. 1 Customer will be liable for all activities and charges incurred through the use of Customer’s Login, and will indemnify, defend and hold GuideIT harmless from all liabilities, losses, damages, costs and expenses (including, without limitation, reasonable attorneys’ fees and costs) incurred by GuideIT to the extent resulting from the use and/or compromise of Customer’s Login, unless the unauthorized use, misuse or compromise of Customer’s Login is solely attributable to a GuideIT’s gross negligence or willful misconduct. 1.4 Installation Sites and Equipment. Customer will prepare any installation site in accordance with GuideIT’s instructions to ensure that any equipment that is part of the Customer Environment is properly configured as required for the provision of Managed Security Services and operates in accordance with the manufacturer’s specifications. All Supported Devices must have a routable network path as specified by GuideIT and, if required, an agent must be loaded on each Supported Device. Customer will install and maintain software agents required for the provision of Managed Security Services to Supported Devices (e.g. for syslog logging for operating system (“OS”) and active directory server), at its cost. If Customer fails to make any preparations required herein and this failure causes GuideIT to incur costs during the implementation or provision of Managed Security Services, then Customer agrees to reimburse GuideIT promptly for these costs. 1.5 Not Industry Specific. Customer acknowledges and agrees that Managed Security Services are offered and provided by GuideIT to multiple customers in various industries. Unless otherwise specifically provided for in the Agreement, Managed Security Services are implemented without specific controls that may generally be required or customary for customers in any particular industry and is not designed to satisfy any specific legal obligations. Customer will be solely responsible for determining that Managed Security Services satisfy Customer’s obligations under law or contract. Customer agrees to use Managed Security Services in accordance with all applicable laws and not to use Managed Security Services in any manner that imposes obligations on GuideIT under any laws other than those laws with which GuideIT agrees to comply as specifically set forth in the Agreement. Without limiting the generality of the foregoing, unless otherwise specifically provided in the Agreement and Customer and GuideIT have entered into a business associate agreement, Customer agrees not to cause GuideIT to create, receive, maintain or transmit protected health information (as defined at 45 C.F.R. § 160.103) for or on behalf of Customer in connection with Managed Security Services or in any manner that would make GuideIT a business associate (as defined at 45 C.F.R. § 160.103) to Customer. In the event Customer acts or uses Managed Security Services in a manner not permitted under this Section 2.5, Customer will (a) indemnify, defend and hold harmless GuideIT for any losses, expenses, costs, liabilities, damages, penalties, investigations or enforcement proceedings (including attorneys’ fees) arising from or relating to Customer’s breach of this Section 2.5; (b) take, at Customer’s expense, prompt action to correct and/or mitigate the effects of such breach; and (c) provide GuideIT with reasonable cooperation and support in connection with GuideIT’s response. Customer will assume and be solely responsible for any reporting requirements under law or contract arising from Customer’s breach of this Section 2.5. 2 2. Excluded Services. The parties acknowledge that GuideIT has no obligation to provide Managed Security Services for any Supported Device that is not properly functioning or that does not meet the Minimum Requirements set forth in the Agreement. 3. Warranties. 3.1 GuideIT Warranties. GuideIT warrants to Customer that it will perform its obligations in a good and workmanlike manner. The remedies, if any, in a service level agreement (“SLA”), if any, applicable to a particular portion of the Managed Security Services are Customer’s sole and exclusive remedies with respect to such portion of Managed Security Services related to the failure to meet any standard set forth in the SLA. GuideIT does not warrant that Managed Security Services will detect and prevent all possible threats and vulnerabilities or that such services will render Customer’s network and systems invulnerable to security breaches or vulnerabilities. 3.2 Third Party Warranties. For any third-party products and/or services incorporated as part of Managed Security Services, Customer will receive only the warranties offered by such third party to the extent GuideIT may pass through such warranties to Customer. 3.3 Customer Warranties. Customer represents and warrants that (a) it has and will continue to have all rights, power, permissions and authority necessary to have GuideIT perform Managed Security Services in the Customer environment (including, without limitation, all rights, power, permissions, authority and network user consents necessary in respect of any IP address assigned to a Supported Device and any consent needed from its network users with respect to any logging and monitoring activities conducted by GuideIT relating to such Managed Security Service), and (b) will not provide any PHI to GuideIT for purposes of GuideIT’s performance of Managed Security Service unless such provision of PHI is specifically contemplated by the Agreement and the parties have entered into a business associate agreement covering the provision of PHI. Customer hereby assumes the sole responsibility for the accuracy of the IP addresses and domains provided to GuideIT. Customer will be liable for all costs and expenses from any third-party claims of loss, damage (including reasonable attorneys’ fees) and liability of any kind that may be incurred as a result of Customer’s breach of the foregoing warranty. 4. Assumption of Risk. 4.1 Scanning Risks. Managed Security Services involving the use of network scanning technology that has inherent