1. DEFINITIONS

Agreement means the agreement between the parties to which this schedule is appended

Customer includes its subsidiaries/ affiliates entities

Customer Help Desk means the internal support desk established by the Customer qualified to support the Services within the Customer’s operations

Business Day means a Day on which the Customer is open for business at a office location using the Service

Day means a calendar day

Maintenance and Support Services means the maintenance and support services to be provided by SCW as described in this Schedule

Minimum Service Level means the minimum Service Levels to be achieved by SCW as set out in this Schedule

Response Times means the time period commencing with notification from the Customer of an incident and ends with the initial response from SCW

Resolution Time means the time period commencing with notification being received from the Customer and ending with a response or deemed response from the Customer Help Desk that an item has been resolved

Service means the online security learning service to be provided by SCW to the Customer

Service Credits means the applicable service credits as described in 2(f) of the Service Levels

Service Hours means, in respect of each week of the Term, the period from the start of the first business day in the first location from which Customer accesses the Services to the end of the last Business day in the relevant week in the last location from which Customer accesses the Services

Service Levels means the performance levels to which the Services shall be provided as set out in this Schedule

Service Period means each calendar month that Customer receives the Services

Service Up Time Percentage means the total number of minutes in a calendar month minus the number of minutes of downtime suffered in a calendar month, divided by the total number of minutes in a calendar month minus scheduled downtime

System Response Time means the time required for the Service to respond to an input as set

Term means the term for which the Customer has subscribed to the Service

Up Time has the meaning set out in 2(e)(iii) of the Service Levels

2. SERVICES SPECIFICATION

GENERAL

1. This schedule describes the scope and functionality of the Services to be provided by SCW to the Customer under this Subscription Agreement. It also specifies certain of the obligations of each party in the delivery of the Services.
2. Each Service has, where specified, an associated Service Level

SERVICES

1. SCW shall supply Customer with an online security learning service incorporating the following production environment services
   i. Online Access: On-line access to the Service during the Service Hours excluding scheduled downtime as defined in this schedule or as otherwise agreed in writing between the parties
   ii. Maintenance and Support Services during the Service Hours
   iii. Data back-ups in accordance with section 5
   iv. Application management:
        i. application upgrades,
        ii. delivery of application maintenance updates
2. SCW shall monitor and manage all components used to deliver the Service during the Service Hours throughout the Term
3. SCW shall ensure appropriate capacity planning of the Services to ensure there is always sufficient capacity to provide the Service at the Service Levels. This shall require Customer to advise SCW of any anticipated material changes to the use of the Service

REPORTING

1. SCW shall make available to authorized Support Contacts a monthly management report detailing the performance of the Service against the Service Levels
   

3. MAINTENANCE AND SUPPORT SERVICES

RELEASE STRATEGY

1. SCW will inform Customer regularly of the timing and contents of new releases to the Service. Customer may provide suggestions and input to SCW regarding any planned or requested new features. SCW shall, at its sole discretion, consider whether Customer’s suggestions shall be included in a subsequent release as part of the Maintenance and Support Services
2. Except where a product enhancement cost has been agreed with the Customer, such new releases to the Service shall be made at no cost to the Customer
3. SCW shall document any such changes in release notes which shall be made available to the Customer as soon as possible, but no later than the date any new release is issued.

SUPPORT SERVICES & RESPONSIBILITIES

1. SCW shall provide the support services in English
2. SCW shall notify Customer of all incidents that may have an impact on the Service provided to the Customer
3. SCW shall be responsible for:
   i.   The availability of the Service
   ii.  Solving incidents and problems raised by the Customer Help Desk
   iii. Implementing changes to the Service required as a result of solving incidents
   iv. Communicating the status of incidents to the Customer Help Desk
   v.  Communicating information about planned system changes of outages to Customer and the subsidiaries in a timely manner
   vi. Responding to each incident in line with the specified actions for each incident class
4. Customer is responsible for:
   i.  Raising incidents to the SCW help desk through a centralized Customer Help Desk
   ii.  The Customer must nominate at least 2 and not more than [X] authorized Support Contacts and notify SCW of their names and contact details immediately following the date of the Agreement.
   iii. Incidents and service requests must be reported by email by an authorized Support Contact to support@securecodewarrior.com
   iv. No phone support is provided directly to User
   v. The Customer must not publish SCW’s contact details on their intranet, website or anywhere else.

INCIDENT MANAGEMENT

1. The Customer Help Desk shall provide the following items when notifying SCW of an incident
   i.   Incident time, duration and location
   ii.  User ID and contact details
   iii.  Incident description
   iv. Category of incident, to be mutually agreed between the parties.

INCIDENT CATEGORIZATION

1. Class A – Severe Impact Provision of Service Failure
   ‍An incident that results in the loss of all or a significant portion of the service and impacts a majority of the users.‍
2. Class B – Major Impact Provision of Service Failure
   The service is accessible by means of a workaround, or only a small number of users are impacted Or an incident which materially affects the performance of the Services in a negative manner or materially restricts the Customer’s use of the Service‍
3. Class C – Moderate Impact
   Incidents occur which do not individually represent a failure of the service, but are agreed as defects Or an incident which only has a minor effect on the Customer’s use of the Service or an Incident which is not a Class A or B incident‍
4. Class D – Low Impact
   A general question or concern raised by the Customer concerning the use or implementation of the Service

RESPONSE TIMES

1. The SCW help desk will acknowledge receipt of the incident report within no more than one hour.

RESOLUTION TIME

1. In the event of a Class A incident SCW will immediately assign necessary staff to work on the incident until resolved or a workaround is provided to the Customer.
2. For Class B and C incidents SCW and the Customer will agree an acceptable timeframe within which the incident should be resolved, such agreement to occur within:
   i.  2 working days for a Class B incident; and
   ii. 10 working days for a Class C incident.
3. For Class D incidents within such period of time as SCW deems appropriate given the nature of the question or concern

CLOSURE OF INCIDENTS

1. Before closing an incident, the SCW help desk will seek confirmation of the Customer that the incident has been resolved.

4. SERVICE LEVELS

GENERAL DESCRIPTION OF SERVICE LEVELS

1. Unless otherwise specified, the measurement period for the Service Levels is each Service Period.
2. Where Service Levels are described as “targeted”, such targeted Service Level measurements represent the expected performance levels of the Service under normal operating conditions, but such targeted measurements are for guidance only and do not constitute any obligations or liabilities on the part of SCW and any failure to meet such targeted Service Levels shall not be construed in any way as a breach by SCW of this Agreement.
3. In the event that Service Levels fail to meet the targeted Up Time and/or the targeted System Response Time metrics in any Service Period, SCW’s obligations are limited to providing an analysis and explanation of the reason(s) and proposed reasonable measures to eliminate the undershoot. Such measures may require changes either in the usage of the Services by the Customer, or of the Services by SCW.
4. Where Service Levels are described as ‘contracted’, such contracted Service Level measurements represent the actual performance levels of the Service under normal operating conditions, and a failure to meet such contracted Service Levels will result in Service Credits being calculated.

UPTIME AND PERFORMANCE SERVICE LEVELS

1. The Service Levels apply to the SCW learning platform and shall be measured over the Service Hours except for scheduled maintenance periods.
2. The metrics used to measure performance of the Service are as follows:
   i.   System Response Time
   ii.   Up Time
   ii.   Maintenance Window
3. point of measurement for all Services monitoring with respect to System Response time shall be the servers at the SCW sub-processor data center. Response times exclude the transaction cycle times on communication links from the data center to the Customer’s end user.
4. System Response Time % of Service Period that Response Times will be met
   i.   Targeted 5 seconds 90%
   ii.   Contracted 10 seconds 99%
   iii.  Contracted 15 seconds 99.75%
5. The System Response metric shall be calculated over a Service Period
6. Measurement methods and targets for Service Up Times shall be as follows:
   i.   Service Up Time shall be calculated at the end of each Service Period. The contracted Service level for Service Up Times in any service period shall be 99.75%. The targeted Service Level for Services Up Times in any Services Period shall be 99%.
   ii.  Up Time shall be expressed in percent and is defined as the time period during which the Service is available to the customer
   iii. Up Time is calculated as follows:
   Service Up Time in % = means total number of minutes in the calendar month minus scheduled downtime minus the number of minutes of downtime suffered in a calendar month, divided by the total number of minutes in a calendar month minus scheduled maintenance windows
7. Service Credits shall apply for failure to meet the contracted Service Levels and shall be as follows
   i.    For Uptime Percentage less than 99.75% but equal to or greater than 99.0%, you will be eligible for a 10% Service Credit of the Service fee for the applicable month.
   ii.    For Uptime Percentage less than 99.0%, you will be eligible for a 20% Service Credit.
   iii.   The Service Fee shall be the total service fee paid divided by the number of months of subscription to the service during a Term
   iv.   SCW shall provide the Service Credit to the Customer in the month following the Service Period in which the Service Level Failure occurred

MAINTENANCE WINDOWS

1. The provisions for scheduled maintenance are as follows:
   i.    Frequency: Weekly
   ii.   Duration: Maximum of two (2) hours)
   iii.  Time Monday 11am-1pm Sydney time (AEST/ADST)
2. Unplanned maintenance including corrective actions to be taken by SCW to resolve an incident

SERVICE LEVEL EXCLUSIONS

1. The parties agree that the Service Levels shall not apply if one or more of the following exists:
   i.    Suspension of the Service to carry out planned or routine maintenance
   ii.   Adverse impact on Up Times or Response Times due to the malfunction of Customer owned or controlled firewalls, networks or connectivity.
   iii.  Adverse impact on Up Times or Response Times due to a Force Majeure event(s)

BACK-UPS

1. SCW shall take a backup of all Customer data:
   i.    Incremental Backup: Every Minute, retained for 24 hours
   ii.   Full backup: Every 6 hours, retained for 2 calendar days
   iii.  Full backup: Every day retained for 7 calendar days
   iv.  Full backup: Every week retained for 4 calendar weeks
   v.   Full backup: Every month retained for 13 months
2. Such backup shall be stored at a separate, secure, location to the production environment
3. Backup data shall only be used for resolving an incident reported by the Customer

‍

‍