Overview
Capitalized terms not defined in this Attachment will have the meanings set forth in the MSA.
Scope of Work
PatientLock intends to use SilverSky (“Host”) installed products and services to provide a Security Operations Center-as-a-Service designed to replace all of the necessary capital costs, licensed products and integration services normally required to establish a security program. The Host uses a secure and compliant cloud for ease of deployment and consumption by the healthcare industry, as well as others making the Service available at predictable and affordable rates. Under this Statement of Work for SilverSky’s Managed Detection and Response with SentinelOne Endpoint Solution-MEPP (“MDR+MEPP”), PatientLock agrees to provide ___________________________, (“Customer”) with certain described services. It is understood by Customer that PatientLock intends to retain the Service, in whole or in part, by, or through, Host. The Service focuses Cyber Threat Detection on network devices not covered by Managed Endpoint Detection and Response (with SentinelOne Endpoint Solution-MEPP).
“Services” will mean PatientLock Managed Detection and Response (MDR+MEPP) Services with SentinelOne Endpoint Solution (MEPP), including SilverSky platform.
PatientLock Services
PatientLock will provide Customer with the following Services:
Services
SilverSky platform to ingest data/events from a wide variety of agreed upon data sources including on-prem devices, endpoints, web apps, authentication gateways and cloud infrastructure. All ingested events are automatically enriched with threat intelligence data, matched against a variety of Indicators of Compromise and intelligently cross-correlated to detect anomalies across Customer’s infrastructure.
24/7/365 coverage over all actionable incidents routed to PatientLock’s monitoring and detection platform; such incidents are reviewed by an Analyst on a 24/7/365 basis. Customer gets full visibility into notified and non-notified incidents.
Investigation mapping within the SilverSky platform utilizing the MITRE Attack framework.
Customized Playbooks: to provide notifications to identified Customer contacts via agreed-upon, specified communication formats. PatientLock will provide containment and guided remediation, including the ability to potentially contain attacks at the endpoint utilizing the PatientLock deployed agent.
Reporting: a set of customizable reports and report templates including, but not limited to, Executive summaries and threat and compliance reports.
Platform transparency by providing Customer access directly into the SilverSky platform.
Unlimited Data Ingestion1: unlimited data ingestion from agreed upon data types and sources from standard feeds. Data is retained for one year (30 days hot storage and 1 year in cold storage).
Support for Microsoft Office365 telemetry; additional fees may apply for this data source. MDR+MEPP/MEPP – Additionally, as part of the Services, PatientLock is reselling the SentinelOne end point solution, and as such will ingest data from SentinelOne as deployed on Customer’s endpoints within this MDR+MEPP service. PatientLock represents and warrants that PatientLock has obtained all required authorizations and consents to resell the MEPP to Customer as part of this MSA and agrees to defend, indemnify, and hold harmless Customer against any actual or alleged claims, damages, or losses arising from PatientLock’s resale of the MEPP to Customer including, without limitation, any claims of infringement or unauthorized use. PatientLock further represents and warrants that the MEPP is not an early adoption or beta version of the Solution as defined in SentinelOne’s Master Subscription Agreement. As the ultimate end customer of SentinelOne, Customer must adhere to any and all SentinelOne end-user related provisions (whether set out in SentinelOne’s Master Subscription Agreement or any other SentinelOne document or agreement related to the SentinelOne Services (posted on SentinelOne’s website, and as may be updated from time-to-time by SentinelOne)), along with any additional terms provided in this Attachment or the MSA.
Customer understands and acknowledges that PatientLock is providing endpoint security utilizing SentinelOne endpoint protection solutions. The SentinelOne solutions are procured by PatientLock via a Managed Security Service Provider (“MSSP”) license and delivered to Customer as a service. As such, all licensing for these Services are controlled by the MSSP licensing agreement between PatientLock and SentinelOne.
MDR+MEPP (with SentinelOne EndPoint Solution-MEPP) Service Implementation
PatientLock Responsibilities
Conduct a knowledge-sharing survey to collect information about Customer's environment, including ingestion data types and sources to be monitored and processes needed to support the implementation of Services.
Establish a secure method of transmitting logs from Customer’s network to the SilverSky platform.
Provide assistance to Customer to configure data sources chosen for ingestion.
Notify Customer of receipt of logs and confirm proper operational integration to ensure alerting.
Provide initial training and training materials for the SilverSky platform/portal.
PatientLock Service Deliverables
Capture device logs from Customer’s monitored devices.
Perform analysis of the log data. This includes, but is not limited to, aggregation, parsing, correlation and alerting.
In cases of significant risk, PatientLock security engineers will analyze incidents following an alert by the risk notification system.
Security Engineers will notify Customer of incidents requiring a response. Instructions on threat remediation and consultation will be provided.
24/7/365 phone-based incident support for additional investigation and guidance for Customer.
Security alerts will be sent to Customer within 10-minutes of alert creation.
Customer Responsibilities
As related to the Services, Customer will:
Prior to engagement commencement, assign a project management contact to serve as a primary contact through the delivery and performance of the MDR+MEPP (with SentinelOne Endpoint Solution-MEPP) Services.
Ensure complete and current contact information is provided on a timely basis.
Cooperate during the deployment period, including providing PatientLock all required information in a complete and accurate form to prevent implementation delays (which may result in additional fees).
Appoint one or more authorized contacts authorized to approve and validate all requested changes.
Implement change requests.
Provide all necessary information with respect to Customer’s environment.
Provide necessary hardware along with maintenance and support contracts to run log collectors within Customer’s environment.
Send log data in an encrypted manner, or via the agreed log collection device/type.
Ensure the format and quality of the data being sent to PatientLock is sufficient for PatientLock to provide the Services.
Retain authority and responsibility for decisions made regarding this service implementation.
Assume responsibility for any direct or physical remediation.
Comply with all SentinelOne end-user provisions (whether set forth in SentinelOne’s Master Subscription Agreement or any other SentinelOne document or agreement applicable to the SentinelOne Services, each as set forth on SentinelOne’s website), and as such provisions may be updated by SentinelOne from time-to-time.
Customer acknowledges that Customer’s fulfillment of these responsibilities is essential to PatientLock’s ability to perform the MDR+MEPP (with SentinelOne EndPoint Solution-MEPP) Services in a timely manner.
Service Level Agreement for Managed Detection and Response
In the event PatientLock fails to meet the levels defined in this MDR+MEPP/MEPP Service Level Agreement for a minimum of two (2) consecutive months, Customer must notify PatientLock in writing of any violations and allow PatientLock thirty (30) days from notification to cure the breach. If still unresolved, Customer may immediately terminate the MDR+MEPP/MEPP Service giving rise to such breach without additional notification or incurring early termination fees within thirty (30) days of PatientLock’s failure to cure.
1. Service Hours of Operation
PatientLock maintains Security Operations, Network Operations, and Technical Support departments on a 24 x 7 x 365 basis. Customer may reach an individual in each of these departments by calling the appropriate support service.
2. Response Time
PatientLock commits to certain incident response times. These commitments are subject to Customer providing PatientLock accurate and current contact information for Customer’s designated points of contact. PatientLock’s failure to respond in accordance with the parameters defined herein will entitle Customer to receive, as Customer’s sole and exclusive remedy and PatientLock’s sole and exclusive obligation, credits described below, provided however, that Customer may obtain no more than one credit per day, regardless of how often in that day PatientLock failed to meet these parameters.
2.1 Definitions of Incident Severity
Critical – This category of incident may have a severe impact to Customer’s network or system and indicates a compromise. Examples of incidents that fall under this category: malware infection, backdoor or Trojan traffic, outbound DDoS, and bot net traffic.
High – This category of incident may have a high impact on Customer’s network or system and could lead to malware infection, data leakage, and disruption of operations due to network or system down time. Examples of incidents that fall under this category: download of malicious software, leakage of file from internal network, DoS or DDoS, P2P traffic (torrent), cloud storage traffic, and exploit launching.
Medium – This category of incident has a medium level of impact on Customer’s network or system and could lead to unnecessary leakage of information or exposure of vulnerabilities. Examples of incidents that fall under this category: port scans, vulnerability scans, social media traffic, unusual network traffic, and multiple failed logins.
Low – This category of incident shows little impact on the Customer. This is mostly informational alerts to inform the Customer. Examples of incidents that fall under this category: login or logout notifications, failed login notifications, application or system update notification, and application or system error message.
Informational – This category of incident shows no impact to Customer. This is only informational alerts to track activity. Examples of incidents that fall under this category: false positives, approved scanning vendors, and test alerts.
The severity level of each incident is determined by PatientLock (in its sole discretion) based on the nature of the incident identified. Customer may indicate to PatientLock that an identified incident is of a lower priority if Customer is not vulnerable to such attack.
2.2 Incident Severity Response Times
Critical/High Alerts - Response within 10 minutes upon identification of incident and a Tier 1 credit if missed; Tier 1 credit is defined in Section 5 below.
Medium/Low Alerts - Response within 24 hours upon identification of incident and a Tier 2 credit if missed; Tier 2 credit is defined in Section 5 below.
3. Service Availability Guarantee
PatientLock’s commitment is to have the MDR+MEPP Services, including the SilverSky platform and its interface, available 99.5% of the time and as set forth below. At Customer’s request, PatientLock will calculate the number of minutes the Service(s) was not available to Customer in a calendar month (“Service Unavailability"). Failure to meet the service level described in this Section will entitle Customer to receive a Tier 1 credit.
4. Maintenance
PatientLock reserves the following weekly maintenance windows during which Customer may experience periodic service outages:
Tuesday and Thursday (12 AM – 2 AM ET).
Saturday (12 AM – 5 AM ET). In the event PatientLock must perform maintenance during a time other than the service windows provided above, PatientLock will use commercially reasonable efforts to provide notification prior to performing the maintenance.
5. Credit Request and Payment Procedures
For failures to meet service levels herein in a calendar month, Customer will be entitled to receive a credit as specified below:
Tier 1. Equal to twice the prorated portion of the monthly fee for the affected service, or
Tier 2. Equal to the prorated portion of the monthly fee for the affected service; provided however that a breach of this SLA due to Exceptions described below will not qualify for such credits. To receive a credit under this SLA, Customer must be current with its payment obligations at the time Service Unavailability occurred. In addition, all credit requests must be submitted in writing, either through PatientLock’s ticketing system, via email or fax, or by certified U.S. mail, postage prepaid. Customer must submit each request for credit within seven (7) days of the occurrence giving rise to the credit claim. The total credit amount PatientLock will pay to Customer in any calendar month will not exceed, in the aggregate, half of the total fees invoiced to Customer for the Services for which a claim is made in the applicable month. (Credits are exclusive of any applicable taxes charged to Customer or collected by PatientLock.)
6. Exceptions
Customer will not receive any credits under this SLA in connection with any failure or deficiency of the MDR+MEPP Services or a failure to meet service level caused by or associated with any of the following:
Maintenance, as defined above.
Fiber cuts or other such issues related to telephone company circuits or local ISP outside of PatientLock’s control.
Customer’s applications, equipment, or facilities.
Customer or any of Customer’s end-user’s acts or omissions.
Reasons for Force Majeure as defined in the Terms and Conditions associated with this MSA.
Any act or omission on the part of any third party, not reasonably within PatientLock’s control.
First month of service for the specific Services for which a credit is claimed.
DNS issues outside PatientLock’s direct control.
Broadband connectivity.
7. Fair Usage Threshold for Data Ingestion2
PatientLock maintains a fair usage policy to ensure the availability and sustainability of the Service. Failure to adhere to the fair usage policy will result first in a notification to Customer and then, if Customer fails to take remedial action, suspension of this SLA until such time as the usage level associated with the corresponding data sources falls below a reasonable, standard threshold.
8. Equipment
When applicable, equipment provided to Customer by PatientLock (“PatientLock Equipment”) is for Customer’s use only during the Term of this Attachment. PatientLock will service the PatientLock Equipment in accordance with PatientLock’s service policies. Customer agrees to: (i) use PatientLock Equipment only for the purpose of receiving Services; (ii) prevent any connections to PatientLock Equipment not expressly authorized by PatientLock; (iii) prevent tampering, alteration or repair of PatientLock Equipment by any persons other than PatientLock or PatientLock’s authorized personnel; and (iv) assume complete responsibility for improper use, damage to or loss of such PatientLock Equipment regardless of cause. Customer will pay PatientLock for any damaged or unrecoverable PatientLock Equipment. Customer authorizes PatientLock and PatientLock’s authorized agents, contractors, representatives and vendors to enter Customer’s premises, with reasonable notice, during normal business hours (or as otherwise authorized by Customer), to install, maintain, repair and/or remove any PatientLock Equipment and/or to perform the Services. Customer must return PatientLock Equipment, at Customer’s expense, within 14 days after this Attachment terminates or expires. PatientLock Equipment must be returned in the same condition in which it was provided to Customer, except for normal wear and tear. If Customer fail to do so, billing for Services will resume and continue until all PatientLock Equipment is returned. Equipment for Services delivered through PatientLock is maintained in a lockdown configuration that does not allow Customer administrative access.
9. Additional Disclaimers
PatientLock does not guarantee a continuous, uninterrupted, virus-free, malware-free, intrusion-free, or continuously secure Customer network or network environment, and PatientLock is not liable if Customer or Customer’s end users are unable to access Customer’s network at any specific time. Additionally, PatientLock does not guarantee that PatientLock will be able to replace any of Customer’s information, content, or other data that may be lost, damaged, or stolen resulting from use of the Services.
Notes
1 Unlimited data ingestion applies to the following agreed upon, standard data sources: Network Data (incl. from public cloud sources such AWS, Azure, Google Cloud, and other similar hyperscale cloud services), Firewall, DNS, Active Directory, Switches, Routers, Access Points, Domain Controllers, Vulnerability Management Solutions, and Endpoint Security Tools.
2 FUT to be calculated based upon the agreed upon data sources to be ingested and listed as per Footnote 1 above.
Arrange signatures
Contact PatientLock to prepare the agreements for your organization or discuss requested changes.
Request a signing copy