Overview
Capitalized terms not defined in this Statement of Work will have the meanings set forth in the MSA.
Scope of Work
PatientLock intends to use SilverSky (“Host”) installed products and services to provide a Security Operations Center-as-a-Service (“Service”) designed to replace all of the necessary capital costs, licensed products and integration services normally required to establish a security program. The Host uses a secure and compliant cloud for ease of deployment and consumption by the healthcare industry as well as others making the Service available at predictable and affordable rates. Under this Statement of Work (“SOW”) for PatientLock’s Network Protection Services (“Network Protection Services”), PatientLock agrees to provide ____________________, (“Customer”) with certain described services. It is understood by the Customer that PatientLock intends to retain the Service, in whole or in part, by SilverSky in connection with the Service under this SOW.
1. Service definition
“Network Protection Services” will mean PatientLock services including principal network security controls in a single-bundled package. This package includes Managed Firewall, Intrusion Detection Prevention Services (IDPS), Web Content Filtering, Gateway AV, remote access that may include two-factor SSL VPN, site-to-site VPNs, and SDWAN (Fortinet). PatientLock provides full management, monitoring, and response for the services, access to configurable reports through the portal, and Lifecycle and Patch Management.
Service SKUs
S-500-3037 SilverSky Network Protection up to 250MB thruput with FortiGate 6X Series
S-501-3037 SilverSky Network Protection up to 500MB thruput with FortiGate 8X Series
S-502-3037 SilverSky Network Protection up to 1GB to thruput with FortiGate 10X Series
S-503-3037 SilverSky Network Protection up to 3GB thruput with FortiGate 20X Series
S-500-3054 SilverSky Network Protection up to 250MB thruput - no hardware included
S-501-3054 SilverSky Network Protection up to 500MB thruput - no hardware included
S-502-3054 SilverSky Network Protection up to 1GB thruput - no hardware included
S-503-3054 SilverSky Network Protection up to 3GB thruput - no hardware included
S-200-2182 Site to Site VPN Tunnels
S-200-2968 Managed FortiSIEM per device Global Support
S-200-3014 Managed FortiSIEM per user
S-200-2970 Managed FortiSIEM per device PATIENTLOCK Only Support
I-500-3037 Installation of SilverSky Network Protection up to 250MB thruput with FortiGate 6X Series
I-501-3037 Installation of SilverSky Network Protection up to 500MB thruput with FortiGate 8X Series
I-502-3037 Installation of SilverSky Network Protection up to 1GB to thruput with FortiGate 10X Series
I-503-3037 Installation of SilverSky Network Protection up to 3GB thruput with FortiGate 20X Series
I-500-3054 Installation of SilverSky Network Protection up to 250MB thruput - no hardware included
I-501-3054 Installation of SilverSky Network Protection up to 500MB thruput - no hardware included
I-502-3054 Installation of SilverSky Network Protection up to 1GB thruput - no hardware included
I-503-3054 Installation of SilverSky Network Protection up to 3GB thruput - no hardware included
I-200-2968 Installation of Managed FortiSIEM per device Global Support
I-200-3014 Installation of Managed FortiSIEM per user
I-200-2970 Installation of Managed FortiSIEM per device PATIENTLOCK Only Support
I-200-2182 Installation of Site to Site VPN Tunnels
2. Customer Responsibilities
During the performance of the Network Protection Services, Customer agree to perform the following obligations and acknowledge and agree that PatientLock’s ability to perform its obligations, and its liability under the SLAs below, are dependent upon Customer’s compliance with the following:
Prior to engagement commencement, assign a project management contact to serve as a primary contact through the delivery and performance of the Network Protection Services;
Ensure complete and current contact information is provided on a timely basis;
Cooperate during the deployment period, including providing PatientLock all required information in a complete and accurate form to prevent implementation delays which may result in additional fees;
Appoint one or more authorized contacts authorized to approve and validate all requested changes;
Implement change requests;
Provide all necessary information with respect to Customer’s environment and communicate any network or system changes that could impact service delivery;
Provide necessary hardware along with maintenance and support contracts to run log collectors within Customer’s environment;
Customer is responsible for ensuring that all Customer-provided hardware is not EOL and is able to support current software versions.
In the event of hardware failure of Customer’s owned equipment. Customer are responsible for initiating and fulfilling the return materials authorization (“RMA”) process with the vendor and PatientLock.
Send log data in an encrypted manner, or via the agreed log collection device/type;
Ensure that the format and quality of the data being sent to PatientLock is sufficient enough for PatientLock to provide the Network Protection Services;
Customer is required to provide, configure and manage required switches to support high Availability (HA) mode.
Customer acknowledges that Customer’s fulfillment of these responsibilities is essential to PatientLock’s ability to perform the Network Protection Services in a timely manner.
3. PatientLock Deliverables
During the performance of the Network Protection Services, PatientLock will configure and deploy the selected security technology and will provide:
Continuous 24x7 device availability management (continuous health and security of Customer’s managed appliance);
A reporting platform to view and audit the alert response process (platform has integrated dashboards, incident management, and flexible reporting);
Service support 24x7 with online ticketing;
Threat intelligence correlation across the Customer firewall and IDPS;
A Security Management Center (SMC) Portal; portal with reporting functionality on Firewall, Web Content Filter, VPN, and Intrusion Detection Prevention System (IDPS) logs;
Management of Firewall policies includes adding, deleting, or modifying individual Network Address Translations (NAT) (incoming, outgoing, and loop-back) including object creation.
Adding, deleting, or modifying access control list changes (such as permit or deny changes), including the creation of policy objects creation (Hosts, Groups, Networks, Ranges, and Service objects).
Adding, deleting, or modifying individual network routes within the firewall.
Adding, deleting, or modifying IDPS signatures, not including routine signature updates.
Standard policy change may comprise one or more of the above bullets. PatientLock reserves the right to determine, within its reasonable discretion, whether a change falls within the scope of Customer’s service.
Software Upgrades and Patch Maintenance (coordinated with the Customer)
In cases where support for a particular product or product version is being discontinued by the vendor or by PatientLock, PatientLock will communicate new platform migration options, if any. To be assured of uninterrupted service, the Customer must complete the migration process within sixty (60) days of notification by PatientLock.
For Customer-provided hardware, the Customer bears any costs relating to procuring new hardware or components and to re-provisioning any devices.
For Customers who receive hardware as a part of their service, PatientLock will provide replacement hardware.
Gateway Anti-Virus support (Fortinet). PatientLock will work with Fortinet to update anti-virus signatures/policies regularly when updates are released by Fortinet and reviewed by PatientLock.
Web Content Filtering (WCF) support (Fortinet). WCF as a licensed option is included in the purchase of this bundle, PatientLock shall deploy the default categorization policy by zone or internet protocol (“IP”) range as specified by the Customer. Websites that are accessed that are within an enabled category shall not be blocked.
Customers can self-manage their WCF actions through the SMC portal or by sending in a change request to PatientLock Support. This is equated to a standard policy change request. Requests for whitelisting or blacklisting of domains are permitted under a standard policy change request.
4. Equipment
Equipment provided to Customer by PatientLock (“PatientLock Equipment”) is for Customer’s use only during the Term of this SOW. PatientLock will service the PatientLock Equipment in accordance with PatientLock’s service policies. Customer agree to (i) use PatientLock Equipment only for the purpose of receiving Network Protection Services; (ii) prevent any connections to PatientLock Equipment not expressly authorized by PatientLock;
prevent tampering, alteration, or repair of PatientLock Equipment by any persons other than PatientLock or PatientLock’s authorized personnel; and (iv) assume complete responsibility for improper use, damage to or loss of such PatientLock Equipment regardless of cause. Customer will pay PatientLock for any damaged or unrecoverable PatientLock Equipment. Customer authorize PatientLock and PatientLock’s authorized agents, contractors, representatives, and vendors to enter Customer’s premises, with reasonable notice, during normal business hours (or as otherwise authorized by Customer), to install, maintain, repair, and/or remove any PatientLock Equipment and/or to perform the Network Protection Services. Customer must return PatientLock Equipment, at Customer’s expense, within 14 days after this SOW terminates or expires. PatientLock Equipment must be returned in the same condition in which it was provided to Customer, except for normal wear and tear. If Customer fails to do so, billing for Network Protection Services will resume and continue until all PatientLock Equipment is returned. Equipment for Network Protection Services delivered through PatientLock is maintained in a lockdown configuration that does not allow Customer administrative access.
5. Additional Disclaimers
PatientLock does not guarantee a continuous, uninterrupted, virus-free, malware-free, intrusion-free, or continuously secure Customer network or network environment, and PatientLock is not liable if Customer or Customer’s end users are unable to access Customer’s network at any specific time. Additionally, PatientLock does not guarantee that PatientLock will be able to replace any of Customer’s information, content, or other data that may be lost, damaged, or stolen resulting from the use of the Services.
Service Level Agreement for Network Protection Services
The following terms and conditions apply to the service levels of the Network Protection Services provided pursuant to the SOW, once the service tuning as a part of service deployment has been completed.
In the event PatientLock fails to meet the levels defined in this Service Level Agreement (“SLA”) for a minimum of two (2) consecutive months, Customer must notify PatientLock in writing of any violations and allow PatientLock thirty (30) days from notification to cure. If still unresolved, Customer may immediately terminate the Service giving rise to such breach without additional notification or incurring early termination fees within thirty (30) days of PatientLock’s failure to cure.
1. Service Hours of Operation
PatientLock maintains Security Operations, Network Operations, and Technical Support departments on a 24 x 7 x 365 basis. Customer may reach an individual in each of these departments by calling the appropriate support service.
2. Response Time
PatientLock commits to certain response times. These commitments are subject to Customer providing PatientLock accurate and current contact information for Customer’s designated points of contact. PatientLock’s failure to respond in accordance with the parameters defined herein will entitle Customer to receive, as Customer’s sole remedy and PatientLock’s sole obligation, credits described below, provided however, that Customer may obtain no more than one credit per day, regardless of how often in that day PatientLock failed to meet these parameters.
Definitions of Alert Severity: Alerts are escalated into events as a result of detected suspicious activity. Events are reviewed both by SOC staff and through automation.
Critical – This category of event may have a severe impact to Customer’s network or system and indicates a compromise. Examples of events that fall under this category: malware infection, backdoor or Trojan traffic, outbound DDoS, and bot net traffic.
High – This category of event may have a high impact on Customer’s network or system and could lead to malware infection, data leakage, and disruption of operations due to network or system down time. Examples of events that fall under this category: download of malicious software, leakage of file from internal network, DoS or DDoS, P2P traffic (torrent), cloud storage traffic, and exploit launching.
Medium – This category of event has a medium level of impact on Customer’s network or system and could lead to unnecessary leakage of information or exposure of vulnerabilities. Examples of events that fall under this category: port scans, vulnerability scans, social media traffic, unusual network traffic, and multiple failed logins.
Low – This category of event shows little impact on the Customer. This is mostly informational communication. Examples of events that fall under this category: login or logout notifications, failed login notifications, application or system update notification, and application or system error message.
Informational – This category of event shows no impact to the Customer. This is only informational alerts to track activity. Examples of events that fall under this category: false positives, approved scanning vendors, and test alerts.
The severity level of each event is determined by PatientLock based on the nature of the event identified. Customer may indicate to PatientLock that an identified event is of a lower priority if Customer is not vulnerable to the detected activity.
Event Severity Response Times
Critical/High Events - Response within 10 minutes upon identification of an Event and a Tier 1 credit if missed; Tier 1 credit is defined in Section 5 below.
Medium/Low Events - Response within 24 hours upon identification of an event and a Tier 2 credit if missed; Tier 2 credit is defined in Section 5 below.
3. Service Availability Guarantee
PatientLock’s commitment is to have the Network Protection Services, available 99.5% of the time and as set forth below. At Customer’s request, PatientLock will calculate the number of minutes the Service(s) was not available to Customer in a calendar month (“Service Unavailability"). Failure to meet the service level described in this Section will entitle Customer to receive a Tier 1 credit.
4. Maintenance
PatientLock reserve the following weekly maintenance windows during which Customer may experience periodic service outages:
Tuesday and Thursday (12 AM – 2 AM ET)
Saturday (12 AM – 5 AM ET)
In the event PatientLock must perform maintenance during a time other than the service windows provided above, PatientLock will provide notification prior to performing the maintenance.
5. Credit Request and Payment Procedures
If PatientLock fails to meet service levels herein in a calendar month, Customer will be entitled to receive a credit as specified below*:
Tier 1. Equal to twice the prorated portion of the monthly fee for the affected service, or;
Tier 2. Equal to the prorated portion of the monthly fee for the affected service.
*Provided however that a breach of this SLA due to Exceptions described below will not qualify for such credits.
To receive a credit under this SLA, Customer must be current with Customer’s payments at the time Service Unavailability occurred. In addition, all credit requests must be submitted in writing, either through SilverSky’s ticketing system, via email or fax, or by certified U.S. mail. Customer must submit each request for credit within seven (7) days of the occurrence giving rise to the credit claim. The total credit amount PatientLock will pay to Customer in any calendar month will not exceed, in the aggregate, half of the total fees invoiced to Customer for the Managed Detection and Response Services for which a claim is made in the applicable month. (Credits are exclusive of any applicable taxes charged to Customer or collected by PatientLock.)
6. Exceptions
Customer will not receive any credits under this SLA in connection with any failure or deficiency of the Managed Detection and Response Services or a failure to meet service level caused by or associated with any of the following:
Maintenance, as defined above;
Fiber cuts or other such issues related to telephone company circuits or local ISP outside of PatientLock’s control;
Customer’s applications, equipment, or facilities;
Customer or any of Customer’s end-user’ acts or omissions;
Reasons of Force Majeure as defined in the Terms and Conditions associated with this MSA;
Any act or omission on the part of any third party, not reasonably within PatientLock’s control;
First month of service for the specific Managed Detection and Response Services for which a credit is claimed;
DNS issues outside PatientLock’s direct control;
Broadband connectivity.
7. Fair Usage Threshold for Data Ingestion
PatientLock maintains a fair usage policy to ensure the availability and sustainability of the Service. Failure to adhere to the fair usage policy will result first in a notification to Customer and then, if Customer fails to take remedial action, suspension of this SLA until such time as the usage level associated with the corresponding data sources falls below a reasonable, standard threshold.
Arrange signatures
Contact PatientLock to prepare the agreements for your organization or discuss requested changes.
Request a signing copy