Managed GRC Terms

Scope

1.1 Covered Work. Managed GRC provides a dedicated team to manage Customer's governance, risk, and compliance program using the Platform on an ongoing basis, in place of Customer maintaining its own GRC analyst staff. Covered activities, team composition, and capacity are as stated in the applicable Order Form, and may include risk assessments, vendor risk reviews, control and policy maintenance, evidence collection, reporting, and day-to-day administration of Customer's Platform instance.

1.2 Not Included. Managed GRC does not include independent advisory work not tied to day-to-day program management, which is Vectra Advisory and governed by Schedule 4, or Automation Solution build work, which is governed by Schedule 1. The applicable Order Form states which, if any, of those services are included alongside Managed GRC.

1.3 Platform Subscription Required. Managed GRC requires Customer to hold an active subscription to the Platform. Services Provider cannot perform Managed GRC without it, because the program being managed runs on the Platform.

Team and Access

2.1 Team Assignment. Services Provider will assign a team to Customer's account as described in the Order Form. Services Provider may change the individuals assigned, provided the team's collective capacity and qualifications remain consistent with the Order Form.

2.2 Platform Access. Customer will designate the assigned team as Authorized Users under the MSSA. That access, and its use, is governed by the MSSA, not this Schedule. Customer may add or remove a team member's access at any time using the functionality of the Services. Services Provider is responsible for an assigned team member's acts and omissions while designated as an Authorized User, including compliance with the MSSA; Section 3.2 of the MSSA relieves Customer of responsibility for those personnel.

Service Delivery

3.1 Cadence. Reporting and meeting cadence are as stated in the Order Form or as the Parties otherwise agree. Customer may escalate a service concern to Services Provider's engagement lead for the account.

3.2 Customer Cooperation. Customer will provide the access, information, decisions, and cooperation reasonably necessary for Services Provider to manage the program, including timely responses needed to complete a review, assessment, or control activity on schedule.

3.3 Capacity and Overages. Where the Order Form states an included capacity or volume, work requested beyond that capacity is out of scope for the Fees stated in the Order Form and requires a Change Order or new Order Form.

3.4 No Guaranteed Outcome. Services Provider does not warrant or guarantee that Customer will obtain or maintain any certification, attestation, audit result, or regulatory status. Managed GRC assists Customer in operating its compliance program; Customer remains solely responsible for that program and for decisions made using Services Provider's work product.

Work Product

4.1 In-Platform Work. Output the assigned team creates within the Platform in the course of Managed GRC is Customer's own output under the MSSA, in the same manner as if created by Customer's own Authorized User, and is not a Deliverable under the Agreement.

4.2 Standalone Materials. A document or other material the team delivers outside the Platform is a Deliverable under the Agreement only if the applicable Order Form identifies it as such; Section 11.3 of the Agreement governs its ownership. Absent that identification, standalone material remains owned by Services Provider, which grants Customer a perpetual, non-exclusive, royalty-free license to use it for Customer's business purposes, including in providing services to its Clients.

4.3 No Acceptance Criteria. Managed GRC does not carry Acceptance Criteria, and Section 5 of the Agreement does not apply to it, whether or not a Deliverable results under Section 4.2.

Fees and Term

5.1 Fees. Managed GRC Fees, billing basis, and term are as stated in the Order Form. This Schedule does not itself state a fee structure; pricing varies by Customer's size, complexity, and scope and is set on a per-deal basis.