Standard Terms and Conditions for the provision of Managed Services By Convergent Network Solutions Ltd

Transcription

1 Standard Terms and Conditions for the provision of Managed Services By Convergent Network Solutions Ltd 1. These terms pertain to the provision of managed security services by Convergent Network Solutions Limited ("CNS") to the Customer. 2. The following standard terms and conditions of the managed service (the Services) should be read in conjunction with the Managed Security & Compliance Services Agreement (the "Services Agreement") between CNS and the Customer. These standard terms and conditions and the provisions set out in the Services Agreement constitute the contract between CNS and the Customer for the supply of the managed service solution. In the event of any conflict between these terms and conditions and the terms of the Services Agreement the terms of the Services Agreement shall prevail. Save as defined separately in these standard terms the definitions used in the Service Agreement shall apply to these terms. 3. THE SERVICES. a. The Services provided by CNS in connection with the managed service offering shall consist of such of the following as shall be detailed in the Services Agreement: (i) CORE (ii) SECURE (iii) PRO-SECURE (iv) COMPLY & SECURE (v) EMERGENCY RESPONSE b. The service levels applicable to such Services shall be the service levels and key performance indicators set out in the Service Agreement together with any subsequently formulated in accordance with (c) below. The Services Agreement may, if specified therein, incorporate a bedding in period in respect of CORE, SECURE, PRO-SECURE, COMPLY & SECURE or EMERGENCY RESPONSE services during which time certain of the specific key performance indicators and agreed compliancy events (as listed in the relevant clause of the Services Agreement) will be agreed between the parties at the level specific to the Customer's requirements and following such agreement these will be incorporated into the Standard Key Performance Indicator List and supported vendors compliancy events. c. For all EMERGENCY RESPONSE only contracts, the Customer must purchase all incident response time in advance. d. For all EMERGENCY RESPONSE only contracts the Customer must maintain a minimum of 8 hours incident response time credit with an agreement to purchase additional time by when required. 4. DURATION. a. The contract shall commence on the Service Period Start Date set out in the Services Agreement and subject to clause 4b. shall operate for an initial term of 3 years from the Service Period Start Date of the agreement (the "Term".) b. Notwithstanding that the Term has not expired but subject to clause 4c. the Customer may terminate the contract on either the first or second anniversary of the date of the contract by giving CNS not less than 6 months prior written notice. On such termination the rights and obligations of the parties under the contract shall (save for those which by their nature and content are intended to survive termination of the contract) cease but without prejudice to the rights and liabilities of either party in respect of any matter arising before the date of termination. c. The parties acknowledge and agree that the fee payable by the Customer under this contract has been discounted to take account of the fact that the term of the Services Agreement is intended to be for a 3 year term. As such in the event that the Customer gives notice to terminate in accordance with clause 4b. on the first or second anniversary of the Service Period Start Date the Customer shall be liable to pay to CNS the Compensation Payment equivalent to 4c(i) 40% of the Fee payable in the second and third year of the contract (in the event that the contract is terminated on the first anniversary of the Commencement Date); or

2 4c(ii) 40% of the Fee payable in the third year of the contract (in the event that the contract is terminated on the second anniversary of the Commencement Date) the parties acknowledge the compensation payments set out in this clause to be a genuine pre-estimate of the damages and costs which will be suffered by CNS in the event of early termination prior to the third anniversary. d. After expiry of the Term the agreement shall continue unless and until terminated by either party giving not less than 6 months written notice to the other. Following expiry of the Term the Fee payable by the Customer shall increase to CNS's then current list price for the provision of those Services. e. Either party may by serving notice terminate the Services Agreement: (i) if the other party commits a material breach of the contract and in the event that the breach is capable of remedy, fails to remedy that breach within 28 days of written notice or in the event of nonpayment fails to make the payment within 14 days of written notice or (ii) If the other party ceases doing business or commences dissolution, insolvency or liquidation or receivership or administration or any analogous proceedings except for amalgamation or reconstruction. f. CNS may terminate the contract at any time on no less than [6] months prior written notice if: (i) there is a material change in the scope or volume of the Services compared with that as at the date of commencement of the contract; or (ii) there is a regulatory change giving rise to a material increase in the cost of providing the Services; or (iii) there is a material increase in the cost of providing the Services. 5. SERVICES AND SERVICE LEVELS. a. CNS shall provide the Services set out in the Services section of the Services Agreement (subject to any amendment in the Services Agreement.) b. The service levels applicable to the managed services are set out in the Services Agreement. c. As part of the business take on process under which the Services have been identified and in setting and agreeing the standard Key Performance Indicators and compliancy regulation or control events to be monitored set out in the Services Agreement ( Equipment and Events Schedule") CNS has relied upon the information given to it by the Customer in respect of the hardware, software, system services, resources, compliancy requirements and business processes used and operated by the Customer and unless expressly indicated otherwise in the Service Agreement CNS has not undertaken any independent verification of such hardware, software, system services, resources, compliancy requirements or business processes operated by the Customer nor the state and condition of such hardware or software system services, resources, compliancy events or business processes. d. The Services to be provided and the monitoring of the Key Performance Indicators, security and network events and agreed compliancy have been agreed by CNS on the basis that all information passed to CNS by the Customer relating to the hardware, software system services, resources, compliancy requirements and business processes operated and used by the Customer are correct, complete and accurate and will remain so at all times during the provision of the Services. In the event that such information is not correct or is incomplete or inaccurate or subsequently becomes incorrect, incomplete or inaccurate then the provision of any Service and/or the monitoring of any Key Performance Indicator, security and network events and agreed compliancy events affected by such incorrect, incomplete or inaccurate information shall be suspended and shall not be binding on CNS and CNS shall have no liability to the Customer in respect of the service and/or Key Performance Indicator, security and network event or compliancy event or alert so affected (including any past failure to provide any Services and/or to monitor any Key Performance Indicator, security and network events or agreed compliancy events affected by this clause). In the event that any information is found to be incorrect incomplete or inaccurate for whatever reason the parties shall use their reasonable endeavours to negotiate in good faith such adjustment to the Fee and/or amendment to the Key Performance Indicator, security and network events or agreed compliancy events as would be reasonable based on the correct, full and accurate information. If the parties reach agreement then the revised Fee and/or Key Performance Indicator, security and network events and agreed compliancy events shall take effect from the date that such Key Performance Indicator or agreed compliancy events are subsequently agreed between the parties. e. CNS shall have no liability for a failure to provide any of the Services or to monitor any Key Performance Indicator, security and network events or agreed compliancy events where such failure

3 arises as a direct or indirect result of any act or omission of the Customer or any third party which affects CNS's ability to access the Customers systems software or hardware in any manner. f. Save to the extent that CNS is providing the hardware or software maintenance services to the Customer, CNS shall also not be liable for its failure to provide any Service and/or monitor any of the Key Performance Indicators, security and network events or capture and alert on any agreed compliancy event in circumstances where such failure is as a direct or indirect result of either a failure of the Customer's systems, hardware or software or as a result of a failure to maintain or support such systems, hardware or software. g. For the avoidance of doubt the service levels in connection with the managed services provided by CNS and set out in the Key Performance Indicators, security and network events and agreed compliancy events relate to CNS's monitoring of such Key Performance Indicators, security and network events and agreed compliancy events and not to the operation of the Customer's hardware, software system services, resources or business processes in accordance with such Key Performance Indicators, security and network events and compliancy events to be captured. h. Save as set out in the provisions relating to the specific service level in the Services Agreement the period for measurement of any compliance with a service level shall be a period of 12 months from either the Commencement date (for the first year of the Agreement) or from the immediately preceding anniversary of the Commencement of the Service Agreement (in all subsequent years). i. Save as set out in the provisions relating to the specific service level in the Services Agreement, or where the Customer has purchased 24x7 support, any response times, given in respect of the fault management service levels shall operate only during CNS's normal working hours which for the purpose of this agreement clause shall be to Monday to Friday excluding bank and public holidays ("business hours"). j. CNS shall be permitted one service level violation in any rolling 3 month period which shall not be penalised. On the occurrence of any second or subsequent service level violation within such period then the Customer shall be entitled to a Service Credit against the Fee payable in respect of the following year equivalent to one days fee (calculated at the yearly rate applicable in the year in which the default took place) for a CORE service failure and equivalent to one days fee (calculated at the yearly rate applicable in the year in which the default took place) for a SECURE service failure and equivalent to one days fee (calculated at the yearly rate applicable in the year in which the default took place) for change management and threat management service failure. For any other PR0-SECURE or COMPLY & SECURE Service violation, Customers sole remedy is as per Appendix B of the Managed Security & Compliance Services Agreement. k. For the purposes of measuring a Key Performance Indicator, a device will not be considered to be unavailable or down if it is part of a failover pair and the resilient device maintains continuity of service and functionality. l. Service reports and service review meetings will be in accordance with the service reporting provisions set out in the Service Agreement. m. A Service Credit can be offered against the Fee payable in respect of the following years service, as per 5j. as a result of a Service violation. No Service Credit will be applied when the Customer is in the last year of the contract and is not intending to renew for a further period. n Where reference is made to the business hours of 09:00 17:30 this means that time will cease to run and activities will cease at 17:30 and re-start at 09:00 on the next day in which business hours occur. 6. SUPPORTED EQUIPMENT. a. The Services shall be provided only in respect of the equipment listed in the equipment schedule to the Services Agreement (the "Equipment"). Any work in respect of any other equipment will be separately chargeable this includes other network and security infrastructure devices. b. Unless otherwise agreed with CNS the Customer shall be responsible for maintaining the Equipment and its environment in accordance with any manufacturer specification and tolerances and CNS shall have no responsibility for failure to provide any of the Services if such failure results from any failure by the Customer to so maintain the Equipment or its environment. c. Should any supported Equipment be removed from the equipment schedule before the Services Agreement has terminated, no refund will be offered. d. Should any of the supported Equipment be upgraded with new functionality or hardware, or should the use of any

4 Equipment change substantially (e.g. supports new class of users; moved to a different location on the network; new interface added; chargeable piece of functionality added) extra charges may be levied in accordance with clause 8. e. If changes are made to the Equipment that do not constitute a substantial change, they must go through the change control process set out in clause 9c. If this is not the case, then all service levels which relate to that piece of equipment shall be suspended until the change is agreed through the change control process. f. Should any supported Equipment item be replaced with a like for like new Equipment item within the same supported device category and where CNS is satisfied that the hardware/software/functionality or services associated with the replacement item remains consistent with the hardware/software/functionality or services associated with the replaced item, there will be no additional service charges. g. Should any supported equipment substantially change to affect the format of the agreed security and network events, compliancy events or the agreed security and network events or compliancy events cease to be generated, CNS shall have no responsibility for failure to provide any of the Services and Business Take On charges may be levied to reinstate the device into Service. MANNER OF SERVICE PROVISION. e. CORE, SECURE, PRO-SECURE, COMPLY & SECURE or EMERGENCY Services will be provided from CNS's Network Operations Centre (NOC) (currently, Advanced 365 Limited, Goswell Road, London, EC1V 7EB). Save as provided in accordance with the fault management service, there will be no onsite service provision at the Customer site other than a visit by CNS for setup and business take on purposes and any agreed day visits for the purposes of service review as needed. f. Save as specified in the Services Agreement CNS s Service Desk will operate from CNS's offices (currently, 5 th Floor, Holland House, 1-4 Bury Street, London, EC3A 5AW) during business hours. Outside of business hours service will be provided by CNS s Service Call Centre and remotely by the on-call engineer. The service does not cover public holidays except by prior agreement. g. The service will be provided from secure management workstations at CNS's offices and network management tools at CNS s NOC. All reasonable steps are taken to ensure the integrity of the remote management connection. Remote support will be provided by the on-call engineer by encrypted VPN into CNS s NOC, and then from encrypted VPN to the supported Equipment at the Customer site. h. Connectivity will be across the Internet via encrypted VPN. No backup connectivity method exists unless otherwise requested by the Customer at the Customer s expense. i. Connectivity at the Customer site will be across VPN over the Internet. The VPN will terminate at a firewall or other appropriate termination point at the Customer site. j. Connectivity at CNS site will be across the normal Internet connection of the provider, with the VPN terminating on a suitable device on the provider network. k. The tools used to provide service will be at the discretion of CNS and may change from time to time without notice. For the EMERGENCY RESPONSE service, CNS shall in all circumstances be operating under the Customer direction relating to incidents directly affecting the Customer and its business operation. 7. CHARGES. a. The Fee for the Services shall be payable annually in advance. Payment of the Fee for the first year shall be made in cleared funds prior to the Service Period Start Date in the Agreement. Fees for the subsequent years shall be payable in cleared funds prior to the anniversary of the commencement date. b. All Fees set out in the Services Agreement are exclusive of VAT which the Customer shall be liable to pay in addition to the Fee at the rate in force form time to time. All Fees are to be paid in pounds sterling. c. If payment of the fee has not been made in accordance with clause 8a. by the due date CNS shall be entitled on giving written notice to the Customer to suspend the provision of the Services pending receipt of payment. d. Any notice served by the Customer that it wishes to exercises its rights under clause 4b. to terminate the contract prior to the expiry of the Term will only be valid if it is accompanied by payment of the Compensation Payment calculated by reference to clause 4c.

5 e. The Fee covers onsite setup of service as detailed in the Services Agreement, offsite service running to service levels. All onsite work must be done within business hours or separately negotiated charges will come into force. f. Any works undertaken in connection with the managed services but which is beyond the scope of the services shall be charged out on an ad-hoc basis at the guide rate of 250 per hour. If any change to the supported Equipment or its environment is made as per clause 6d, surcharges will be made against the contract by separate negotiation. Until these charges are agreed, all service levels are in abeyance, although the contract will continue to run.

6 8. SERVICE MANAGEMENT FRAMEWORK. a. CNS and the Customer will provide service contact details for the primary points of contact between the parties. In the case of CNS this will be the Service Desk Manager unless specified otherwise in the Services Agreement. b. The Customer shall provide service contact details for the relevant members of its IT team, security team and compliance team and (if appropriate) notify CNS of the areas of responsibility of each member of the team so listed. c. If at any time the parties agree any alteration in either the Services to be provided or the scope or terms of any specific Service then such change shall be recorded in writing signed by each of the parties and unless specified in the record of change that change shall be deemed to have been approved and shall take effect from the date of signature of the record of such change. Unless agreed otherwise and set out in the record of change signed in accordance with this clause all costs incurred by CNS in connection with any proposed change shall be payable by the Customer. d. Any disagreement between the parties shall first be discussed in good faith between the CNS Service desk manager and the Customer's service contact referred to in clause 9a. above. If any such disagreement cannot be resolved by those respective parties within 7 days of the issue arising (or such longer date as those parties may agree) the matter shall be referred to the Head of Managed Services within CNS and the appropriate escalation officer of the Customer who shall be notified to CNS by the Customer on or before the expiry of the initial 7 day period referred to for the initial discussions between the parties. 9. THIRD PARTIES. a. CNS may at any time during the course of the contract sub-contract the provision of any of the Services or any part of any of the Services to any third party. b. CNS cannot exercise control over, or be held responsible for the actions of, other third party suppliers appointed by the Customer. c. The Customer will provide a list of third party contact details and will facilitate initial introductions and on-going communication between CNS and other third party suppliers. d. Communications between CNS and other third parties will be direct on the introduction being made by the Customer. e. In areas where third parties are unresponsive, this will be notified to the Customer for Customer action. SLA failures caused by third parties will not be counted for normal SLA measurements. 10. INTELLECTUAL PROPERTY a. For the purposes of this clause 11, Intellectual Property Rights means all patents, rights to inventions, utility models, copyright and related rights, trademarks, service marks, trade, business and domain names, rights in trade dress or get-up, rights in goodwill or to sue for passing off, unfair competition rights, rights in designs, rights in computer software, database right, topography rights, rights in confidential information (including know-how and trade secrets) and any other intellectual property rights, in each case whether registered or unregistered and including all applications for, and renewals or extensions of, such rights, and all similar or equivalent rights or forms of protection in any part of the world b. CNS shall own and retain all Intellectual Property Rights created prior to or independently of the contract. All Intellectual Property Rights created by CNS in carrying out the Services shall, upon creation, vest in CNS. c. The Customer grants to CNS a non-exclusive and royalty free right to use any Intellectual Property Rights of the Customer during the term of the contract for the purposes of enabling CNS to provide the Services. d. Nothing in the contract will restrict CNS from the use of any general skill or knowledge gained from the experience of providing or receiving the Services which it, individually or jointly, develops or discloses under the contract provided that in doing so CNS does not infringe the Intellectual Property Rights of the Customer.

7 11. ANTI BRIBERY a. Each party (Complying Party) shall: (i) comply with all applicable laws, statutes, regulations and codes relating to anti-bribery and anti-corruption including but not limited to the Bribery Act 2010 (Relevant Requirements); as soon as practicable, report to the other party any request or demand for any undue financial or other advantage of any kind received by the Complying Party in connection with the performance of the contract; (ii) ensure that any person associated with the Complying Party who is performing services in connection with the Services Agreement does so only on the basis of a written contract which imposes terms similar to those imposed on the Complying Party in this clause 12 (Relevant Terms.) 12. LIMITATION ON LIABILITY. a. This clause sets out the entire financial liability of CNS (including any liability for the acts or omissions of its employees, agents, consultants and subcontractors) to the Customer in respect of: - any breach of the Services Agreement or these terms. - any use made by the Customer of the Services or any Equipment supplied by CNS or any part of them; - any representation, statement or tortuous act or omission (including negligence) arising under or in connection with the Service Agreement or the provision of the Services and/or Equipment by CNS; b. In recognition of the relative risks and rewards of the parties agree that, subject to clause 13.e, CNS total liability in contract, tort (including negligence or breach of statutory duty), misrepresentation, restitution or otherwise arising in connection with the Services Agreement and any contract performed by CNS in connection with the Services Agreement shall be limited to the value of the annual Fee set out in the Services Agreement in respect of the year in which the cause of action arose or one million pounds sterling, whichever is less. c. CNS shall not be liable to the Customer for any, loss of profits, loss of business, depletion of goodwill and/or similar losses or loss of anticipated savings, loss of equipment, loss of contract, loss of use, loss or corruption of data or information or any special, indirect, consequential, or pure economic loss, costs, damage, charges or expenses. d. CNS shall be liable for any physical damage it causes to an item of Equipment due to its negligence or wilful misconduct. If this occurs, the Customer's sole remedy shall be limited to either CNS's repair of the item of Equipment, or, if CNS reasonably determines that this is impossible or uneconomic, replacement with comparable equipment or a pro-rated refund based on depreciation over 5 years. e. Nothing in these terms or a contract shall be construed to limit the liability of CNS for death or personal injury caused by its own negligence or for any damage or liability incurred by the Customer as a result of fraud or fraudulent misrepresentation by CNS. f. By entering into a contract based on these terms, the parties acknowledge that this limitation of liability clause has been reviewed and understood and is a material part of these terms, and that each party has had the opportunity to seek legal advice regarding this clause. 13. CONFIDENTIALITY. a. For the purpose of this clause 14, confidential information means any information or data in any form or medium, including but not limited to written, documentary, oral or electronic information, which is marked confidential or which by its nature or the circumstances surrounding its disclosure should reasonably be regarded as confidential, including but not limited to the terms of any contract. b. Both parties agree to take reasonable care to ensure that any confidential information remains confidential. Both parties agree not to disclose any confidential information during or subsequent to the Term of any contract to any third party, other than where the disclosure is reasonable in the context of general legal requirements or the provision of any services or equipment, such as but not limited to disclosure as necessary to any employee or sub-contractor. Confidential information may be disclosed if: - it is in the public domain without breach of these terms; - it was already known by the party receiving it; - it was, so far as the receiving party is aware, legitimately disclosed to it on a non-confidential basis without any restriction on its further disclosure; or

8 - disclosure is required by any court, legislative or regulatory body, provided that, if permitted, the party who made the original disclosure is notified as soon as possible. c. Both parties agree to ensure any third party to whom disclosure is made in accordance with these terms will comply with the obligations in this clause 14. d. Both Parties agree that all confidential information will not be used by the receiving Party for any purpose other than performing its obligations under the Services Agreement without the express written consent of the disclosing Party. 14. FORCE MAJEURE. a. Neither party shall be responsible for a delay or failure to perform an obligation under a contract, other than a delay in making a due payment by an affected party, if caused by an event beyond the reasonable control of that party, provided that the other party is notified as soon as practicable. Events beyond a party's reasonable control include but are not limited to fire, flood, weather conditions, civil and industrial disturbances, power surges or failure and delays or failures by suppliers, subcontractors, utility companies, telephone companies, internet carriers, telecommunications or other service providers. b. The affected party shall use reasonable endeavours to fulfil its obligations as far as reasonably possible. c. If the Customer or CNS suffers delay or failure due to an event beyond its reasonable control in accordance with clause 15a, it shall give written notice to the other party and if the delay or failure due to such an event continues for a period in excess 30 days then both CNS and the Customer shall be entitled to terminate the contract forthwith on giving written notice to the other party. 15. GENERAL. a. Governing law. These terms and all contracts subject to them shall be governed by English law and both parties agree to be bound by the exclusive jurisdiction of the English courts. b. Assignment. Neither party may assign or transfer any of its rights or obligations under a contract without the prior written consent of the other party, which consent shall not be unreasonably withheld, provided that nothing in this clause or in any contract shall prevent CNS from using subcontractors to perform any of its obligations. c. Binding effect. All contracts subject to these terms shall be binding upon and shall inure to the benefit of the parties and their respective successors and permitted assigns. d. Third party rights. Nothing in these terms, expressed or implied, shall confer any right or remedy on any person other than the parties. No party other than CNS and the Customer shall have any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any of these terms. e. Counterparts. A contract may be executed in one or more counterparts, each of which shall be deemed an original, but which together shall constitute a single agreement. Either party may rely on a faxed authorised signature from the other party to bind that other party. f. Amendment and waiver. These terms or any other provision of a contract may be modified or supplemented only by a written document (excluding electronic mail and instant messaging) executed by both parties. A waiver by either party of a breach of these terms or any other provision of a contract shall not be construed as a waiver of any subsequent or different breach. The fact that a party has not sought a remedy for non-compliance or breach by the other party shall not be construed as a waiver of any right or remedy. g. Invalid clauses. If any court finds any provision of these terms or any other provision of a contract to be invalid or unenforceable, the remainder of these terms and the contract shall continue in full force and effect as if the provision had not existed and the parties shall negotiate in good faith to agree a provision putting them in the same position(as near as possible) to the invalid or unenforceable provision. h. Preparation of these terms. The parties acknowledge and agree that these terms and the terms the Service Agreement have been fully and carefully reviewed and negotiated by the parties. i. Entire agreement. Each contract constitutes the entire agreement and understanding between the parties about its subject matter and supersedes all prior agreements and understandings about that subject matter. No usage of trade or course of dealing by or between the parties shall be deemed to constitute any variation or amendment of any contract or these terms. Each party acknowledges that in entering into a contract, it does not do so on the basis of, and does not rely on, any representation, warranty or other provision except as provided in writing in the contract. j. Headings. The headings appearing in these terms have been inserted as a matter of convenience and shall not affect their meaning or interpretation.

9 k. Independent parties. Nothing in these terms shall be construed to establish or create an agency, partnership or joint venture relationship between the parties. l. Non-solicitation. Both parties agree not to directly or indirectly solicit, employ or contract with any employee of the other party who has been associated with a contract between the parties during its term and for one year after its termination or expiry. m. Notices. Notices required by these terms shall be in writing and shall either be delivered in person or by a postal or courier service which requires the signature of the receiving party. The notice will become effective on delivery. Notices shall be served in the case of CNS at Holland House, 1-4 Bury Street, London, EC3A 5AW marked for the attention of the Service Contracts Manager and in the case of the Customer at the registered office address of the Customer.

10 This Agreement is made on the day of 2014, between CNS and the Customer This Agreement is signed by the duly authorised representatives of the above mentioned parties: - Signed on behalf of: (The Customer.) Signed by: Name: Position: Signed on behalf of: (Convergent Network Solutions Ltd.) Signed by: Name: Position: