Overview
Capitalized terms not defined in this Attachment will have the meanings set forth in the MSA.
Scope of Work
PatientLock intends to use SilverSky (“Host”) installed products and services to provide a Security Operations Center-as-a-Service (“Service”) designed to replace all of the necessary capital costs, licensed products and integration services normally required to establish a security program. The Host uses a secure and compliant cloud for ease of deployment and consumption by the healthcare industry as well as others making the Service available at predictable and affordable rates. Under this Statement of Work for SilverSky’s Managed Detection and Response (“MDR”), PatientLock agrees to provide _________________________ (“Customer”) with certain described services. It is understood by the Customer that PatientLock intends to retain the Service, in whole or in part, by SilverSky in connection with the Service under this Statement of Work. The Service focuses Cyber Threat Detection on network devices not covered by Managed Endpoint Detection and Response.
1. Managed Detection and Response Service Description
PatientLock will provide the Customer with the following MDR Services:
SilverSky platform to ingest data/events from an agreed upon set of data sources including on-prem devices, endpoints, webapps, authentication gateways and cloud infrastructure. All ingested events are automatically enriched with threat intelligence data, matched against a variety of Indicators of Compromise and intelligently cross-correlated to detect anomalies across Customer’s infrastructure.
24/7/365 coverage over all actionable incidents routed to PatientLock’s monitoring and detection platform; such incidents are reviewed by an Analyst on a 24/7/365 basis. Customer gets full visibility in to notified and non-notified incidents.
Investigation mapping within the SilverSky platform utilizing the MITRE Attack framework.
Customer will have a dedicated account manager and cybersecurity advisor. In addition, Customer will access to PatientLock’ global security operations team for incident investigations, threat hunting, and real-time support. Note: The dedicated cybersecurity advisor only applies if recurring monthly fee associated with the contract herein is $500 or greater.
Customized Playbooks: to provide notifications to identified client contacts via agreed-upon, specified communication formats. PatientLock will provide containment and guided remediation, including the ability to potentially contain attacks at the endpoint utilizing the PatientLock deployed agent.
Reporting: a set of customizable reports and report templates including, but not limited to, Executive summaries and threat and compliance reports.
Platform transparency by providing Customer access directly into the SilverSky platform.
Unlimited Data Ingestion1: unlimited data ingestion from agreed upon data types and sources from standard feeds. Data is retained for one year (30 days hot storage and 1 year in cold storage).
Support for Microsoft Office365 telemetry; additional fees may apply for this data source.
2. Responsibilities
PatientLock Responsibilities
Conduct a knowledge-sharing survey to collect information about the Customer's environment, including ingestion data types and sources to be monitored and processes needed to support the implementation of services.
Establish a secure method of transmitting logs from the Customer network to the SilverSky platform.
Provide assistance to the Customer to configure data sources chosen for ingestion.
Notify the Customer of receipt of logs and confirm proper operational integration to ensure alerting.
Provide initial training and training materials for the SilverSky platform/portal.
Customer Responsibilities During performance of the Services Customer will:
Prior to engagement commencement, assign a project management contact to serve as a primary contact through the delivery and performance of the MDR Services.
Ensure complete and current contact information is provided on a timely basis.
Cooperate during the deployment period, including providing to PatientLock all required information in a complete and accurate form to prevent implementation delays which may result in additional fees.
Appoint one or more authorized contacts authorized to approve and validate all requested changes.
Implement change requests.
Provide all necessary information with respect to Customer’s environment.
Provide necessary hardware along with maintenance and support contracts to run log collectors within Customer’s environment.
Send log data in an encrypted manner, or via the agreed log collection device/type.
Ensure the format and quality of the data being sent to PatientLock is sufficient for PatientLock to provide the MDR Services.
Retain authority and responsibility for decisions made regarding this service implementation.
Assume responsibility for any direct or physical remediation.
Customer acknowledges that Customer’s fulfillment of these responsibilities is essential to PatientLock’s ability to perform the MDR Services in a timely manner.
3. Deliverables
Capture device logs from the Customer’s monitored devices.
Perform analysis of the log data. This includes, but is not limited to, aggregation, parsing, correlation, and alerting.
In cases of significant risk, PatientLock security engineers will analyze incidents following an alert by the risk notification system.
Security Engineers will notify the Customer of incidents requiring a response. Instructions on threat remediation and consultation will be provided.
24/7/365 phone-based incident support for additional investigation and guidance for the Customer.
Security alerts will be sent to the Customer within 10-minutes of alert creation.
4. Assumptions
Customer will provide PatientLock with reasonably requested information upon which PatientLock can rely to be current, accurate, and complete.
Customer will provide access to Customer’s personnel who have detailed knowledge of Customer’s security architecture, network architecture, computing environment, and related matters.
Customer will provide access to Customer’s personnel who have an understanding of Customer’s security policies, regulations and requirements.
Customer will evaluate PatientLock deliverables and immediately notify PatientLock of any perceived problems or issues with PatientLock obligations.
PatientLock will immediately notify Customer of any perceived problems or issues regarding Customer’s obligations.
Customer is responsible for any additional costs if PatientLock is unable to perform the Service due to Customer’s delay or other failure to fulfill its obligations under this Statement of Work.
Service Level Agreement For Managed Detection And Response
The following terms and conditions apply to the service levels of the Managed Detection and Response Services provided pursuant to this Attachment.
In the event PatientLock fails to meet the levels defined in this Service Level Agreement for a minimum of two (2) consecutive months, Customer must notify PatientLock in writing of any violations and allow PatientLock thirty (30) days from notification to cure. If still unresolved, Customer may immediately terminate the Service giving rise to such breach without additional notification or incurring early termination fees within thirty (30) days of PatientLock’s failure to cure.
1. Service Hours of Operation
PatientLock maintains Security Operations, Network Operations, and Technical Support departments on a 24 x 7 x 365 basis. Customer may reach an individual in each of these departments by calling the appropriate support service.
2. Response Time
PatientLock commits to certain incident response times. These commitments are subject to Customer providing PatientLock accurate and current contact information for Customer’s designated points of contact. PatientLock’s failure to respond in accordance with the parameters defined herein will entitle Customer to receive, as Customer’s sole remedy and PatientLock’s sole obligation, credits described below, provided however, that Customer may obtain no more than one credit per day, regardless of how often in that day PatientLock failed to meet these parameters.
Definitions of Incident Severity:
Critical – This category of incident may have a severe impact to Customer’s network or system and indicates a compromise. Examples of incidents that fall under this category: malware infection, backdoor or Trojan traffic, outbound DDoS, and bot net traffic.
High – This category of incident may have a high impact on Customer’s network or system and could lead to malware infection, data leakage, and disruption of operations due to network or system down time. Examples of incidents that fall under this category: download of malicious software, leakage of file from internal network, DoS or DDoS, P2P traffic (torrent), cloud storage traffic, and exploit launching.
Medium – This category of incident has a medium level of impact on Customer’s network or system and could lead to unnecessary leakage of information or exposure of vulnerabilities. Examples of incidents that fall under this category: port scans, vulnerability scans, social media traffic, unusual network traffic, and multiple failed logins.
Low – This category of incident shows little impact on the Customer. This is mostly informational alerts to inform the Customer. Examples of incidents that fall under this category: login or logout notifications, failed login notifications, application or system update notification, and application or system error message.
Informational – This category of incident shows no impact to the Customer. This is only informational alerts to track activity. Examples of incidents that fall under this category: false positives, approved scanning vendors, and test alerts.
The severity level of each incident is determined by PatientLock based on the nature of the incident identified. Customer may indicate to PatientLock that an identified incident is of a lower priority if Customer is not vulnerable to such attack.
Incident Severity Response Times
Critical/High Alerts - Response within 10 minutes upon identification of incident and a Tier 1 credit if missed; Tier 1 credit is defined in Section 5 below.
Medium/Low Alerts - Response within 24 hours upon identification of incident and a Tier 2 credit if missed; Tier 2 credit is defined in Section 5 below.
3. Service Availability Guarantee
PatientLock’s commitment is to have the Managed Detection and Response Services, including the SilverSky platform and its interface, available 99.5% of the time and as set forth below. At Customer’s request, PatientLock will calculate the number of minutes the Service(s) was not available to Customer in a calendar month (“Service Unavailability"). Failure to meet the service level described in this Section will entitle Customer to receive a Tier 1 credit.
4. Maintenance
PatientLock reserves the following weekly maintenance windows during which Customer may experience periodic service outages:
Tuesday and Thursday (12 AM – 2 AM ET).
Saturday (12 AM – 5 AM ET). In the event PatientLock must perform maintenance during a time other than the service windows provided above, PatientLock will provide notification prior to performing the maintenance.
5. Credit Request and Payment Procedures
If PatientLock fails to meet service levels herein in a calendar month, Customer will be entitled to receive a credit as specified below:
Tier 1. Equal to twice the prorated portion of the monthly fee for the affected service, or
Tier 2. Equal to the prorated portion of the monthly fee for the affected service; provided however that a breach of this SLA due to Exceptions described below will not qualify for such credits. To receive a credit under this SLA, Customer must be current with Customer’s payments at the time Service Unavailability occurred. In addition, all credit requests must be submitted in writing, either through PatientLock’s ticketing system, via email or fax, or by certified U.S. mail. Customer must submit each request for credit within seven (7) days of the occurrence giving rise to the credit claim. The total credit amount PatientLock will pay to Customer in any calendar month will not exceed, in the aggregate, half of the total fees invoiced to Customer for the Managed Detection and Response Services for which a claim is made in the applicable month. (Credits are exclusive of any applicable taxes charged to Customer or collected by PatientLock.)
6. Exceptions
Customer will not receive any credits under this SLA in connection with any failure or deficiency of the Managed Detection and Response Services or a failure to meet service level caused by or associated with any of the following:
Maintenance, as defined above.
Fiber cuts or other such issues related to telephone Customer circuits or local ISP outside of PatientLock’s control.
Customer’s applications, equipment, or facilities.
Customer or any of Customer’s end-user’s acts or omissions.
Reasons of Force Majeure as defined in the Terms and Conditions associated with this MSA.
Any act or omission on the part of any third party, not reasonably within PatientLock’s control.
First month of service for the specific Managed Detection and Response Services for which a credit is claimed.
DNS issues outside PatientLock’s direct control.
Broadband connectivity.
7. Performance Evaluation
Customer authorizes PatientLock to evaluate service upgrades and changes on an annual basis at each of Customer’s locations which utilize the Services. In the event that such evaluations identify ways to improve performance or service at no additional cost to Customer, Customer authorizes PatientLock to implement them.
8. Fair Usage Threshold for Data Ingestion2
PatientLock maintains a fair usage policy to ensure the availability and sustainability of the Service. Failure to adhere to the fair usage policy will result first in a notification to Customer and then, if Customer fails to take remedial action, suspension of this SLA until such time as the usage level associated with the corresponding data sources falls below a reasonable, standard threshold.
9. Equipment
When applicable, equipment provided to Customer by PatientLock (“PatientLock Equipment”) is for Customer’s use only during the Term of this Attachment. PatientLock will service the PatientLock Equipment in accordance with PatientLock’s service policies. Customer agrees to (i) use PatientLock Equipment only for the purpose of receiving Managed Detection and Response Services; (ii) prevent any connections to PatientLock Equipment not expressly authorized by PatientLock; (iii) prevent tampering, alteration, or repair of PatientLock Equipment by any persons other than PatientLock or PatientLock’s authorized personnel; and (iv) assume complete responsibility for improper use, damage to or loss of such PatientLock Equipment regardless of cause. Customer will pay PatientLock for any damaged or unrecoverable PatientLock Equipment. Customer authorizes PatientLock and PatientLock’s authorized agents, contractors, representatives and vendors to enter Customer’s premises, with reasonable notice, during normal business hours (or as otherwise authorized by Customer), to install, maintain, repair and/or remove any PatientLock Equipment and/or to perform the Managed Detection and Response Services. Customer must return PatientLock Equipment, at Customer’s expense, within 14 days after this Attachment terminates or expires. PatientLock Equipment must be returned in the same condition in which it was provided to Customer, except for normal wear and tear. If Customer fails to do so, billing for Managed Detection and Response Services will resume and continue until all PatientLock Equipment is returned. Equipment for Managed Detection and Response Services delivered through PatientLock is maintained in a lockdown configuration that does not allow Customer administrative access.
10. Term and Termination
This Attachment will be in effect during the Initial Term set forth in the Service Order and will thereafter automatically renew for a period equal to the Initial Term as provided in the Service Order. The fee schedule listed in the Service Order will be subject to annual pricing adjustments. However, such pricing adjustments may not exceed 5%, on an annualized basis, during the Initial Term. Intention not to renew must be provided at least 60 days prior to the beginning of the renewal term. The sections related to Payment Terms, Limitation of Liability, Warranties, Indemnity, Confidentiality and Intellectual Property from the General Terms and Conditions, as provided in the referenced General Terms and Conditions document, will survive the expiration or termination of this Attachment for any reason. Within 10 days after the expiration or termination of this Attachment for any reason, Customer must pay all undisputed fees accrued and unpaid at the time of termination, and the cancellation fee if applicable.
11. Additional Disclaimers
PatientLock does not guarantee a continuous, uninterrupted, virus-free, malware-free, intrusion-free, or continuously secure Customer network or network environment, and PatientLock is not liable if Customer or Customer’s end users are unable to access Customer’s network at any specific time. Additionally, PatientLock does not guarantee that PatientLock will be able to replace any of Customer’s information, content, or other data that may be lost, damaged, or stolen resulting from use of the Managed Detection and Response Services.
Notes
1 Unlimited data ingestion applies to the following agreed upon, standard data sources: Network Data (incl. from public cloud sources such AWS, Azure, Google Cloud, and other similar hyperscale cloud services), Firewall, DNS, Active Directory, Switches, Routers, Access Points, Domain Controllers, Vulnerability Management Solutions, and Endpoint Security Tools.
2 FUT to be calculated based upon the agreed upon data sources to be ingested and listed as per Footnote 1 above.
Arrange signatures
Contact PatientLock to prepare the agreements for your organization or discuss requested changes.
Request a signing copy