© 2026 AccuSights LLC. All rights reserved.
This Exhibit A is incorporated into the AccuSights Protect Services Agreement (the "Agreement"). Capitalized terms have the meanings in the Agreement. AccuSights may update this Exhibit under Section 22.2 of the Agreement (improvements permitted; no unilateral degradation during a Term).
A-1. Protect tiers and pricing
Tier names and list prices are those published at accusights.com/pricing as of the version date. The tier, User count and plan type (monthly or annual) stated in the Order Form control. Every tier is monitored 24x7x365 by the AccuSights SOC, with human acknowledgment of Severity-1 Security Incidents within 15 minutes and human triage within 60 minutes, around the clock. "Business Hours" means 8:00 a.m.–5:00 p.m. Central Time, Monday–Friday, excluding U.S. federal holidays.
| Protect Essentials | Protect Advanced | Protect Complete | |
|---|---|---|---|
| List price | $25 per User / month | $35 per User / month | $50 per User / month |
| Minimum Users | 10 | 10 | 10 |
| Plans available | Monthly or annual | Monthly or annual | Monthly or annual |
| Description | Managed detection and response on every endpoint, inbox, identity and cloud account, with automatic containment per the elected Response Mode. | Everything in Protect Essentials plus network, perimeter and web-property telemetry sources, faster human review of Sev-2 and Sev-3 cases, and a quarterly service review. | Everything in Protect Advanced plus a named Cyber Success Engineer, a monthly service review, and priority scheduling for onboarding, tuning and scope changes. |
| Automated detection and containment (per Response Mode) | 24x7x365 | 24x7x365 | 24x7x365 |
| SOC monitoring and human analyst coverage for Sev-1 | 24x7x365 | 24x7x365 | 24x7x365 |
| Human acknowledgment of Sev-1 (≤ 15 minutes) and human triage (≤ 60 minutes) | 24x7x365 | 24x7x365 | 24x7x365 |
| Human confirmation call on Sev-1 | 24x7x365 | 24x7x365 | 24x7x365 |
| Telemetry source classes (see A-2) | Endpoint, identity, email, cloud tenant | All Essentials sources plus network / perimeter, web properties, backup and other log sources | All Advanced sources |
| Sev-2 human triage | Within 1 Business Day | Within 4 Business Hours | Within 4 Business Hours |
| Sev-3 human review | Within 3 Business Days | Within 1 Business Day | Within 1 Business Day |
| Named Cyber Success Engineer | Not included (SOC case team and Portal) | Not included (SOC case team and Portal) | Included |
| Service review | Annual (at renewal) | Quarterly | Monthly |
| Typical fit | Every business | Businesses with firewalls, public web properties or multiple sites that want fuller source coverage and faster follow-up on lower-severity cases | Healthcare, legal, financial, defense suppliers and multi-location businesses that want a named engineer who knows their environment |
Included in every tier:
- Security awareness and phishing training for staff, scored per person and per team, no per-module charges
- Dark-web monitoring for Customer's domain(s) and personnel credentials
- Device management and patching support for enrolled endpoints (patch deployment is a shared responsibility; see Exhibit C)
- Vulnerability scanning of In-Scope Assets, monthly and on material change
- One-page monthly report
- Compliance evidence produced from Protect activity, mapped to Customer's frameworks in the Portal
Billing unit. A "User" is each individual with an active mailbox or identity in the connected identity/email tenant, or each individual assigned an enrolled endpoint, whichever is greater. Shared devices, servers and service accounts are covered without a separate User charge up to a ratio of two (2) enrolled servers or shared devices per User; above that ratio, additional devices are billed at the per-device rate stated in the Order Form.
A-2. Monitoring stack (generic description)
The Protect Services collect Telemetry from, and where authorized act on, the following source classes. Specific products are selected by AccuSights and may change under Section 4.4 of the Agreement.
| Source class | What is collected | Response Actions available (Authorize / Collaborate modes) |
|---|---|---|
| Endpoint Agent (Windows, macOS, supported Linux; mobile via MDM where supported) | Process, file, registry, network and user-session events; installed software and patch state; device posture | Host isolation; process termination; file quarantine; remote wipe of enrolled managed devices where MDM-integrated |
| Identity (Microsoft Entra ID / Microsoft 365, Google Workspace; other IdPs on request) | Sign-in and audit logs, MFA events, risky-user signals, privilege changes, app consents | Disable account; revoke sessions and refresh tokens; force password reset; remove malicious OAuth grants |
| Email (Microsoft 365 Exchange Online, Google Workspace Gmail) | Message metadata and headers, mail-flow and inbox-rule changes, URL/attachment verdicts, user-reported phishing | Remove malicious inbox/forwarding rules; purge or quarantine messages; block sender/domain |
| Cloud (Microsoft 365 tenant, Google Workspace tenant; Azure, AWS, GCP control-plane logs where connected) | Admin and configuration audit logs, sharing events, storage access events | Disable compromised keys/service principals where connected; block indicators |
| Network / perimeter (supported firewalls, DNS filtering, Wi-Fi controllers where integrated) | Flow logs, DNS queries, IDS alerts, VPN authentication | Block IP/domain at firewall or DNS filter where integration supports it |
| Web properties (Customer's public websites and stores) | External attack-surface scanning, admin-login anomalies where plugin/agent supports it, certificate and DNS changes | Notify only (no Response Actions) unless Playbook states otherwise |
| Backup and other log sources | Backup job success/failure where integrated; other syslog sources by agreement | Notify only |
Telemetry is transmitted encrypted to AccuSights' platform hosted in the United States (Microsoft Azure, primary region East US 2, and Amazon Web Services US regions) and retained for 90 days on every tier as stated in Sections 18.3 and 18.10 of the Agreement. There is no archival tier and no extended-retention option.
Not a SIEM; Secondary Logs. AccuSights Protect ingests copies of security telemetry and event data solely to detect and respond to threats. Those copies are secondary, read-only working data, retained for 90 days and then deleted. AccuSights is not a SIEM, log-management or records-retention service and is not the Customer's system of record. The Customer remains solely responsible for retaining its own logs and records for the periods required by CMMC and NIST SP 800-171 (AU family), HIPAA, PCI DSS, its insurer, litigation holds, or any other obligation. AccuSights will provide export assistance for data still within the 90-day window on request at its then-current hourly rate, and has no liability for the unavailability of telemetry older than 90 days.
A-3. Severity definitions
AccuSights assigns Severity at triage and may re-classify as facts develop. Severity drives the SLA targets in A-4.
| Severity | Definition | Examples |
|---|---|---|
| Sev 1 — Critical | Confirmed or highly probable active compromise with imminent risk of material harm to In-Scope Assets or Customer Data | Active ransomware encryption; confirmed attacker interactive session on a server or privileged account; confirmed business-email-compromise with financial redirection in progress; mass data exfiltration in progress |
| Sev 2 — High | Probable compromise or high-confidence malicious activity that is contained or not yet impacting operations, or a critical exposure requiring urgent action | Malware executed and quarantined by Agent; successful sign-in from anomalous location on a standard user account; credentials for Customer's domain found on the dark web with evidence of active use; critical unpatched internet-facing vulnerability with active exploitation in the wild |
| Sev 3 — Medium | Suspicious activity requiring investigation, or policy/hygiene issue with meaningful risk | Blocked phishing campaign targeting multiple users; MFA fatigue attempts; new admin account created outside change window; Agent offline on a server for more than 24 hours |
| Sev 4 — Low / Informational | Low-risk detections, tuning items and informational findings | Blocked commodity malware download; benign-verified anomaly; vulnerability scan findings without known exploitation; awareness-training results |
Detection time. "Detection" for SLA purposes is the timestamp at which the AccuSights platform generates the alert that is subsequently classified as the Security Incident, not the time the underlying event occurred on Customer's system.
Acknowledgment. "Acknowledgment" means a human analyst has opened or taken ownership of the case, assigned Severity, initiated any automated Response Action permitted by the Response Mode and Playbook, and sent notice to the Authorized Contacts by the Sev-1 channel in the Escalation Matrix. The platform may open the case and send the first notice automatically, but the Sev-1 acknowledgment SLA is met only when a human analyst has taken ownership within the target time.
Triage. "Triage" means a human analyst has reviewed the case, confirmed or revised Severity, determined initial scope, and communicated findings and recommended or executed Response Actions to the Authorized Contacts.
A-4. Service-level targets
All targets run from the Monitoring Start Date. Times are elapsed from Detection.
| Metric | Target | Applies to | Coverage |
|---|---|---|---|
| Sev-1 acknowledgment (human) | ≤ 15 minutes | All tiers | 24x7x365 |
| Sev-1 triage (human) | ≤ 60 minutes | All tiers | 24x7x365 |
| Sev-2 acknowledgment | ≤ 60 minutes | All tiers | 24x7x365 (automated) |
| Sev-2 triage | Protect Essentials: within 1 Business Day; Protect Advanced and Protect Complete: ≤ 4 Business Hours (targets, no credit) | All tiers | Business Hours |
| Sev-3 / Sev-4 | Protect Essentials: reviewed within 3 Business Days; Protect Advanced and Protect Complete: within 1 Business Day; Sev-4 included in weekly digest (targets, no credit) | All tiers | Business Hours |
| Portal availability | 99.5% per calendar month, excluding scheduled maintenance (≤ 8 hours/month, notified ≥ 48 hours ahead, outside Business Hours where practicable) and emergency maintenance | All tiers | Measured by AccuSights monitoring |
| Monthly report | Delivered by the 10th of the following month (target, no credit) | All tiers | — |
Only the Sev-1 acknowledgment metric and Portal availability carry Service Credits. All other targets are operational objectives.
A-5. Service Credit table
| Failure | Credit | Cap |
|---|---|---|
| Each Sev-1 Security Incident not acknowledged within 15 minutes | 5% of that month's Protect Fees per missed event | |
| Portal availability below 99.5% but ≥ 99.0% in a month | 5% of that month's Protect Fees | Aggregate credits for all failures in a month: 25% of that month's Protect Fees |
| Portal availability below 99.0% in a month | 10% of that month's Protect Fees |
Claim window: 30 days after the end of the month (Agreement §8.3). Exclusions: Agreement §8.4 (pre-Monitoring Start Date; Customer-Responsible Events; maintenance; force majeure; third-party platform outages; suspension; payment breach). Sole remedy: Agreement §8.5.
Chronic failure termination right. If AccuSights misses the Sev-1 acknowledgment target for three (3) or more Sev-1 Security Incidents in each of three (3) consecutive months, in each case not excused under §8.4, Customer may terminate the affected Order Form on thirty (30) days' notice given within thirty (30) days after the third month, with a pro-rata refund of prepaid unused Fees. This is the only termination right arising from service-level performance.
A-6. Included vs. add-on services
| Service | Included | Add-on (Order Form or hourly) |
|---|---|---|
| Continuous monitoring, detection, case management | All tiers | — |
| Automated containment per Response Mode | All tiers | — |
| Human Sev-1 acknowledgment, triage and Response Action execution, 24x7x365 | All tiers | — |
| Incident scoping, initial containment guidance and forensic triage | Up to 8 analyst hours per incident, all tiers | Forensic investigation beyond the 8 included hours per incident: priced on the Order Form (hourly rate or prepaid block) |
| Forensic investigation (disk/memory imaging, timeline reconstruction, root-cause report) beyond the 8 included hours per incident | Not included | Priced on the Order Form |
| Incident-response retainer (prepaid response hours with a committed response window) | Not included | Priced on the Order Form |
| Regulatory response support (regulator, auditor, prime-contractor or insurer inquiries arising from a Security Incident; declarations, record production, interviews; Agreement §23.8) | Not included | Priced on the Order Form; otherwise at AccuSights' then-current hourly rate |
| Restoration, rebuild and recovery of systems and data | Not included (Customer / Customer's MSP) | Professional services at hourly rates |
| Breach coaching, legal, notification, credit monitoring, PR | Not included (Customer's insurer / counsel) | Not offered; AccuSights can refer to Customer's carrier panel |
| Security awareness and phishing training | All tiers | — |
| Dark-web monitoring (Customer domains and personnel credentials) | All tiers, up to 3 Customer domains | Additional domains: priced on the Order Form |
| Vulnerability scanning of In-Scope Assets (monthly and on change) | All tiers | Authenticated internal scanning or penetration testing: quoted separately |
| Device management and patching support | All tiers (see Exhibit C for split) | Full managed patching where no Customer's MSP exists: quoted separately |
| Compliance evidence mapped to frameworks | All tiers | Framework readiness, policies, audits: AccuSights, Inc. Comply / Assess under separate agreement |
| Telemetry retention | 90 days on all tiers (secondary, read-only working copies; Agreement §18.10) | Not offered. There is no extended-retention add-on and no archival tier; Customer retains its own logs and records for the periods required by CMMC / NIST SP 800-171 (AU family), HIPAA, PCI DSS, its insurer and litigation holds. Export assistance for data still within the 90-day window at AccuSights' then-current hourly rate. |
| Onboarding and baseline | Included (remote) | On-site deployment: quoted |
| Tabletop exercise | Not included (included in vCISO Program and Executive packages, Exhibit B) | Quoted per exercise |
| CUI-scoped enclave monitoring | Not included | Separate CUI-scoped Order Form required (Agreement §7.5) |
| BAA with AccuSights LLC for Customers that are HIPAA covered entities or business associates | Included at no charge; must be executed before the Monitoring Start Date | — |
A-7. Reporting cadence
| Report | Frequency | Audience | Content |
|---|---|---|---|
| Real-time alerts and case updates | As they occur | Authorized Contacts per Escalation Matrix | Severity, affected assets, actions taken, actions requested |
| Sev-1 incident summary | Within 1 Business Day of containment | Authorized Contacts, executive sponsor | What happened, what was done, when; open items; Risk Acceptances created |
| Weekly digest | Weekly (email) | Security contact / Customer's MSP | Sev-2 to Sev-4 case summary, Agent health, open vulnerabilities, awareness-training status |
| One-page monthly report | By the 10th of the following month | Owner / executive sponsor | Incidents by Severity, SLA performance and any credits, coverage metrics (Agent %, MFA %, patch compliance), open Risk Acceptances, top recommendations |
| Compliance evidence export | Continuous in Portal; on request | Customer's compliance lead / auditor | Dated evidence of Protect controls mapped to Customer's frameworks (informational only; Agreement §12.3(e)) |
| Service review | Annual at renewal (Protect Essentials); quarterly (Protect Advanced); monthly (Protect Complete) | Customer leadership; SOC case team (Essentials and Advanced) or named Cyber Success Engineer (Complete) | Trend review, tuning, scope changes, renewal planning |
A-8. Escalation matrix template
Customer completes and maintains this in the Portal (Agreement §7.1(g)). At least two Authorized Contacts must be reachable 24x7 by phone.
| Role | Name | Title | Phone (24x7) | Alternate channel (SMS / Signal / Teams) | Hours available | Authority | |
|---|---|---|---|---|---|---|---|
| Primary Sev-1 contact | 24x7 | ☐ Approve Response Actions ☐ Change Response Mode ☐ Approve Playbooks | |||||
| Secondary Sev-1 contact | 24x7 | ☐ Approve Response Actions ☐ Change Response Mode ☐ Approve Playbooks | |||||
| Executive sponsor / owner | ☐ Change Response Mode ☐ Accept Risk | ||||||
| IT lead or Customer's MSP contact | ☐ Approve Response Actions ☐ Execute Collaborate-mode actions | ||||||
| Compliance / privacy lead (HIPAA Security Official, etc.) | ☐ Receive breach-relevant notices | ||||||
| Cyber insurance carrier / breach coach (for Customer's own use) | Reference only |
Escalation sequence (Sev-1): Platform notice to Primary and Secondary by phone call and alternate channel at acknowledgment → if no response in 15 minutes, Executive sponsor → if no response in 30 minutes, all contacts on rotation every 30 minutes, documented in the case. In Authorize mode, containment proceeds in parallel; in Collaborate mode, no Response Action is taken until an authorized contact approves; in Notify mode, no Response Action is taken.
AccuSights contacts: SOC hotline +1 (773) 747-7490 (24x7x365) · [email protected] with subject line "ATTN: SOC" · Portal case system · Named Cyber Success Engineer (Protect Complete; assigned at onboarding).
A-9. Onboarding checklist and Monitoring Start Date
| Step | Owner | Prerequisite to Monitoring Start Date? |
|---|---|---|
| Order Form executed; cap acknowledgment recorded | Both | Yes |
| BAA with AccuSights LLC executed (required for Customers that are HIPAA covered entities or business associates) | Both | Yes, for HIPAA covered entities and business associates |
| Asset inventory completed in Portal | Customer / Customer's MSP | Yes |
| Endpoint Agent deployed on ≥ 95% of inventoried endpoints and servers, reporting healthy | Customer / Customer's MSP (AccuSights assists) | Yes |
| Identity and email tenant integrations connected with required permissions | Customer / Customer's MSP | Yes |
| Cloud, network and web integrations connected (as applicable to tier) | Customer / Customer's MSP | Recommended; gaps logged as Risk Acceptances |
| Escalation Matrix completed with ≥ 2 contacts reachable 24x7 | Customer | Yes |
| Response Mode confirmed and initial Playbooks approved | Customer | Yes |
| Baseline and tuning period completed (≥ 7 days) | AccuSights | Yes |
| Monitoring Start Date declared in Portal | AccuSights | — |
| 100% Agent coverage achieved | Customer / Customer's MSP | Within 30 days after Monitoring Start Date |