Common use of Service Provider Activities Frequency Detailed Description Clause in Contracts

Service Provider Activities Frequency Detailed Description. Off-site data transfer check Daily Report of backup success Off-site data transfer issue remediation As Needed Intervention when alerted to backup system issue Excessive data transfer review As Needed Intervention when alerted to backup system issue Monitors & Service Monitoring* Frequency Detailed Description DR Offsite Transfer Excessive* <Critical> Continuous There is much more data queued to transfer than usual DR Offsite Transfer Nearing Cap* Continuous Warning that transfer cap is nearing cap and charges possible DR Offsite Transfer Failure* Continuous Warning that the offsite transfer is not functioning Value Reporting* Frequency Detailed Description DR Offsite Transfer Status* Service Onboarding Activities Frequency Detailed Description Evaluate current backup job(s) and requirements Once per Client Work with Client to assess current DR plan and needs Configure, Deploy, and Test DR Technology Technology Dependent Serviceable Technologies Supported Versions and Releases Efolder backup for file Latest two major releases Efolder Replibit Serviceable Conditions Adequate storage, internet bandwidth, and software licenses Coverage Exclusions & Exceptions Data transfer and storage charges and fees Service Levels & Performance Goals Offsite data transfer within X hours of current data. (Technology and environment dependent) Service Level & Performance Exceptions *Dependent on the Technology being utilized and may not be available Group 4 – Identity Management Coverage (A3.4) Service Provider Activities Frequency Detailed Description Domain User Permission Management Continuous Monitor AD user permissions Domain User Password Resets and Account Unlocks As Needed Approved user requested access Domain User Setup As Needed Approved user requested access Domain Group and Folder Permission Management As Needed Approved user requested access Monitors & Service Monitoring* Frequency Detailed Description Offline Servers Monitor Continuous Monitoring for offline Domain Controllers EV – Blacklisted Events (4720, 4238) Continuous Locked User Accounts Value Reporting* Frequency Detailed Description 30 Day AD Changes Monthly Report as requested by client of AD changes Login Status Report Quarterly Report as requested by client of system logins Service Onboarding Activities Frequency Detailed Description Active Directory Review and Cleanup Once Per Client Setup of Administrative and Support User Accounts Once Per Client Serviceable Technologies Supported Versions and Releases Microsoft Windows Domain Latest three major releases Serviceable Conditions Active Directory has been cleaned up and standardized to the Service Provider’s specifications. User must be physically or wirelessly connected to the Domain network and maintain an adequate internet connection Coverage Exclusions & Exceptions Microsoft Server and Active Directory Licensing The costs to manage, implement, and/or procure a single sign on solution Service Levels & Performance Goals Active Directory Uptime to equal or exceed 98% by means of server uptime and routine backups Service Level & Performance Exceptions Non-standard and/or complex multi-site or multi-domain environments *Dependent on the Technology being utilized and may not be available Group 5 – Patch Management Coverage (A3.5) Service Provider Activities Frequency Detailed Description Assess available Microsoft product updates Once Per Patch Verify valid patches available Test Service Provider approved updates As Needed User requested vertical application patching Deploy Service Provider tested and approved updates Once Per Patch Automatic monitoring of patches Validate deployed updates installed successfully Once Per Patch Automatic monitoring of patches Remediate unsuccessful updates As Needed Intervention resulting from failed patching alerts Monitors & Service Monitoring* Frequency Detailed Description UPDATES - Failed Continuous RMM Monitor of patch status UPDATES - Installed Continuous RMM Monitor of patch status UPDATES - Missing Service Pack Continuous RMM Monitor of patch status UPDATES - Out of Date Continuous RMM Monitor of patch status Value Reporting* Frequency Detailed Description Patch Detail On & Off-Boarding Patch Health (The Health Report may replace this.) Monthly

Service Provider Activities Frequency Detailed Description. Off-site data transfer check Backup Check Daily Report Automatic system monitor of backup success OffTest File Restore Weekly Automatic system test restore Test Server Stand-site data transfer issue remediation up (If backup technology supports) Bi-Weekly Automatic system test restore Remediate Failing Backups As Needed Intervention when alerted to Review and failed backup system issue Excessive data transfer review jobs and remediate Restore Files / Data As Needed Intervention when alerted to backup system issue Restore files as requested by client Monitors & Service Monitoring* Frequency Detailed Description DR Offsite Transfer Excessive* <CriticalBU – Job Running > 8 Hours Continuous There is much more data queued The backups configuration may need adjusted BU - Backup Failed Continuous The backup failed and needs reviewed BU – Verify Backup Job Failed Continuous The backup couldn’t be verified as successful and needs tested BU – Backup Failed to transfer than usual DR Offsite Transfer Nearing Cap* Configure Job Continuous Warning that transfer cap is nearing cap and charges possible DR Offsite Transfer Failure* Continuous Warning that the offsite transfer is The backup process did not functioning begin properly Value Reporting* Frequency Detailed Description DR Offsite Transfer Status* Acronis Weekly Report Weekly Shadow Protect report on previous week’s backups Health Report Monthly Provides a count of failed / successful backup jobs Service Onboarding Activities Frequency Detailed Description Evaluate current backup job(s) and requirements Once per Client Work with Client to assess current DR plan backups and current needs Configure, Deploy, and Test DR Backup Technology Technology Dependent Serviceable Technologies Supported Versions and Releases Efolder backup for file NewCloud Backup Latest two major releases Efolder Replibit Serviceable Conditions Adequate storageAdequate, internet bandwidthcurrent, and actively licensed backup software licenses Storage space sufficient for the successful completion of backup jobs Storage space sufficient for adequate retention period Adequate and reasonably fast access to any/all remote, tape, or other physical backup data (Service levels are contingent upon this) Coverage Exclusions & Exceptions Data transfer and storage charges and fees The cost of any necessary software licenses The cost of temporary, permanent, and archival storage Data is not and cannot be guaranteed (However, this service is a method to help protect data) Service Levels & Performance Goals Offsite data transfer Backup jobs successful 95% of the time File Restore within general service levels listed in Coverage Summary (Technology and environment dependent) Virtual Server Standups within X hours of current data. time* (Technology and environment dependent) Service Level & Performance Exceptions Challenges with the technology that require the involvement of the backup technologies’ vendor/manufacturer Recovery of any/all files or data not included within original scoping requirements *Dependent on the Technology being utilized and may not be available Group 4 – Identity Management Coverage (A3.4) Service Provider Activities Frequency Detailed Description Domain User Permission Management Continuous Monitor AD user permissions Domain User Password Resets and Account Unlocks As Needed Approved user requested access Domain User Setup As Needed Approved user requested access Domain Group and Folder Permission Management As Needed Approved user requested access Monitors & Service Monitoring* Frequency Detailed Description Offline Servers Monitor Continuous Monitoring for offline Domain Controllers EV – Blacklisted Events (4720, 4238) Continuous Locked User Accounts Value Reporting* Frequency Detailed Description 30 Day AD Changes Monthly Report as requested by client of AD changes Login Status Report Quarterly Report as requested by client of system logins Service Onboarding Activities Frequency Detailed Description Active Directory Review and Cleanup Once Per Client Setup of Administrative and Support User Accounts Once Per Client Serviceable Technologies Supported Versions and Releases Microsoft Windows Domain Latest three major releases Serviceable Conditions Active Directory has been cleaned up and standardized to the Service Provider’s specifications. User must be physically or wirelessly connected to the Domain network and maintain an adequate internet connection Coverage Exclusions & Exceptions Microsoft Server and Active Directory Licensing The costs to manage, implement, and/or procure a single sign on solution Service Levels & Performance Goals Active Directory Uptime to equal or exceed 98% by means of server uptime and routine backups Service Level & Performance Exceptions Non-standard and/or complex multi-site or multi-domain environments *Dependent on the Technology being utilized and may not be available Group 5 – Patch Management Coverage (A3.5) Service Provider Activities Frequency Detailed Description Assess available Microsoft product updates Once Per Patch Verify valid patches available Test Service Provider approved updates As Needed User requested vertical application patching Deploy Service Provider tested and approved updates Once Per Patch Automatic monitoring of patches Validate deployed updates installed successfully Once Per Patch Automatic monitoring of patches Remediate unsuccessful updates As Needed Intervention resulting from failed patching alerts Monitors & Service Monitoring* Frequency Detailed Description UPDATES - Failed Continuous RMM Monitor of patch status UPDATES - Installed Continuous RMM Monitor of patch status UPDATES - Missing Service Pack Continuous RMM Monitor of patch status UPDATES - Out of Date Continuous RMM Monitor of patch status Value Reporting* Frequency Detailed Description Patch Detail On & Off-Boarding Patch Health (The Health Report may replace this.) Monthlyavailable

Service Provider Activities Frequency Detailed Description. Off-site data transfer check Daily Report of backup success Off-site data transfer issue remediation Global Server Group Policy Adjustment As Needed Intervention when alerted to backup system issue Excessive data transfer review Adjusts IT environment configuration. (Non-standard fees may apply) Server Maintenance As Needed Intervention when alerted to backup system issue Disk, raid, performance, OS configuration, service, and event logs. Server Configuration Adjustments As Needed If non-standard adjustments are necessary, fees may be apply. Monitors & Service Monitoring* Frequency Detailed Description DR Offsite Transfer Excessive* DRV - Free Space < 10% Total Size or 2GB <Critical> Continuous There is much more data queued to transfer than usual DR Offsite Transfer Nearing CapRMM monitor of sever storage space BlackListed Events - Informational, Warnings, and Errors Continuous RMM Server event log monitor EV - Drive Errors, Raid Failures, or Smart Errors <Critical> Continuous RMM drive error log monitor EV - Excessive Alerts Detected > 25 Like Events Continuous RMM Event monitor EV - Reoccuring Critical > 75 Occurrences Continuous RMM critical event monitor EV - Chassis Intrusion Continuous RMM chassis monitor HDW - Hardware Changes Detected Continuous RMM hardware detection monitor LT - Offline Servers <Critical> Continuous RMM Server offline monitor SVC - Auto Services Stopped <Critical> Continuous RMM Server service monitor UPTIME - SVR 1 Mo. Since Reboot* Continuous Warning that transfer cap is nearing cap and charges possible DR Offsite Transfer Failure* Continuous Warning that the offsite transfer is not functioning RMM Uptime monitor Value Reporting* Frequency Detailed Description DR Offsite Transfer Status* Health Report Monthly Client requested monthly system health report form RMM Service Onboarding Activities Frequency Detailed Description Evaluate current backup job(s) and requirements Once per Client Work with Client to assess current DR plan and needs Configure, Deploy, and Test DR Technology Technology Dependent Serviceable Technologies Supported Versions and Releases Efolder backup for file Latest two major releases Efolder Replibit Serviceable Conditions Adequate storage, internet bandwidth, and software licenses Coverage Exclusions & Exceptions Data transfer and storage charges and fees Deploy Service Levels & Performance Goals Offsite data transfer within X hours of current data. (Technology and environment dependent) Service Level & Performance Exceptions *Dependent on the Technology being utilized and may not be available Group 4 – Identity Provider’s Management Coverage (A3.4) Service Provider Activities Frequency Detailed Description Domain User Permission Management Continuous Monitor AD user permissions Domain User Password Resets and Account Unlocks As Needed Approved user requested access Domain User Setup As Needed Approved user requested access Domain Group and Folder Permission Management As Needed Approved user requested access Monitors & Service Monitoring* Frequency Detailed Description Offline Servers Monitor Continuous Monitoring for offline Domain Controllers EV – Blacklisted Events (4720, 4238) Continuous Locked User Accounts Value Reporting* Frequency Detailed Description 30 Day AD Changes Monthly Report as requested by client of AD changes Login Status Report Quarterly Report as requested by client of system logins Service Onboarding Activities Frequency Detailed Description Active Directory Review and Cleanup Agents Once Per Client Setup of Administrative and Support User Accounts Server Complete Server Onboarding Documentation Once Per Client Server Establish and Implement Server Config. Standards Once Per Server Address Monitor Alerts Until All Addressed Serviceable Technologies Supported Versions and Releases Microsoft Windows Domain Latest three major releases Server 2008, R2, Essentials, and greater Serviceable Conditions Active Directory has been cleaned up Server’s configuration, physical state, and standardized to the Service Provider’s specificationsgeneral health is reasonable. User must be physically or wirelessly connected to the Domain network and maintain an adequate internet connection Coverage Exclusions & Exceptions Microsoft Server and Active Directory Licensing The costs to manage, implement, and/or procure a single sign on solution Service Levels & Performance Goals Active Directory Uptime to equal or exceed 98% by means of server uptime and routine backups Service Level & Performance Exceptions Non-standard and/or complex multi-site or multi-domain environments *Dependent on the Technology being utilized and may not be available Group 5 – Patch Management Coverage (A3.5) Service Provider Activities Frequency Detailed Description Assess available Microsoft product updates Once Per Patch Verify valid patches available Test Service Provider approved updates As Needed User requested vertical application patching Deploy Service Provider tested and approved updates Once Per Patch Automatic monitoring of patches Validate deployed updates installed successfully Once Per Patch Automatic monitoring of patches Remediate unsuccessful updates As Needed Intervention resulting from failed patching alerts Monitors & Service Monitoring* Frequency Detailed Description UPDATES - Failed Continuous RMM Monitor of patch status UPDATES - Installed Continuous RMM Monitor of patch status UPDATES - Missing Service Pack Continuous RMM Monitor of patch status UPDATES - Out of Date Continuous RMM Monitor of patch status Value Reporting* Frequency Detailed Description Patch Detail On & Off-Boarding Patch Health (The Health Report scope projects may replace thisbe proposed if necessary to ensure serviceability.) MonthlyServer is adequately licensed.

Service Provider Activities Frequency Detailed Description. Off-site data transfer check Backup Check Daily Report Automatic system monitor of backup success OffTest File Restore Weekly Automatic system test restore Test Server Stand-site data transfer issue remediation up (If backup technology supports) Bi-Weekly Automatic system test restore Remediate Failing Backups As Needed Intervention when alerted to Review and failed backup system issue Excessive data transfer review jobs and remediate Restore Files / Data As Needed Intervention when alerted to backup system issue Restore files as requested by client Monitors & Service Monitoring* Frequency Detailed Description DR Offsite Transfer Excessive* <CriticalBU – Job Running > 8 Hours Continuous There is much more data queued The backups configuration may need adjusted BU - Backup Failed Continuous The backup failed and needs reviewed BU – Verify Backup Job Failed Continuous The backup couldn’t be verified as successful and needs tested BU – Backup Failed to transfer than usual DR Offsite Transfer Nearing Cap* Configure Job Continuous Warning that transfer cap is nearing cap and charges possible DR Offsite Transfer Failure* Continuous Warning that the offsite transfer is The backup process did not functioning begin properly Value Reporting* Frequency Detailed Description DR Offsite Transfer Status* ShadowProtect Weekly Report Weekly Shadow Protect report on previous week’s backups Health Report Monthly Provides a count of failed / successful backup jobs Service Onboarding Activities Frequency Detailed Description Evaluate current backup job(s) and requirements Once per Client Work with Client to assess current DR plan backups and current needs Configure, Deploy, and Test DR Backup Technology Technology Dependent Serviceable Technologies Supported Versions and Releases Efolder backup for file StorageCraft Shadowprotect Latest two major releases Efolder Replibit Serviceable Conditions Adequate storageAdequate, internet bandwidthcurrent, and actively licensed backup software licenses Storage space sufficient for the successful completion of backup jobs Storage space sufficient for adequate retention period Adequate and reasonably fast access to any/all remote, tape, or other physical backup data (Service levels are contingent upon this) Coverage Exclusions & Exceptions Data transfer and storage charges and fees The cost of any necessary software licenses The cost of temporary, permanent, and archival storage Data is not and cannot be guaranteed (However, this service is a method to help protect data) Service Levels & Performance Goals Offsite data transfer Backup jobs successful 95% of the time File Restore within general service levels listed in Coverage Summary (Technology and environment dependent) Virtual Server Standups within X hours of current data. time* (Technology and environment dependent) Service Level & Performance Exceptions Challenges with the technology that require the involvement of the backup technologies’ vendor/manufacturer Recovery of any/all files or data not included within original scoping requirements *Dependent on the Technology being utilized and may not be available Group 4 – Identity Management Coverage (A3.4) Service Provider Activities Frequency Detailed Description Domain User Permission Management Continuous Monitor AD user permissions Domain User Password Resets and Account Unlocks As Needed Approved user requested access Domain User Setup As Needed Approved user requested access Domain Group and Folder Permission Management As Needed Approved user requested access Monitors & Service Monitoring* Frequency Detailed Description Offline Servers Monitor Continuous Monitoring for offline Domain Controllers EV – Blacklisted Events (4720, 4238) Continuous Locked User Accounts Value Reporting* Frequency Detailed Description 30 Day AD Changes Monthly Report as requested by client of AD changes Login Status Report Quarterly Report as requested by client of system logins Service Onboarding Activities Frequency Detailed Description Active Directory Review and Cleanup Once Per Client Setup of Administrative and Support User Accounts Once Per Client Serviceable Technologies Supported Versions and Releases Microsoft Windows Domain Latest three major releases Serviceable Conditions Active Directory has been cleaned up and standardized to the Service Provider’s specifications. User must be physically or wirelessly connected to the Domain network and maintain an adequate internet connection Coverage Exclusions & Exceptions Microsoft Server and Active Directory Licensing The costs to manage, implement, and/or procure a single sign on solution Service Levels & Performance Goals Active Directory Uptime to equal or exceed 98% by means of server uptime and routine backups Service Level & Performance Exceptions Non-standard and/or complex multi-site or multi-domain environments *Dependent on the Technology being utilized and may not be available Group 5 – Patch Management Coverage (A3.5) Service Provider Activities Frequency Detailed Description Assess available Microsoft product updates Once Per Patch Verify valid patches available Test Service Provider approved updates As Needed User requested vertical application patching Deploy Service Provider tested and approved updates Once Per Patch Automatic monitoring of patches Validate deployed updates installed successfully Once Per Patch Automatic monitoring of patches Remediate unsuccessful updates As Needed Intervention resulting from failed patching alerts Monitors & Service Monitoring* Frequency Detailed Description UPDATES - Failed Continuous RMM Monitor of patch status UPDATES - Installed Continuous RMM Monitor of patch status UPDATES - Missing Service Pack Continuous RMM Monitor of patch status UPDATES - Out of Date Continuous RMM Monitor of patch status Value Reporting* Frequency Detailed Description Patch Detail On & Off-Boarding Patch Health (The Health Report may replace this.) Monthlyavailable

Service Provider Activities Frequency Detailed Description. Off-site data transfer check Daily Report of backup success and failure Off-site data transfer issue remediation As Needed Intervention when alerted to backup system issue Excessive data transfer review As Needed Intervention when alerted to backup system issue Monitors & Service Monitoring* Frequency Detailed Description DR Offsite Transfer Excessive* <Critical> Continuous There is much more data queued to transfer than usual DR Offsite Transfer Nearing Cap* Continuous Warning that transfer cap is nearing cap and charges possible DR Offsite Transfer Failure* Continuous Warning that the offsite transfer is not functioning Value Reporting* Frequency Detailed Description DR Offsite Transfer Status* Daily Report backup success and failure Service Onboarding Activities Frequency Detailed Description Evaluate current backup job(s) and requirements Once per Client Work with Client to assess current DR plan and needs Configure, Deploy, and Test DR Technology Technology Dependent Serviceable Technologies Supported Versions and Releases Efolder backup for file Microsoft Hyper-V Replication Latest two major releases Efolder Replibit Azure Site Recovery Latest two major releases Synology Replication Latest two major releases Serviceable Conditions Adequate storage, internet bandwidth, and software licenses Coverage Exclusions & Exceptions Data transfer and storage charges and fees Service Levels & Performance Goals Offsite data transfer within X 24 hours of current data. (Technology and environment dependent) Service Level & Performance Exceptions Excessive bandwidth use, inadequate bandwidth, or high change rate at customer location that causes data transfer delays and/or failures *Dependent on the Technology being utilized and may not be available Group 4 – Identity Management Coverage (A3.4A2.4) Service Provider Activities Frequency Detailed Description Domain User Permission Management Continuous Monitor AD user permissions Domain User Password Resets and Account Unlocks As Needed Approved user requested access Domain User Setup As Needed Approved user requested access Domain Group and Folder Permission Management As Needed Approved user requested access Monitors & Service Monitoring* Frequency Detailed Description Offline Servers Monitor Domain Controller(s) Continuous Monitoring for offline Domain Controllers EV – Blacklisted Events (4720, 4238) Continuous Locked Out User Accounts Continuous Monitor for accounts that become locked out Value Reporting* Frequency Detailed Description 30 Day AD Changes Monthly As Needed Report as requested by client of AD changes Login Status Report Quarterly As Needed Report as requested by client of system logins Service Onboarding Activities Frequency Detailed Description Active Directory Review and Cleanup Once Per Client Setup of Administrative and Support User Accounts Once Per Client Serviceable Technologies Supported Versions and Releases Microsoft Windows Domain Latest three major releases Serviceable Conditions Active Directory has been cleaned up and standardized to the Service Provider’s specifications. User must be physically or wirelessly connected to the Domain network and maintain an adequate internet connection Coverage Exclusions & Exceptions Microsoft Server and Active Directory Licensing The costs to manage, implement, and/or procure a single sign on solution Extensive or overly complex GPO conditions that were not built by our team Remediation of policy or permission changes performed by non-Decision Digital authorized personnel Service Levels & Performance Goals Active Directory Uptime to equal or exceed 98% by means of server uptime and routine backups Service Level & Performance Exceptions Non-standard and/or complex multi-site or multi-domain environments Remediation of policy or permission changes performed by non-Decision Digital authorized personnel *Dependent on the Technology being utilized and may not be available Group 5 – Patch Management Coverage (A3.5A2.5) Service Provider Activities Frequency Detailed Description Assess available Microsoft product updates Once Per Patch Verify valid patches available Test Service Provider approved updates As Needed User requested vertical application patching Deploy Service Provider tested and approved updates Once Per Patch Automatic monitoring of patches Validate deployed updates installed successfully Once Per Patch Automatic monitoring of patches Remediate unsuccessful updates As Needed Intervention resulting from failed patching alerts Monitors & Service Monitoring* Frequency Detailed Description UPDATES - Failed Continuous RMM Monitor of patch status UPDATES - Installed Continuous RMM Monitor of patch status UPDATES - Missing Service Pack Continuous RMM Monitor of patch status UPDATES - Out of Date Continuous RMM Monitor of patch status Value Reporting* Frequency Detailed Description Patch Detail On & Off-Boarding Patch Health (The Health Report may replace this.) MonthlyMonthly Monthly Executive Summary report Service Onboarding Activities Frequency Detailed Description Define & Setup Maintenance Windows with Client Define & Setup Patching Policy with Client Serviceable Technologies Supported Versions and Releases Windows Windows 8.1, and greater Microsoft Windows Server 2012 R2 and greater Serviceable Conditions Windows Installation properly activated with a valid license Windows Domain configured to Service Provider’s recommendations

Service Provider Activities Frequency Detailed Description. Off-site data transfer check Backup Check Daily Report Automatic system monitor of backup success OffTest File Restore Weekly Automatic system test restore Test Server Stand-site data transfer issue remediation up (If backup technology supports) Bi-Weekly Automatic system test restore Remediate Failing Backups As Needed Intervention when alerted to Review and failed backup system issue Excessive data transfer review jobs and remediate Restore Files / Data As Needed Intervention when alerted to backup system issue Restore files as requested by client Monitors & Service Monitoring* Frequency Detailed Description DR Offsite Transfer Excessive* <CriticalBU – Job Running > 8 Hours Continuous There is much more data queued The backups configuration may need adjusted BU - Backup Failed Continuous The backup failed and needs reviewed BU – Verify Backup Job Failed Continuous The backup couldn’t be verified as successful and needs tested BU – Backup Failed to transfer than usual DR Offsite Transfer Nearing Cap* Configure Job Continuous Warning that transfer cap is nearing cap and charges possible DR Offsite Transfer Failure* Continuous Warning that the offsite transfer is The backup process did not functioning begin properly Value Reporting* Frequency Detailed Description DR Offsite Transfer Status* ShadowProtect Weekly Report Weekly Shadow Protect report on previous week’s backups Health Report Monthly Provides a count of failed / successful backup jobs Service Onboarding Activities Frequency Detailed Description Evaluate current backup job(s) and requirements Once per Client Work with Client to assess current DR plan backups and current needs Configure, Deploy, and Test DR Backup Technology Technology Dependent Serviceable Technologies Supported Versions and Releases Efolder backup for file StorageCraft Shadowprotect Latest two major releases Efolder Replibit Serviceable Conditions Adequate storageAdequate, internet bandwidthcurrent, and actively licensed backup software licenses Storage space sufficient for the successful completion of backup jobs Storage space sufficient for adequate retention period Adequate and reasonably fast access to any/all remote, tape, or other physical backup data (Service levels are contingent upon this) Coverage Exclusions & Exceptions Data transfer and storage charges and fees The cost of any necessary software licenses The cost of temporary, permanent, and archival storage Data is not and cannot be guaranteed (However, this service is a method to help protect data) Service Levels & Performance Goals Offsite data transfer Backup jobs successful 95% of the time File Restore within general service levels listed in Coverage Summary (Technology and environment dependent) Virtual Server Standups within X hours of current data. time* (Technology and environment dependent) Service Level & Performance Exceptions Challenges with the technology that require the involvement of the backup technologies’ vendor/manufacturer Recovery of any/all files or data not included within original scoping requirements *Dependent on the Technology being utilized and may not be available Group 4 – Identity Management Coverage (A3.4) Service Provider Activities Frequency Detailed Description Domain User Permission Management Continuous Monitor AD user permissions Domain User Password Resets and Account Unlocks As Needed Approved user requested access Domain User Setup As Needed Approved user requested access Domain Group and Folder Permission Management As Needed Approved user requested access Monitors & Service Monitoring* Frequency Detailed Description Offline Servers Monitor Continuous Monitoring for offline Domain Controllers EV – Blacklisted Events (4720, 4238) Continuous Locked User Accounts Value Reporting* Frequency Detailed Description 30 Day AD Changes Monthly Report as requested by client of AD changes Login Status Report Quarterly Report as requested by client of system logins Service Onboarding Activities Frequency Detailed Description Active Directory Review and Cleanup Once Per Client Setup of Administrative and Support User Accounts Once Per Client Serviceable Technologies Supported Versions and Releases Microsoft Windows Domain Latest three major releases Serviceable Conditions Active Directory has been cleaned up and standardized to the Service Provider’s specifications. User must be physically or wirelessly connected to the Domain network and maintain an adequate internet connection Coverage Exclusions & Exceptions Microsoft Server and Active Directory Licensing The costs to manage, implement, and/or procure a single sign on solution Service Levels & Performance Goals Active Directory Uptime to equal or exceed 98% by means of server uptime and routine backups Service Level & Performance Exceptions Non-standard and/or complex multi-site or multi-domain environments *Dependent on the Technology being utilized and may not be available Group 5 – Patch Management Coverage (A3.5) Service Provider Activities Frequency Detailed Description Assess available Microsoft product updates Once Per Patch Verify valid patches available Test Service Provider approved updates As Needed User requested vertical application patching Deploy Service Provider tested and approved updates Once Per Patch Automatic monitoring of patches Validate deployed updates installed successfully Once Per Patch Automatic monitoring of patches Remediate unsuccessful updates As Needed Intervention resulting from failed patching alerts Monitors & Service Monitoring* Frequency Detailed Description UPDATES - Failed Continuous RMM Monitor of patch status UPDATES - Installed Continuous RMM Monitor of patch status UPDATES - Missing Service Pack Continuous RMM Monitor of patch status UPDATES - Out of Date Continuous RMM Monitor of patch status Value Reporting* Frequency Detailed Description Patch Detail On & Off-Boarding Patch Health (The Health Report may replace this.) Monthlyavailable

Service Provider Activities Frequency Detailed Description. Off-site data transfer check Daily Report of backup success Off-site data transfer issue remediation As Needed Intervention when alerted to backup system issue Excessive data transfer review As Needed Intervention when alerted to backup system issue Monitors & Service Monitoring* Frequency Detailed Description DR Offsite Transfer Excessive* <Critical> Continuous There is much more data queued to transfer than usual DR Offsite Transfer Nearing Cap* Continuous Warning that transfer cap is nearing cap and charges possible DR Offsite Transfer Failure* Continuous Warning that the offsite transfer is not functioning Value Reporting* Frequency Detailed Description DR Offsite Transfer Status* Service Onboarding Activities Frequency Detailed Description Evaluate current backup job(s) and requirements Once per Client Work with Client to assess current DR plan and needs Configure, Deploy, and Test DR Technology Technology Dependent Serviceable Technologies Supported Versions and Releases Efolder backup for file NewCloud Backup Latest two major releases Efolder Replibit NewCloud Backup Serviceable Conditions Adequate storage, internet bandwidth, and software licenses Coverage Exclusions & Exceptions Data transfer and storage charges and fees Service Levels & Performance Goals Offsite data transfer within X hours of current data. (Technology and environment dependent) Service Level & Performance Exceptions *Dependent on the Technology being utilized and may not be available Group 4 – Identity Management Coverage (A3.4) Service Provider Activities Frequency Detailed Description Domain User Permission Management Continuous Monitor AD A user permissions Domain User Password Resets and Account Unlocks As Needed Approved user requested access Domain User Setup As Needed Approved user requested access Domain Group and Folder Permission Management As Needed Approved user requested access Monitors & Service Monitoring* Frequency Detailed Description Offline Servers Monitor Continuous Monitoring for offline Domain Controllers EV – Blacklisted Events (4720, 4238) Continuous Locked User Accounts Value Reporting* Frequency Detailed Description 30 Day AD Changes Monthly Report as requested by client of AD changes Login Status Report Quarterly Report as requested by client of system logins Service Onboarding Activities Frequency Detailed Description Active Directory Review and Cleanup Once Per Client Setup of Administrative and Support User Accounts Once Per Client Serviceable Technologies Supported Versions and Releases Microsoft Windows Domain Latest three major releases Serviceable Conditions Active Directory has been cleaned up and standardized to the Service Provider’s specifications. User must be physically or wirelessly connected to the Domain network and maintain an adequate internet connection Coverage Exclusions & Exceptions Microsoft Server and Active Directory Licensing The costs to manage, implement, and/or procure a single sign on solution Service Levels & Performance Goals Active Directory Uptime to equal or exceed 98% by means of server uptime and routine backups Service Level & Performance Exceptions Non-standard and/or complex multi-site or multi-domain environments *Dependent on the Technology being utilized and may not be available Group 5 – Patch Management Coverage (A3.5) Service Provider Activities Frequency Detailed Description Assess available Microsoft product updates Once Per Patch Verify valid patches available Test Service Provider approved updates As Needed User requested vertical application patching Deploy Service Provider tested and approved updates Once Per Patch Automatic monitoring of patches Validate deployed updates installed successfully Once Per Patch Automatic monitoring of patches Remediate unsuccessful updates As Needed Intervention resulting from failed patching alerts Monitors & Service Monitoring* Frequency Detailed Description UPDATES - Failed Continuous RMM Monitor of patch status UPDATES - Installed Continuous RMM Monitor of patch status UPDATES - Missing Service Pack Continuous RMM Monitor of patch status UPDATES - Out of Date Continuous RMM Monitor of patch status Value Reporting* Frequency Detailed Description Patch Detail On & Off-Boarding Patch Health (The Health Report may replace this.) Monthlyaccess

Service Provider Activities Frequency Detailed Description. Off-site data transfer check Daily Report of backup success Off-site data transfer issue remediation Remediate Monitor Alerts As Needed Intervention when alerted to backup system issue Excessive data transfer review System alerts generated by RMM Remediate Malware/Virus Infection As Needed Intervention when alerted to backup system issue Address AV issues identified by RMM Adjust Antivirus Configuration As Needed Modify AV exceptions and settings Monitors & Service Monitoring* Frequency Detailed Description DR Offsite Transfer Excessive* <Critical> AV - Disabled Continuous There is much more data queued to transfer than usual DR Offsite Transfer Nearing Cap* RMM Review of AV status AV - Out of Date Continuous Warning that transfer cap is nearing cap and charges possible DR Offsite Transfer Failure* RMM Review of AV status AV - Software Missing Continuous Warning that the offsite transfer is not functioning RMM Review of AV status REG - Windows Appinit DLL Defined Continuous RMM Review of AV status Value Reporting* Frequency Detailed Description DR Offsite Transfer Status* Antivirus_Policy Quarterly Report of AV settings Antivirus_Threats Monthly Report of AV threats and interference Service Onboarding Activities Frequency Detailed Description Evaluate current backup job(s) Setup and requirements Configure Antivirus Server Once per Client Work with Client Deploy Antivirus to assess current DR plan and needs Configure, Deploy, and Test DR Technology Technology Dependent Workstations Once per workstation Deploy Antivirus to Servers Once per server Serviceable Technologies Supported Versions and Releases Efolder backup for file Webroot antivirus Latest two major releases Efolder Replibit Serviceable Conditions Adequate storageAntivirus is licensed, internet bandwidth, warranted and software licenses supported by vendor. Coverage Exclusions & Exceptions Data transfer and storage charges and fees Antivirus software/license purchases Malware remediation due to injection or negligent Client end-user activity. Antivirus Definition up to date within 1 day of available definitions. Service Levels & Performance Goals Offsite data transfer within X hours of current data. (Technology Antivirus Software Installed and environment dependent) Running on at least 95% Service Level & Performance Exceptions Malware is unpredictable and in turn, so is remediation. Therefore remediation attempts do not fall under general resolution service levels. Mass infections of a Client environment due to the unpredictable nature of malware, service levels cannot be guaranteed. *Dependent on the Technology being utilized and may not be available Group 4 – Identity Management Coverage (A3.4) Service Provider Activities Frequency Detailed Description Domain User Permission Management Continuous Monitor AD user permissions Domain User Password Resets and Account Unlocks As Needed Approved user requested access Domain User Setup As Needed Approved user requested access Domain Group and Folder Permission Management As Needed Approved user requested access Monitors & Service Monitoring* Frequency Detailed Description Offline Servers Monitor Continuous Monitoring for offline Domain Controllers EV – Blacklisted Events (4720, 4238) Continuous Locked User Accounts Value Reporting* Frequency Detailed Description 30 Day AD Changes Monthly Report as requested by client of AD changes Login Status Report Quarterly Report as requested by client of system logins Service Onboarding Activities Frequency Detailed Description Active Directory Review and Cleanup Once Per Client Setup of Administrative and Support User Accounts Once Per Client Serviceable Technologies Supported Versions and Releases Microsoft Windows Domain Latest three major releases Serviceable Conditions Active Directory has been cleaned up and standardized to the Service Provider’s specifications. User must be physically or wirelessly connected to the Domain network and maintain an adequate internet connection Coverage Exclusions & Exceptions Microsoft Server and Active Directory Licensing The costs to manage, implement, and/or procure a single sign on solution Service Levels & Performance Goals Active Directory Uptime to equal or exceed 98% by means of server uptime and routine backups Service Level & Performance Exceptions Non-standard and/or complex multi-site or multi-domain environments *Dependent on the Technology being utilized and may not be available Group 5 – Patch Management Coverage (A3.5) Service Provider Activities Frequency Detailed Description Assess available Microsoft product updates Once Per Patch Verify valid patches available Test Service Provider approved updates As Needed User requested vertical application patching Deploy Service Provider tested and approved updates Once Per Patch Automatic monitoring of patches Validate deployed updates installed successfully Once Per Patch Automatic monitoring of patches Remediate unsuccessful updates As Needed Intervention resulting from failed patching alerts Monitors & Service Monitoring* Frequency Detailed Description UPDATES - Failed Continuous RMM Monitor of patch status UPDATES - Installed Continuous RMM Monitor of patch status UPDATES - Missing Service Pack Continuous RMM Monitor of patch status UPDATES - Out of Date Continuous RMM Monitor of patch status Value Reporting* Frequency Detailed Description Patch Detail On & Off-Boarding Patch Health (The Health Report may replace this.) Monthlyavailable