Cuick Trac Services Agreement

1.  Service Provider shall provide to Customer the services (the “Services”) set out in the Statement of Work (“SOW”). Service Provider shall provide the Services (a) in accordance with the terms and subject to the conditions set forth in this Agreement, including the Service Level Agreement attached as Exhibit A; (b) using personnel of required skill, experience, licenses, and qualifications; (c) in a timely, workmanlike, and professional manner; and (d) in accordance with the highest professional/generally recognized industry standards in Service Provider’s field. Service Provider shall comply with all Customer rules, regulations, and policies when providing the Services. Nothing in this Agreement shall be construed to prevent Customer from itself performing or from receiving services from other providers that are similar or identical to the Services. Service Provider shall not subcontract the Services.

2.  Fees and For the Services to be performed hereunder, Customer shall pay to Service Provider (against Service Provider’s invoice) the fee as set forth in the SOW (the “Fee”) within 30 days after receipt of the invoice, provided that Service Provider has furnished a correct invoice. The Fee is inclusive of the cost of all materials used for the provision of the Services. Customer shall reimburse Service Provider only for expenses that have been pre-approved in writing by Customer in its reasonable discretion, within 30 days of receipt by Customer of Service Provider’s invoice, which shall be accompanied by receipts and supporting documentation reasonably acceptable to Customer.

3.  Intellectual Under this Agreement, each party retains ownership of its respective pre-existing intellectual property, with no transfer of such ownership rights implied. Intellectual property rights in deliverables created specifically for the Customer (“Deliverables”) during the provision of Services will belong to the Customer, including but not limited to copyrights, patents, trademarks, and any other rights related to the Deliverables. For any Deliverables not classified as “work made for hire,” the Service Provider irrevocably assigns all such rights to the Customer without additional compensation. The Service Provider retains ownership of any pre-existing intellectual property used in the provision of the Services, granting the Customer a non-exclusive license to use this intellectual property within the Deliverables only for their intended purpose.

4.  All non-public, confidential or proprietary information of Customer (“Confidential Information”), including, but not limited to, specifications, samples, patterns, designs, plans, drawings, documents, data, business operations, customer lists, pricing, discounts, or rebates disclosed by Customer to Service Provider, whether disclosed orally or disclosed or accessed in written, electronic, or other form or media, or otherwise learned by Service Provider in providing services, and whether or not marked, designated, or otherwise identified as “confidential,” in connection with this Agreement is confidential, solely for Service Provider’s use in performing this Agreement and may not be disclosed or copied unless authorized by Customer in writing. Confidential Information does not include any information that: (a) is or becomes generally available to the public other than as a result of Service Provider’s breach of this Agreement; (b) is obtained by Service Provider on a non-confidential basis from a third-party that was not legally or contractually restricted from disclosing such information; or (c) Service Provider establishes by documentary evidence, was in Service Provider’s possession prior to Customer’s disclosure hereunder. Upon Customer’s request, Service Provider shall promptly return all documents and other materials received from Customer. Customer shall be entitled to injunctive relief for any violation of this Section.

5.  This Agreement shall commence as of the Effective Date and shall continue thereafter until the completion of the Services set out in the SOW, unless sooner terminated pursuant to Section 6 (the “Term”).

6.  Either Party may terminate this Agreement, effective upon written notice to the other Party (the “Defaulting Party”), if the Defaulting Party: (a) materially breaches this Agreement, and such breach is incapable of cure, or with respect to a material breach capable of cure, the Defaulting Party does not cure such breach within 30 days after receipt of written notice of such breach; (b) becomes insolvent or admits its inability to pay its debts generally as they become due; (c) becomes subject, voluntarily or involuntarily, to any proceeding under any domestic or foreign bankruptcy or insolvency law, which is not fully stayed within seven business days or is not dismissed or vacated within 45 days after filing; (d) is dissolved or liquidated or takes any corporate action for such purpose; (e) makes a general assignment for the benefit of creditors; or (f) has a receiver, trustee, custodian, or similar agent appointed by order of any court of competent jurisdiction to take charge of or sell any material portion of its property or business. Customer may terminate this Agreement for any reason by giving Service Provider 90 days’ prior written notice of its intent to terminate the Services, subject to any agreed upon termination charge or exceptions as set out in the SOW or its Additional Notes.

7.  Effect of Expiration or Upon expiration or termination of this Agreement for any reason, Service Provider shall promptly: (a) deliver to Customer all documents, work product, and other materials, whether or not complete, prepared by or on behalf of Service Provider in the course of performing the Services for which Customer has paid; (b) return to Customer all Customer-owned property, equipment, or materials in its possession or control; (c) remove any Service Provider-owned property, equipment, or materials located at Customer’s locations; (d) deliver to Customer, all documents and tangible materials (and any copies) containing, reflecting, incorporating, or based on Customer’s Confidential Information; (e) provide reasonable cooperation and assistance to Customer in transitioning the Services to an alternate service provider; (f) on a pro rata basis, repay all fees and expenses paid in advance for any Services which have not been provided; (g) permanently erase all of Customer’s Confidential Information from its computer systems; and (h) certify in writing to Customer that it has complied with the requirements of this Section 7.

8.  Independent It is understood and acknowledged that in providing the Services, Service Provider acts in the capacity of an independent contractor and not as an employee or agent of the Customer. Service Provider shall control the conditions, time, details, and means by which Service Provider performs the Services. Customer shall have the right to inspect the work of Service Provider as it progresses solely for the purpose of determining whether the work is completed according to this Agreement. Service Provider has no authority to commit, act for or on behalf of Customer, or to bind Customer to any obligation or liability. Service Provider shall not be eligible for and shall not receive any employee benefits from Customer and shall be solely responsible for the payment of all taxes, FICA, federal and state unemployment insurance contributions, state disability premiums, and all similar taxes and fees relating to the fees earned by Service Provider hereunder.

9.  Service Provider shall indemnify, defend, and hold harmless Customer and its oicers, directors, employees, agents, ailiates, successors, and permitted assigns (collectively, “Indemnified Party”) against any and all losses, damages, liabilities, deficiencies, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs, or expenses of whatever kind, including reasonable attorneys’ fees, fees and the costs of enforcing any right to indemnification under this Agreement, and the cost of pursuing any insurance providers, incurred by Indemnified Party (collectively, “Losses”), relating to any claim of a third party or Customer arising out of or occurring in connection with Service Provider’s negligence, willful misconduct, or breach of this Agreement. Service Provider shall not enter into any settlement without Customer’s or Indemnified Party’s prior written consent.

10. Compliance with Law. Service Provider is in compliance with and shall comply with all applicable laws, regulations, and ordinances. Service Provider has and shall maintain in effect all the licenses, permissions, authorizations, consents, and permits that it needs to carry out its obligations under this Agreement.

11. Each of the parties hereto shall use reasonable efforts to, from time to time at the request and sole expense of the other party without any additional consideration, furnish the other party such further information, execute and deliver such additional documents, instruments, and conveyances, and take such other actions and do such other things, as may be reasonably necessary or appropriate to carry out the provisions of this Agreement and give effect to the transactions contemplated hereby. Each Party shall deliver all communications in writing either in person, by certified or registered mail, return receipt requested and postage prepaid, by facsimile or email (with confirmation of transmission), or by recognized overnight courier service, and addressed to the other Party at the addresses set forth above (or to such other address that the receiving Party may designate from time to time in accordance with this section). This Agreement and all matters arising out of or relating to this Agreement, including tort and statutory claims are governed by, and construed in accordance with, the laws of Delaware, (including its statutes of limitations and Delaware choice of law statutes, without giving effect to any conflict of laws provisions thereof that would result in the application of the laws of a different jurisdiction. Either party shall institute any legal suit, action, or proceeding arising out of or relating to this Agreement in the federal or state courts in each case located in Delaware. EACH PARTY HEREBY IRREVOCABLY AND UNCONDITIONALLY: (A) CONSENTS AND SUBMITS TO THE EXCLUSIVE JURISDICTION OF THE AFOREMENTIONED COURTS; AND (B) WAIVES ANY OBJECTION TO THAT CHOICE OF FORUM BASED ON VENUE OR TO THE EFFECT THAT THE FORUM IS NOT CONVENIENT; (C) WAIVES ANY RIGHT TO TRIAL BY JURY; AND (D) WAIVES PERSONAL SERVICE OF ANY SUMMONS, COMPLAINT, OR OTHER PROCESS, WHICH MAY BE MADE BY ANY OTHER MEANS PERMITTED BY DELAWARE LAW. This Agreement contains the entire understanding of the Parties with respect to the subject matter hereof, and supersedes all prior and contemporaneous written or oral understandings, agreements, representations, and warranties with respect to such subject matter. The invalidity, illegality, or unenforceability of any provision herein does not affect any other provision herein or the validity, legality, or enforceability of such provision in any other jurisdiction. The Parties may not amend this Agreement except by written instrument signed by the Parties. No waiver of any right, remedy, power, or privilege under this Agreement (“Right(s)”) is effective unless contained in a writing signed by the Party charged with such waiver. No failure to exercise, or delay in exercising, any Right operates as a waiver thereof. No single or partial exercise of any Right precludes any other or further exercise thereof or the exercise of any other Right. The Rights under this Agreement are cumulative and are in addition to any other rights and remedies available at law or in equity or otherwise. Neither party may directly or indirectly assign, transfer, or delegate any of or all of its rights or obligations under this Agreement, voluntarily or involuntarily, including by change of control, merger (whether or not such party is the surviving entity), operation of law, or any other manner, without the prior written consent of the other party. Any purported assignment or delegation in violation of this Section shall be null and void. This Agreement is binding upon and inures to the benefit of the Parties and their respective successors and permitted assigns. Except for the Parties, their successors and permitted assigns, there are no third party beneficiaries under this Agreement. Sections 3, 4, 7, 8, 9, and 10 of this Agreement, as well as any other provision that, in order to give proper effect to its intent, should survive the expiration or termination of this Agreement, will survive such expiration or termination for the period specified therein, or if nothing is specified for a period of 12 months after such expiration or termination. This Agreement may be executed in counterparts, including by electronic signature.

Exhibit A

Service Level Agreement

This Service Level Agreement describes the terms and conditions, and outlines Beryllium InfoSec, Inc.’s (“Service Provider”) responsibilities and support provided to Customers using the Cuick Trac enclave.

Technical Support

Under this agreement, monitoring by Service Provider’s personnel of the Cuick Trac environment will occur on a 5- days a week (Monday – Friday) basis with service hours of 8:00am-6:00pm CST. Remediation services will be provided only during business hours unless otherwise specifically stated in the SOW. Service Provider will respond to problems, errors, or interruptions in the provision of the Services in the timeframe(s) described below. Severity levels will be determined by Service Provider at its reasonable discretion and in accordance with industry best practices. All remediation services will initially be performed remotely; Service Provider will provide onsite service only if remote remediation is ineffective and, under all circumstances, only if covered under the Service plan selected by Customer.

All time frames are calculated as of the time that Service Provider is notified of the applicable issue / problem by Customer through Service Provider’s designated support portal, help desk, or by telephone. Notifications received in any manner other than described herein may result in a delay in the provision of remediation efforts. Help desk support provided outside of Service Provider’s normal service hours will be billed to Customer at the hourly rate of $200/ hour (2- hour minimum applies), and support provided between 11:00pm-6:00am CST will be billed to Customer at the hourly rate of $600/ hour. For support to locations in significantly different time zones, 2+ days notice for anticipated priority support is recommended. Support requiring on-site visits will be billed to Customer at the flat rate of $3000/ day, plus expenses (based upon the approved United States Federal Government Per Diem rate for that fiscal year).

Service Level Defaults

In the event of a Service Level Default, the corresponding Service Level Credit will be creditable to Customer; provided, however, that in no event will the total amount of Service Level Credits creditable to Customer for a single month exceed the “At Risk Amount” for that month.

If Service Provider believes that a Service Level Default should be excused, then Service Provider will so state in the applicable Service Level Report. In the applicable Service Level Report, Service Provider will also indicate the following:

1. Which Service Levels are affected by the exemptions and the calculation of the actual performance values of the affected Service Levels, both with and without taking into account the effect of the excuses concerned; and
2. All of the circumstances that give rise to the claimed exemption, in suicient detail to permit Customer to

evaluate whether Service Provider’s claim of exemption is valid.

At Risk Amount. In no event will the total amount of Service Level Credits in a single month exceed, in total, 75 percent of the aggregate amount of all Cuick Trac Enclave Charges for the applicable month (the “At Risk Amount” for the applicable month) within the first year of the agreement. The At Risk Amount will reduce to 50 percent after the first year.

Service Level Credits

For purposes of calculating the Service Level Credit, Customer will allocate a certain number of points (“Service Level Credits”) to each of the Service Levels; provided, however, that the aggregate Credits allocated among all Service Levels will not exceed 100.

Service Level Credits will be calculated monthly. Customer will be entitled to a Service Level Credit for each Service Level Default that occurs during such month. Any Service Level Credits will begin to accrue for Service Level Defaults 3 months after the Service Commencement Date for the applicable Service Level.

For Service Level Defaults, each Service Level Credit is equal to the product of: (1) the Service Level Credits applicable to the affected Service Level, divided by 100, multiplied by; (2) the “At Risk Amount”. Below is a sample calculation.

If Service Provider has failed to meet a Service Level during the prior month; to which Customer has allocated 30 Service Level Credits; and Service Provider’s total Cuick Trac Enclave Charges to Customer for such month for the Services are $10,000, the applicable Service Level Credit would be computed as follows:

(Service Level Credits / 100) X “At Risk Amount” = (30 / 100) X (Cuick Trac Enclave Charges X 75%) = (30 / 100) X ($10,000 * 75%) = $2,250

Service Level Credits will be calculated and paid monthly and adjusted in the invoice for the applicable month. Internet Service Connection

The Cuick Trac secure virtual enclave requires an active ISP connection for access. Based upon individual needs, it is strongly recommended that Customer obtain a primary and secondary ISP with automatic fail-over to prevent loss of connectivity. Customer understands and agrees that Service Provider has no control over ISP services and shall not be held liable for any loss or work stoppages caused by ISP outages and Service Provider shall be held harmless in the event of any such losses.

Expectations & Assumptions

The following is asserted to facilitate this engagement.

6. All Parties will mutually cooperate and comply with requests for information about the operation of information systems concerning the safeguarding of CUI and furnish answers quickly and truthfully in the interest of those
7. All Parties’ points of contact for communication will be assigned for the duration of the SOW, unless changed via prior written or e-mail notification to all
8. Service Provider will provide all Services and Service Deliverables, and perform all obligations set forth in the
9. Customer will obtain and maintain internet connectivity through an internet service Service Provider (ISP) of their choosing. It is strongly recommended that primary and back-up connections be established to avoid unexpected ISP outages.
10. No changes to the SOW shall be made without the written consent of all All changes must be submitted with the Cuick Trac CUI Access List, provided to Customer during on-boarding.
11. Service Provider is not providing Customer with any legal advice or legal counsel. Customer is encouraged to seek legal advice from their own

Software that is not on the Cuick Trac approved white-list, but may be in use in the Customer’s networks, will be analyzed for security concerns and explicitly approved on a case-by-case basis. Service Provider cannot and will not provision software that creates unmitigated vulnerability within the environment.

Customer understands and agrees that software that is not part of the Cuick Trac whitelist may pose additional risk to Customer’s environment, and Customer fully accepts the additional risk. The Service Provider is not liable for software implemented at Customer’s request.

Anti-Virus; Anti-Malware

Cuick Trac provides anti-virus and anti-malware; however, viruses and/or malware that exist on the Customer’s system at the time that the Cuick Trac secure virtual enclave is implemented may not be capable of being removed without additional services, for which a cost may be incurred which will be charged to the Customer.

Customer understands and agrees that no security solution is one hundred percent effective, and any security paradigm may be circumvented and/or rendered ineffective by certain malware that were previously unknown to the manufacturers of the software solution, and/or which are purposely or intentionally downloaded or installed onto Systems.

Customer is strongly advised to refrain from downloading files that are sent by unknown users, and/or users or files whose origination cannot be verified. Service Provider does not warrant or guarantee that all viruses and malware will be capable of being removed, or that any data corrupted or encrypted by Viruses or malware will be recoverable.

To improve security awareness, Customer agrees that Service Provider may transfer information about the results of processed files, information used for URL reputation determination, security risk tracking, and statistics for protection against spam and malware. Any information obtained in this manner does not and will not contain any personal or confidential information.

In the event of Federal or State investigation of breach or malware infection, Service Provider is required to surrender copies of logs, user environment configuration files, and data to law enforcement upon receipt of a legally enforced order. Service Provider will make every attempt to preserve information in its original state prior to forensic investigation but cannot make any guarantees or warranties to this preservation.

Patch Management

Service Provider shall keep all managed and/ or hosted equipment and software current with critical patches and updates (“Patches”) as such Patches are released by the manufacturers of the applicable hardware or software. Patches and updates are developed by third party vendors and, on rare occasions, may cause system instability. Service Provider reserves the right, but not the obligation, to refrain from installing a Patch if Service Provider is aware of technical problems caused by a Patch, or believes that a Patch may render the System, or any portion of the System, unstable or present an information security vulnerability or may otherwise create a NIST 800-171 compliance violation.

Consulting Advisory Services

The advice and suggestions provided by the Service Provider’s security experts, technical support or operations personnel will be for Customer’s informational and/or educational purposes only. The Service Provider’s personnel will not hold an actual director or oicer position with Customer and will neither hold nor maintain any fiduciary relationship or any position as employee or agent of Customer. Under no circumstances shall Customer list or place Service Provider’s personnel on Customer’s corporate records or accounts. At all times, the Service Provider’s personnel will be an independent contractor of Customer.

Diagnostic / Auditing Services

Given a 24 hour notice for Customer, any diagnostic or auditing services performed by Service Provider may require Service Provider to install a small amount of code (“Diagnostic Code”) on one or more of the devices attached to the Customer’s network enclave. The Diagnostic Code is deleted in its entirety after the testing process concludes. No personal data or CUI will be reviewed or copied by Service Provider at any time during the testing process. No files will be erased, modified, opened, reviewed, or copied at any time during the testing process. The Diagnostic Code will not install or create any disabling device, or any backdoor or hidden entryway into the Customer’s network enclave system. The results of the diagnostic testing will be kept confidential by Service Provider.

The testing process is for diagnostic purposes only. The process is not intended, and will not be used, to correct any problem or error in the System. Service Provider does not warrant or represent that the testing process will result in any particular outcome, or that any issue, hardware, or software configuration will be correctly detected or identified.

Data Replication

Service Provider does not guarantee or support data replication services outside of the Cuick Trac environment as it will be outside of the Cuick Trac baseline responsibility.

Data Destruction

Upon Service Provider deprovisioning a Customer from the Cuick Trac secure virtual enclave, all Customer, data will be destroyed. It is the responsibility of Customer to retrieve any and all of their data from the Cuick Trac secure virtual enclave before the final date of service. After the last day of the Cuick Trac service, all of Customer’s previously dedicated Cuick Trac storage will be securely wiped in accordance with DOD sanitization requirements for reuse of hard-drives. Retrieval of Customer data from their previously allocated storage is not possible and the Service Provider shall be held harmless and indemnified by Customer against, any claims, costs, fees, or expenses incurred by Customer that arise or result from data destruction after the end of this Agreement.

Unsupported Configuration Elements or Services

If Customer requests a configuration element (hardware or software) or hosting service in a manner that is not customary for Service Provider, or that is in “end of life” or “end of support” status, Service Provider may designate the element or service as “unsupported,” “non-standard,” “best efforts,” “reasonable endeavor,” “one-off,” “EOL,” “end of support,” or with like term in the service description (an “Unsupported Service”). Service Provider makes no representation or warranty whatsoever regarding any Unsupported Service, and Customer agrees that Service Provider will not be liable to Customer for any loss or damage arising from the provision of an Unsupported Service. Deployment and service level guarantees shall not apply to any Unsupported Service. Service Provider reserves the right of refusal to implement such configurations in the interest of preserving Customer security.

IP Addresses

Any IP addresses provided to Customer by Service Provider during the term of the Agreement are managed by Service Provider and Service Provider will retain these IP addresses after termination of the agreement, meaning that they may not be transferred or utilized by Customer after termination of the Agreement.

Hosting Services

Customer agrees that it is responsible for the actions and behaviors of its users of the Cuick Trac secure virtual enclave. In addition, Customer agrees that neither it, nor any of its employees or designated representatives, will use the Services in a manner that violates the laws, regulations, ordinances, or other such requirements of any jurisdiction. Customer warrants and represents that all hosted applications will be properly licensed, and that all such licenses shall be maintained by Customer throughout the entire term of the SOW and SLA. In addition, Customer agrees that neither it, nor any of its employees or designated representatives, will: transmit any unsolicited commercial or bulk email, will not engage in any activity known or considered to be “spamming” and carry out any “denial of service” attacks on any other website or Internet service; infringe on any copyright, trademark, patent, trade secret, or other proprietary rights of any third party; collect, attempt to collect, publicize, or otherwise disclose personally identifiable information of any person or entity without their express consent (which may be through the person or entity’s registration and/or subscription to Customer’s services, in which case Customer must provide a privacy policy which discloses any and all uses of information that Customer collects) or as otherwise required by law; or, undertake any action which is harmful or potentially harmful to Service Provider or its infrastructure.

Customer is solely responsible for ensuring that its login information is utilized only by Customer and Customer’s authorized users and agents. Customer’s responsibility includes ensuring the secrecy and strength of user identifications and passwords. Service Provider shall have no liability resulting from the unauthorized use of Customer’s login information. If login information is lost, stolen, or used by unauthorized parties or if Customer believes that any hosted applications or hosted data has been accessed by unauthorized parties, it is Customer’s responsibility to notify Service Provider immediately to request the login information be reset or unauthorized access otherwise be prevented. Service Provider will use commercially reasonable efforts to implement such requests as soon as practicable after receipt of notice.

SPLA Licensing

As part of the Services, Service Provider will acquire certain licenses from Microsoft under a services Service Provider license agreement (“SPLA”). The SPLA incorporates the terms and conditions of another Microsoft document, called the Service Service Provider Use Rights (or “SPUR”). Service Provider’s licensing of Microsoft software, and Customer’s use of such software, must always comply with the terms of the SPLA and SPUR. If Microsoft modifies the terms of the SPLA or the SPUR, Service Provider may be required, and will be permitted without prior notice to Customer to modify the Services to comply with the modified terms of the SPLA or SPUR, as applicable.

NIST 800-171 Policy and Procedural Guidance

As part of the Services, Service Provider will provide Customer with Policy and Procedure shell documents which must be completed by Customer to meet requirements under NIST 800-171. Service Provider uses best practice and makes all efforts to support the administrative requirements of NIST 800-171.

Service Level Descriptions

This shows the descriptions of the required Service Levels.

Incident Response Time

Incident Resolution Time

Availability

Services Provided

Service Ticket Priorities

Ticket Priorities: All tickets are worked from highest priority to lowest priority and from oldest to newest. Service hours are from 8am-6pm CST.

P1 – Priority 1: Critical

Examples of P1:

• Large degradation of service impacting most or all of the
• Server Down
• Network Down
• Email Down
• Fire, flood, etc…

P2 – Priority 2: High Priority Examples of P2:

• Backups failing – 3 days in a row
• Company communications, IE email being down
• Critical use workstation down
• Customer has requested service be completed within 24 hours
• Ticket has been open for more than 60 days

P3 – Priority 3: Medium Priority Examples of P3:

• Backups failing – 2 days in row
• New user provisioning
• One or more users productivity is hindered
• Problem is inconveniencing multiple users
• Workstation down
• Customer has requested service be completed within 48 hours
• Ticket has been opened for more than 30 days

P4 – Priority 4: Low Priority Examples of P4:

• Any item not having met the criteria for P1,2,or 3 and not specifically requested by the Customer to be higher priority than to be done on a monthly maintenance period
• Scheduled work for the Customer
• Monthly maintenance, updates,