Monitoring and Detection Service Level Agreement

1.               Certain Definitions.  For purposes of this Service Level Agreement (SLA), the following terms shall have the meaning set forth herein.   Capitalized terms used in this SLA but not defined herein, shall have the meaning otherwise ascribed thereto in the MSA.

“Client Systems” means Client’s network, computer systems, software systems, telecommunications systems, and other technology, whether owned or licensed by Client.

 “Incident” means an outage, error, defect, deficiency, failure or other similar event within the control of Binary Defense that -materially degrades or prevents the performance by Binary Defense of the Managed Security Services.

“Managed Security Services” means the managed security services described in the SOW.

“Scheduled System Down Time” means the total time during which the Managed Security Services are down and not made available to Client due to planned maintenance or correction.

“Service Credit” means a fee credit in an amount equal to the percentage of the Managed Security Services fee otherwise payable by Client for a period during which Unscheduled System Down Time occurs (as further defined under Section 4 of this SLA).

“System Availability” means the percentage of time during which the Managed Security Services are available to Client and working without Incident or Scheduled System Down Time or other exclusions as further defined under Section 4 of this SLA.

“Unscheduled System Down Time” is any time during which the Managed Security Services are not available to Client due to an Incident.

2.               Support and Maintenance of Managed Security Services.  Binary Defense will maintain and provide or cause to be provided support for the Managed Security Services in accordance with its then current support policies.  In order for Binary Defense to provide managed or co-managed Managed Security Services, Client hereby agrees that Client is required to provide Binary Defense with a direct connection to the Client devices on its network through an authenticated service in Binary Defense’s secure operations center. If required to provide Managed Security Services through a VPN or any other indirect means, Client hereby agrees that Binary Defense shall have no responsibility or liability related to a failure to perform or any delay in performing its obligations, including but not limited to meeting the SLA, any adds, moves, changes to, or access to such devices in connection with any incident response or held desk request. With respect to this Service Level Agreement, Support and maintenance of the Managed Security Services shall include the following services:

(a)              Maintain and operate, on a 24 hour per day, 7 day per week, 365 day per year basis, a platform designed to make the Managed Security Services available to Client with not less than a 99% rate of System Availability. 

(b)              Binary Defense will give Client prior written notice of all periods of Scheduled System Down Time prior to the commencement thereof.  In the event Unscheduled System Down Time is necessary, Binary Defense shall advise Client as soon as reasonably practicable prior to commencing the same.

(c)              Provide software support and maintenance for Managed Security Services including, without limitation, the use of commercially reasonable efforts to correct known software “bugs”, errors and defects so that the Managed Security Services operate in the manner for which they are intended.

(d)              Follow the Emergency Response Procedure (described in Section 3 below) and the System Availability requirements set forth in this SLA.3.    Emergency Response Procedure.  Binary Defense will use commercially reasonable efforts to correct any Incident that causes Unscheduled System Down Time as quickly as possible and minimize the adverse impact of the Unscheduled System Down Time on the provision of Managed Security Services.  The correction and resolution of any Incident that causes Unscheduled System Down Time will be conducted in accordance with the Emergency Response Procedure set forth in this Section.

(a)              Incident Classification.  When an Incident occurs with regard to the Managed Security Services and is reported to Binary Defense by Client or discovered by Binary Defense, Binary Defense will assign a severity level to each Incident based on the Incident Classification Table below.

Incident Classification Table

(b)              Error Reporting and Response.  If Client becomes aware of an Incident, Client will report the Incident to Binary Defense together with a reasonable description of the Incident.  Binary Defense will assign a classification to the reported Incident and respond to Client’s reported Incident as indicated below.

(c)              Secure Operations Center (SOC) Availability.  The SOC will maintain communications availability to the Internet 99% of the time during a calendar month.  Communications availability is defined as the ability for Binary Defense SOC to transmit and receive TCP/IP packets between its networks and its upstream Internet Service Provider.

(d)              Incident Response.  Client shall receive a response via help desk ticketing system, email or telephonically (pre-selected by Client in writing), to security incidents within thirty (30) minutes from receipt of an alarm event notification to Binary Defense’ onsite monitored security information and event management application, and the determination by Binary Defense that the event constitutes an Incident. 

(e)              Help Desk Requests.  Requests submitted via the Binary Defense Portal or via telephone will be subject to “initial response” (either through the help desk ticketing system, email or telephonically) within one (1) hour from the time stamp on the help desk ticket created by Binary Defense.  An initial response to Help Desk request classified as “Emergency” on the help desk ticket will be sent within thirty (30) minutes from the time stamp on the help desk ticket created by Binary Defense.

4.               System Availability and Service Credits.

• Required Quarterly System Availability.  Binary Defense will use commercially reasonable efforts to make the Managed Security Services available to Client with System Availability of not less than 99% during any quarter on a cumulative basis.
• Calculation of Quarterly System Availability.  System Availability shall be calculated on a quarterly basis and will expressed as a percentage and determined as follows:

Scheduled System Down Time.  Client shall be given reasonable prior written notice of all periods of Scheduled System Down Time prior to the commencement thereof.

(d)              Credit.  In the event that this SLA is not met for a given calendar month, as Client’s sole and exclusive right and remedy and Binary Defense’s sole and exclusive liability and obligation, Client shall be entitled to a monetary credit as described in this subsection (d).  The monetary credit will be double the applicable monthly service per minute fee for each minute over the required response time.  A credit shall be calculated by dividing the monthly payment fee for the applicable service for which SLA failure occurred by 43,200 multiplied by 2 and then multiplied by the number of minutes over the required response time.

5.               Service Level Credit Exclusions. No Service Level Credits are available: (a) during Scheduled System Down Time; (b) in the event of any Client caused service outage, connectivity, or other failure of Client Systems; (c) during a Force Majeure Event (defined in the MSA); (d) Client misuse, abuse or other use not in compliance with the MSA or the Documentation; (e) Client’s failure to meet any minimum hardware or software requirements set forth in the Documentation;  and (f) availability or performance of the internet at large between Binary Defense and Client.  Client agrees that in no event will the total amount of service credits to the Client shall exceed the service fees paid by Client for such month.