Skip to content

Legal Exhibit C — Shared Responsibility Matrix

AccuSights LLC

Exhibit C — Shared Responsibility Matrix

Version 2026.10 · Effective November 1, 2026 · Download the PDF (Exhibits A to C in one file)

Contents (5 sections)

Version 2026.10, effective November 1, 2026. This is the version in force; it is also at the current Shared Responsibility Matrix. Every version is listed in the document archive.

© 2026 AccuSights LLC. All rights reserved.

This Exhibit C is incorporated into the AccuSights Protect Services Agreement (the "Agreement"). It records which party is responsible for each activity needed for the Protect Services to work. A responsibility assigned to "Customer" is Customer's whether Customer performs it directly or through Customer's MSP; where Customer has no MSP, the "Customer's MSP" column responsibilities fall to Customer. A failure in a Customer or Customer's MSP responsibility that contributes to a Security Incident or loss is a Customer-Responsible Event (Agreement §13.4).

Legend: R = Responsible (performs the activity) · A = Approves / decides · S = Supports (assists, advises, provides tooling or guidance) · I = Informed · — = No role

C-1. Onboarding

# Responsibility AccuSights LLC Customer Customer's MSP (if any)
1 Execute Order Form, cap acknowledgment and, for Customers that are HIPAA covered entities or business associates, the BAA with AccuSights LLC (before the Monitoring Start Date) R R / A I
2 Provide complete and accurate asset inventory (endpoints, servers, identities, tenants, cloud accounts, network devices, web properties, remote/BYOD devices used for business) S A R
3 Confirm ownership of, and authority to monitor and act on, every In-Scope Asset, including third-party-hosted and BYOD assets (Agreement §6.5) I R / A S
4 Provide Agent packages, deployment instructions and integration guides R I I
5 Deploy endpoint Agents to ≥ 95% of inventoried endpoints and servers before Monitoring Start Date, and 100% within 30 days after S A R
6 Grant identity, email, cloud and network integration permissions at the scopes AccuSights specifies S A R
7 Complete Escalation Matrix with ≥ 2 Authorized Contacts reachable 24x7 S R / A S
8 Elect Response Mode (Notify / Collaborate / Authorize) in the Order Form; designate excluded assets (life-safety, clinical, production-control) S R / A S
9 Draft initial Playbooks (conditions, permitted Response Actions, decision windows) R A S
10 Provide employee notices and obtain consents required for endpoint, email and identity monitoring under applicable law and Customer's policies — R / A S
11 Disclose regulated-data environments (PHI, CUI, PCI cardholder data) and ensure BAA or CUI-scoped order is in place before enrollment I R S
12 Complete baseline and detection tuning; declare Monitoring Start Date R I I
13 Provide Portal training to Authorized Contacts R I I

C-2. Steady state — detection and response

# Responsibility AccuSights LLC Customer Customer's MSP (if any)
14 Collect, store and analyze Telemetry 24x7x365; maintain detection content and threat intelligence R — —
15 Triage Security Events, assign Severity, open and manage cases R I I
16 Acknowledge and escalate Sev-1 Security Incidents per Exhibit A and the Escalation Matrix R I I
17 Respond to escalations within the Playbook decision window; approve or decline Response Actions (Collaborate mode) I R / A S
18 Execute Response Actions in Authorize mode within approved Playbooks R I I
19 Execute recommended Response Actions in Notify and Collaborate modes S A R
20 Reverse containment (un-isolate, re-enable) once threat contained, on Authorized Contact request R A S
21 Restore data and rebuild systems after an incident; recover from backups S (add-on) A R
22 Report suspected incidents, lost devices and credential compromise to AccuSights within 24 hours; preserve evidence I R R
23 Engage cyber-insurance carrier, breach coach, counsel, notification vendors; make breach-notification decisions and filings I R / A —
24 Forensic investigation beyond included triage scope R (add-on) A S
25 Implement remediation recommendations within stated timeframes, or record a Risk Acceptance S A R
26 Maintain and review Risk Acceptance log; revisit accepted risks R (log) A I

C-3. Steady state — security hygiene and environment

# Responsibility AccuSights LLC Customer Customer's MSP (if any)
27 Keep Agents installed, healthy and reporting on 100% of in-scope endpoints; enroll new devices within 5 business days; restore offline Agents S (health alerts) A R
28 Enforce MFA on all administrative, privileged, remote-access and email accounts S (alerts, guidance) A R
29 Patch critical vulnerabilities (CVSS ≥ 9.0 / vendor-critical) within 30 days; other patches within a reasonable time S (scanning, patch deployment support per tier) A R
30 Retire or isolate end-of-life and unsupported systems, or record Risk Acceptance S A R
31 Maintain immutable or offline backups of business-critical data; test restoration at least quarterly S (backup-job alerts where integrated) A R
32 Manage identity provider, email tenant, cloud tenant and network configuration; implement AccuSights hardening recommendations S A R
33 Network segmentation, firewall rules, Wi-Fi and terminal isolation S A R
34 Endpoint encryption, MDM enrollment and device management policies S (device management support per tier) A R
35 Privileged-access management, admin account lifecycle, joiner/mover/leaver process S A R
36 Keep asset inventory and Escalation Matrix current (within 1 business day of changes) S A R
37 Notify AccuSights before material environment changes (tenant migration, IdP change, EDR change, new site) I R R
38 Vulnerability scanning of In-Scope Assets (monthly and on change) and reporting R I I
39 Security awareness and phishing training delivery and scoring R A (participation) I
40 Dark-web monitoring for Customer domains and credentials; alerting on exposure R A (password resets) R (resets)
41 Website, e-commerce and plugin patching; admin credential hygiene for web properties S (external monitoring) A R

C-4. Data, compliance and governance

# Responsibility AccuSights LLC Customer Customer's MSP (if any)
42 Secure AccuSights' own platform, Telemetry storage and personnel access (Agreement §18.6) R — —
43 Retain secondary, read-only copies of Telemetry for 90 days per Exhibit A and Agreement §18.10; export and delete Customer Data at termination per Agreement §17 R A (export requests) S
43a Log and records retention (Not a SIEM; Secondary Logs): retain Customer's own logs and records for the periods required by CMMC / NIST SP 800-171 (AU family), HIPAA, PCI DSS, Customer's insurer, litigation holds or any other obligation; maintain Customer's own system of record; request export of any Telemetry still within the 90-day window S (export assistance at hourly rate, within the 90-day window only) R / A R
44 Classify and control regulated data on Customer systems (PHI, CUI, PCI); keep it out of unscoped environments — R S
45 Compliance evidence: AccuSights produces evidence of Protect controls; Customer owns its compliance program, assessments, attestations and filings R (evidence) R / A (program) S
46 Regulatory, auditor, prime-contractor and insurer communications, questionnaires and attestations S (hourly / vCISO) R / A S
47 Maintain cyber-liability insurance ≥ $1,000,000 per claim; provide certificate on request I R —
48 Maintain AccuSights E&O / cyber insurance per Agreement §20.1 R I —
49 Manage subcontractors and tooling vendors used to deliver Protect; remain responsible for their performance R I —
50 Manage Customer's other vendors (including Customer's MSP) and their access to Customer systems — R / A R (own access)
51 Agent removal and integration revocation at offboarding (within 30 days) S (instructions, remote disable) A R

C-5. Notes

  • MSP-purchased Protect. Where Customer's MSP places the order, the Agreement is accepted by Customer (the end client) directly or by the MSP holding written authority to bind Customer (Agreement §3.4). The MSP may bill Customer at wholesale and remains responsible for collection from Customer. The MSP's column responsibilities are contractual obligations of the MSP to Customer, and Customer remains responsible to AccuSights for them under Agreement §5.5.
  • Coverage. AccuSights "R" entries for Sev-1 human acknowledgment, triage and Response Action execution apply 24x7x365 on all tiers. Human review of Sev-2 to Sev-4 cases follows the Business Hours windows for Customer's tier in Exhibit A. Automated detection and containment operate 24x7x365 on all tiers.
  • Changes. The Parties may re-allocate individual rows for a Customer by Order Form. Absent that, this Exhibit controls.
  • Read with Exhibit A (Service Description) and Agreement Sections 6 (Response Modes), 7 (Customer Obligations), 10 (Risk Acceptance) and 13.4 (Customer-Responsible Events).