Master Service Agreement

1 Definitions

In this Agreement, the following terms have the meanings set forth below:

“Agreement” means this Master Service Agreement, together with all Statements of Work, Service Descriptions, and attachments incorporated by reference.

“Business Day” means Monday through Friday, excluding federal holidays observed in the Commonwealth of Virginia.

“Client” means the entity identified in the applicable Statement of Work or invoice accepting these terms.

“Confidential Information” means all non-public information disclosed by either party, whether oral, written, or electronic, that is designated as confidential or that a reasonable person would understand to be confidential.

“Controlled Unclassified Information” (“CUI”) means information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls, as defined in 32 CFR Part 2002.

“Covered Contractor Information System” means an unclassified information system that is owned or operated by or for a contractor and that processes, stores, or transmits covered defense information, as defined in DFARS 252.204-7012.

“Effective Date” means the date this Agreement is executed by both parties, or the date Client first pays an invoice referencing these terms, whichever is earlier.

“Federal Contract Information” (“FCI”) means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government.

“Products” means software licenses, hardware, support and maintenance services, and subscription services provided by Service Provider.

“Service Provider” or “Hyper Vigilance” means Hyper Vigilance, LLC, a Virginia limited liability company.

“Services” means the managed security services, consulting, assessment, implementation, and advisory services described in the applicable Statement of Work or Service Description.

“Shared Responsibility Matrix” (“SRM”) means the document identifying which party is responsible for implementing, maintaining, and providing evidence for each applicable security control.

“Statement of Work” (“SOW”) means a document executed by both parties that describes the specific Services, deliverables, timelines, and fees for a particular engagement.

2 Scope of Services

This Agreement serves as a Master Service Agreement and applies to all purchases of Services and Products from Service Provider by Client.

No Services or Products will be provided under this Agreement alone. Services will be delivered pursuant to Statements of Work, service tier documentation (e.g., GuardNet Watch Tower, Light House, or Enterprise), or other service descriptions that, when executed or accepted by both parties, are incorporated into this Agreement.

Multiple Statements of Work may be incorporated under this Agreement. Should there be any conflict between the terms of any Statement of Work and this Agreement, the terms of the Statement of Work will prevail.

2.1 Service Exclusions

Unless explicitly stated in a Statement of Work, Services do not include:

1. Support for end-of-life hardware or software no longer supported by the manufacturer;
2. Remediation of pre-existing security vulnerabilities not identified during initial assessment;
3. Physical security assessments or installations;
4. Legal advice, regulatory filings, or representation before government agencies; or
5. Third-party vendor management beyond the scope of services described in the applicable SOW.

3 Term & Termination

3.1 Term

This Agreement begins on the Effective Date and continues until all Statements of Work have expired or been terminated, unless earlier terminated as provided herein.

3.2 Termination for Cause

Either party may terminate this Agreement or any Statement of Work upon ninety (90) days’ written notice if the other party:

1. Fails to fulfill in any material respect its obligations under this Agreement or any SOW and does not cure such failure within thirty (30) days of receipt of written notice;
2. Breaches any material term or condition and fails to remedy such breach within thirty (30) days of receipt of written notice; or
3. Terminates or suspends its business operations, becomes insolvent, or files for bankruptcy, unless succeeded by a permitted assignee.

3.3 Termination for Convenience

Either party may terminate this Agreement or any Statement of Work for convenience upon ninety (90) days’ written notice to the other party.

3.4 Transition Assistance

Upon termination, Service Provider will assist Client in the orderly transition of Services, including timely transfer to another designated provider, for a period not to exceed thirty (30) days. Client agrees to pay Service Provider the actual costs of rendering such transition assistance at the then-current hourly rate.

3.5 Effect of Termination

Termination of this Agreement does not release either party from obligations accrued prior to termination. Sections 6 (Confidentiality), 7 (Intellectual Property), 8 (Limitation of Liability), 9 (Indemnification), 11 (Data Protection & CUI Handling), 12 (Incident Response), 15 (Non-Solicitation), and 18 (Governing Law) survive termination.

4 Fees & Payment

4.1 Invoicing

Fees for recurring managed services will be invoiced monthly in advance. Payment is due within fifteen (15) days of invoice date.

4.2 Fixed-Price Services

Fixed-price engagements will be invoiced in two installments: fifty percent (50%) upon Client’s acceptance of a quote or SOW, and fifty percent (50%) upon completion of the described services.

4.3 Hourly Services

Hourly services performed outside of included service blocks will be invoiced at the end of each month. Payment is required within fifteen (15) days of invoice date.

4.4 Late Payment

If payment is not received on or before the invoice due date, interest shall accrue at the rate of one and one-half percent (1.5%) per month from the date due until paid in full.

4.5 Service Suspension

Service Provider reserves the right to suspend Services and recover Products if payment is not received within fifteen (15) days following the due date. Service Provider will provide five (5) business days’ written notice before suspension. Services will be restored within two (2) business days of receipt of all outstanding payments.

4.6 Taxes

Any applicable Federal, State, or Local taxes will be added to each invoice. Client shall pay such taxes unless a valid exemption certificate is provided to Service Provider.

4.7 Rate Adjustments

Service Provider may adjust service rates annually, effective on the anniversary of the Statement of Work, with no less than sixty (60) days’ written notice. Rate adjustments shall not exceed the greater of five percent (5%) or the Consumer Price Index (CPI) increase for the preceding twelve-month period.

5 Service Levels

Service Provider will use commercially reasonable efforts to meet the service levels described in the applicable Statement of Work or Service Description. Standard service level targets include:

5.1 Response Times

1. Critical (P1): Service down or security breach — initial response within one (1) hour, status updates every two (2) hours.
2. High (P2): Significant degradation — initial response within four (4) hours, status updates every four (4) hours.
3. Medium (P3): Minor impact — initial response within one (1) business day.
4. Low (P4): Information request — initial response within two (2) business days.

5.2 Availability

For managed security services, Service Provider targets 99.5% availability of monitoring and alerting infrastructure, measured monthly, excluding scheduled maintenance windows announced at least forty-eight (48) hours in advance.

5.3 Remedies

If Service Provider fails to meet the stated service levels for three (3) consecutive months, Client may request a service credit equal to five percent (5%) of the monthly fee for each month in which the service level was not met, up to a maximum of fifteen percent (15%) of the monthly fee. Service credits are Client’s sole and exclusive remedy for service level failures.

6 Confidentiality

Each party agrees to hold the other party’s Confidential Information in strict confidence and not to disclose it to any third party, except to employees, contractors, or agents who need to know such information to perform obligations under this Agreement and who are bound by confidentiality obligations at least as protective as those herein.

Confidential Information does not include information that: (a) is or becomes publicly available through no fault of the receiving party; (b) was already known to the receiving party prior to disclosure; (c) is independently developed without use of the disclosing party’s Confidential Information; or (d) is disclosed pursuant to a court order or legal requirement, provided the receiving party gives prompt notice to the disclosing party.

Obligations under this section survive for five (5) years after termination of this Agreement, except for trade secrets, which remain confidential for as long as they qualify as trade secrets under applicable law.

7 Intellectual Property

7.1 Pre-Existing IP

Each party retains all rights in its pre-existing intellectual property. Nothing in this Agreement transfers ownership of either party’s pre-existing IP to the other.

7.2 Deliverables

Unless otherwise specified in a Statement of Work, all custom deliverables created specifically for Client under this Agreement are owned by Client upon full payment. Service Provider retains a non-exclusive license to use general knowledge, techniques, and methodologies developed during the engagement.

7.3 Tools and Frameworks

Service Provider’s proprietary tools, scripts, templates, and frameworks (including but not limited to GuardNet monitoring tools, assessment templates, and compliance frameworks) remain the exclusive property of Service Provider. Client receives a limited, non-exclusive, non-transferable license to use such tools solely in connection with Services received under this Agreement.

8 Limitation of Liability

8.1 Cap on Direct Damages

Except as provided in Section 8.3, the aggregate liability of either party for all claims arising out of or related to this Agreement shall not exceed the total fees paid or payable by Client to Service Provider during the twelve (12) months preceding the event giving rise to the claim.

8.2 Exclusion of Indirect Damages

In no event shall either party be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, revenue, data, or business opportunity, regardless of the cause of action or theory of liability, even if advised of the possibility of such damages.

8.3 Carve-Outs

The limitations in Sections 8.1 and 8.2 do not applyto:

1. Liability arising from a party’s gross negligence or willful misconduct;
2. Breach of Section 6 (Confidentiality) or Section 11 (Data Protection & CUI Handling);
3. A party’s indemnification obligations under Section 9; or
4. Liability that cannot be limited under applicable law.

9 Indemnification

9.1 By Service Provider

Service Provider shall indemnify, defend, and hold harmless Client from and against any third-party claims, damages, and expenses (including reasonable attorneys’ fees) arising from: (a) Service Provider’s gross negligence or willful misconduct in performing Services; (b) infringement of any third-party intellectual property rights by Service Provider’s proprietary tools; or (c) Service Provider’s breach of its confidentiality or data protection obligations.

9.2 By Client

Client shall indemnify, defend, and hold harmless Service Provider from and against any third-party claims, damages, and expenses arising from: (a) Client’s failure to implement security controls designated as Client’s responsibility in the Shared Responsibility Matrix; (b) Client’s misuse of Services or Products; or (c) Client’s breach of applicable laws or regulations.

9.3 Procedure

The indemnified party shall provide prompt written notice of any claim and grant the indemnifying party sole control of the defense and settlement. The indemnified party shall cooperate at the indemnifying party’s expense. The indemnifying party shall not settle any claim that imposes obligations on the indemnified party without prior written consent.

10 Insurance

Service Provider maintains the following insurance coverage:

1. Commercial General Liability with limits of not less than $1,000,000 per occurrence;
2. Professional Liability (Errors & Omissions) with limits of not less than $2,000,000 per claim; and
3. Cyber Liability with limits of not less than $2,000,000 per claim.

Service Provider will provide a certificate of insurance upon Client’s written request.

11 Data Protection & CUI Handling

11.1 Scope of CUI Handling

Service Provider may access, process, monitor, or store Client data in the course of delivering Services. Where such data includes CUI or FCI, both parties acknowledge their respective obligations under NIST SP 800-171, DFARS 252.204-7012, and the Cybersecurity Maturity Model Certification (CMMC) framework.

11.2 Service Provider Obligations

Where Service Provider’s systems process, store, or transmit CUI on behalf of Client, Service Provider shall:

1. Implement and maintain security controls consistent with NIST SP 800-171 Rev. 2 (or successor) for all systems in scope;
2. Maintain a System Security Plan (SSP) documenting the implementation of applicable controls;
3. Notify Client within seventy-two (72) hours of discovering a cyber incident affecting CUI, consistent with DFARS 252.204-7012;
4. Cooperate with Client and applicable government entities in the investigation and remediation of security incidents;
5. Not transfer CUI to subprocessors without Client’s prior written consent; and
6. Return or securely destroy all CUI within thirty (30) days of termination, at Client’s direction.

11.3 Client Obligations

Client shall:

1. Clearly identify and mark CUI provided to or accessible by Service Provider;
2. Provide accurate scoping information regarding the types of CUI and applicable safeguarding requirements;
3. Maintain its own System Security Plan and Plan of Action & Milestones (POA&M); and
4. Implement security controls designated as Client’s responsibility in the Shared Responsibility Matrix.

11.4 Data Processing

Service Provider will process Client data only as necessary to provide the Services and in accordance with Client’s documented instructions. Service Provider will not sell, share, or use Client data for any purpose other than performing its obligations under this Agreement.

12 Incident Response & Breach Notification

12.1 Detection and Response

Service Provider maintains a documented incident response plan and will respond to security incidents affecting Client data or systems under Service Provider’s management in accordance with the procedures described in the Shared Responsibility Matrix and applicable System Control Implementation documentation. Service Provider will use commercially reasonable efforts to:

1. Acknowledge confirmed security incidents promptly upon detection;
2. Activate appropriate response personnel and begin investigation;
3. Notify Client of the incident, including known scope, affected systems, and initial remediation steps, within a timeframe appropriate to the severity of the incident; and
4. Deliver a written incident report within a reasonable period following incident resolution.

Specific incident notification timelines and escalation procedures are documented in the SRM and may be further defined in the applicable Statement of Work. In the event of a conflict between timelines stated in a SOW and this section, the SOW shall prevail.

12.2 DFARS Compliance

For incidents involving CUI, Service Provider will report the cyber incident to the DoD Cyber Crime Center (DC3) within seventy-two (72) hours of discovery, in accordance with DFARS 252.204-7012, and will provide Client with the incident report number as soon as practicable.

12.3 Cooperation

Both parties agree to cooperate fully in the investigation, remediation, and reporting of security incidents, including preserving evidence, providing access to relevant logs and systems, and participating in post-incident reviews.

13 Shared Responsibility

For clients subject to CMMC or NIST 800-171 requirements, the parties will maintain a Shared Responsibility Matrix documenting which party is responsible for implementing, maintaining, and providing evidence for each applicable security control.

13.1 Matrix Development

Service Provider will prepare an initial Shared Responsibility Matrix based on the Client’s service tier and assessment scope. Client and Service Provider will review and agree upon the matrix within thirty (30) days of SOW execution.

13.2 Updates

The Shared Responsibility Matrix will be reviewed and updated: (a) annually; (b) upon material changes to the service scope; (c) upon changes to applicable regulatory requirements; or (d) upon request by either party.

13.3 Assessment Support

Service Provider will support Client during CMMC assessments by providing documentation, evidence, and access to systems for controls designated as Service Provider’s responsibility in the SRM. Service Provider will make relevant personnel available for assessor interviews within five (5) business days of request.

14 Compliance & Audit Rights

Client (or Client’s designated assessor) may audit Service Provider’s compliance with this Agreement, applicable security controls, and data protection obligations upon thirty (30) days’ written notice, no more than once per calendar year unless triggered by a security incident.

Audits shall be conducted during normal business hours and shall not unreasonably interfere with Service Provider’s operations. Service Provider will provide reasonable access to relevant systems, logs, documentation, and personnel.

If an audit reveals material non-compliance, Service Provider shall prepare a remediation plan within fifteen (15) business days and implement corrective actions within a mutually agreed timeframe.

15 Non-Solicitation

During the term of this Agreement and for a period of twelve (12) months following termination, neither party shall directly or indirectly solicit for employment any employee or contractor of the other party who was directly involved in the performance of Services under this Agreement.

This restriction does not apply to general advertising or solicitation not specifically directed at the other party’s personnel, nor to any individual who initiates contact with the hiring party without solicitation.

16 Assignment

Service Provider may assign its rights and obligations under this Agreement to any entity that succeeds to all or substantially all of Service Provider’s business or assets. Client may not assign its rights or obligations without Service Provider’s prior written consent, which shall not be unreasonably withheld. A change of control of Client — including merger, acquisition, or sale of substantially all assets — shall be deemed an assignment requiring Service Provider’s consent.

17 Force Majeure

Neither party shall be liable for failure or delay in performing its obligations (other than payment obligations) due to circumstances beyond its reasonable control, including but not limited to acts of God, natural disasters, pandemics, government actions, cyber attacks by nation-state actors, or failures of third-party infrastructure providers.

The affected party shall provide prompt written notice and use commercially reasonable efforts to mitigate the impact. If a force majeure event continues for more than sixty (60) days, either party may terminate the affected Statement of Work without penalty.

18 Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the Commonwealth of Virginia, without regard to its conflict of laws principles. The parties consent to the exclusive jurisdiction of the state and federal courts located in Virginia for the resolution of any disputes arising under this Agreement.

19 Dispute Resolution

The parties agree to attempt to resolve any dispute arising out of this Agreement through good-faith negotiation. If the dispute is not resolved within thirty (30) days, either party may initiate mediation administered by a mutually agreed mediator. If mediation does not resolve the dispute within sixty (60) days, either party may pursue remedies available at law or in equity in accordance with Section 18.

20 Entire Agreement

This Master Service Agreement, together with all Statements of Work, Service Descriptions, the Shared Responsibility Matrix, and any other documents incorporated by reference, constitutes the entire agreement between the parties and supersedes all prior agreements, negotiations, representations, or understandings, whether oral or written.

This Agreement may only be amended in writing signed by authorized representatives of both parties, or by Service Provider publishing an updated version of these terms at hypervigilance.com/terms with no less than thirty (30) days’ notice to Client. If Client objects to the updated terms in writing within the thirty (30) day notice period, the prior version shall continue to apply to Client’s active Statements of Work until their natural expiration.

21 Acceptance

This Agreement may be accepted by:

1. Signature: Execution by authorized representatives of both parties;
2. Invoice Payment: Client’s payment of any invoice that references this Agreement or the URL hypervigilance.com/terms; or
3. Continued Use: Client’s continued use of Services after receiving notice of these terms.

In the event of acceptance by invoice payment or continued use, the Effective Date shall be the date of the first such payment or the date of notice, whichever is earlier.