AccuSights Statement of Work — Fixed-Fee Readiness Project

© 2026 AccuSights, Inc. · 2058 N. Western Ave, Chicago, IL 60647 · +1 (773) 747-7490

Protect Offerings (SOC/MDR, vCISO) are not within this SOW and can be ordered only from AccuSights LLC under the Protect Services Agreement.

1. Project Overview

AccuSights will perform a fixed-fee compliance-readiness engagement (the "Project") to help Customer prepare for a formal assessment, audit or attestation of the framework(s) in Section 2. The Project is a readiness and advisory engagement. AccuSights does not conduct certification assessments, issue certifications or attestations, or determine Customer's compliance (Terms §10).

2. Frameworks and Scope

3. Services and Activities

AccuSights will perform the following phases:

Phase 1 — Kickoff and Scoping (Week 1). Kickoff Meeting; confirm scope, boundary, points of contact, schedule and evidence-collection approach; provision Customer's Platform tenant and integrations; Customer completes the intake questionnaire.

Phase 2 — Gap Assessment (Weeks 2–4). Review of Customer's policies, procedures, configurations and evidence against each in-scope control; control interviews with Customer personnel; automated evidence collection through Platform integrations where available; identification of gaps and prioritized remediation recommendations.

Phase 3 — Remediation Support (Weeks 5–10). Remediation planning; delivery of policy and procedure templates from the AccuSights library, tailored to Customer's inputs; SSP and POA&M drafting support; up to ________ hours of advisory support for Customer's remediation activities; tracking of remediation tasks and Risk Acceptances in the Platform.

Phase 4 — Readiness Validation (Weeks 11–12). Re-review of remediated controls; validation of evidence sufficiency; mock-assessment interviews for ________ selected controls; delivery of the Readiness Completion Report.

Advisory hours beyond the amount in Phase 3 are available at $________ per hour under a Change Order. Phase weeks above are the standard schedule and are adjusted to the estimated duration stated on page 1.

4. Deliverables

Deliverables are licensed to Customer under Terms §7.3. Deliverables are point-in-time and informational (Terms §10.6) and are not certifications, attestations or legal advice (Terms §10.1, §10.7).

5. Assumptions

The fixed fee and schedule assume that:

1. Scope, boundary and size are as stated in Section 2; material changes require a Change Order.
2. Customer's environment consists primarily of ☐ Microsoft 365 commercial ☐ Microsoft 365 GCC ☐ Microsoft 365 GCC High ☐ Azure ☐ AWS ☐ on-premises ☐ other: ________, and supported integrations listed in the Documentation.
3. Customer has, or will procure separately, the technical controls required by the framework (for example, MFA, endpoint protection, logging, encryption); AccuSights advises on and validates configuration but does not procure, license, install or operate technology unless listed in Section 3.
4. Customer will provide requested evidence and questionnaire responses within five (5) business days of request, and will make personnel available for interviews within ten (10) business days of request.
5. Interviews and meetings are conducted remotely during AccuSights business hours (Central Time). On-site work, if any, is listed in Section 8 with travel billed at cost.
6. AccuSights relies on the accuracy of Customer-provided information without independent verification except where validation is expressly part of Phase 4 (Terms §12.2).
7. The Project addresses the framework version(s) and assessment guides current at the SOW Effective Date; changes published after that date are handled by Change Order.
8. No CUI or PHI will be provided to AccuSights except as elected in Section 2.

6. Customer Dependencies and Evidence Responsibilities

Customer will:

1. Designate a Project sponsor with decision-making authority and a Project lead available at least four (4) hours per week.
2. Provide accurate and complete asset inventories, network diagrams, data-flow diagrams, existing policies, prior assessment results and vendor lists at kickoff.
3. Own, produce, collect and upload evidence to the Platform for each control; AccuSights will advise on what evidence is sufficient but does not create evidence of Customer's operating effectiveness.
4. Own and implement all remediation tasks, including configuration changes, procurement and staffing, within the target dates in the POA&M, or record a Risk Acceptance (Terms §12.4).
5. Grant read-only or appropriately scoped access to in-scope cloud tenants and tools for evidence collection, and confirm that it has authority to grant such access (Terms §7.5).
6. Review and approve or reject each Deliverable within the acceptance period in Section 9.
7. Select, engage and pay its own C3PAO, auditor, QSA, certification body or assessor independently of AccuSights (Terms §10.5), and, for CMMC, designate its own Affirming Official and submit its own SPRS score and affirmations (Terms §10.3).

Delays caused by Customer dependencies extend the schedule day-for-day and, if they exceed thirty (30) days in aggregate, entitle AccuSights to a Change Order for re-mobilization at $________ and to invoice the next milestone.

7. Milestones and Fees

Fees are invoiced on the milestone trigger and payable net 30 (Terms §6.2), exclusive of Taxes (Terms §6.8). Expenses: ☐ none ☐ pre-approved travel at cost, not to exceed $________. Platform subscription fees, if any, are on the Order Form, not this SOW.

8. Out of Scope

Unless added by Change Order, the following are out of scope:

• Conducting or participating in the formal assessment, audit or attestation; serving as assessor, auditor of record, QSA or certification body; and (for CMMC) any participation in a Level 2 certification assessment for Customer within three years of this engagement (Terms §10.3(c)).
• Signing, submitting or affirming SPRS scores, CMMC affirmations, SOC management assertions, PCI AOCs, HIPAA breach determinations or any regulatory filing.
• Implementation, installation, configuration or operation of hardware, software, cloud services or controls; procurement of licenses; managed IT services.
• Security monitoring, detection, incident response, penetration testing or vulnerability scanning beyond the assessment activities in Section 3 (Protect Offerings are available only from AccuSights LLC).
• Legal advice, contract interpretation of Customer's government or customer contracts, or determinations of whether a framework applies to Customer.
• Entities, locations, systems, tenants or frameworks not listed in Section 2; scope growth exceeding ten percent (10%) of the size stated in Section 2.
• Remediation of findings from the formal assessment beyond the Readiness Re-Performance Commitment (Section 11).
• Training beyond the readout in D6; staff augmentation; data migration; CUI enclave build-out.

9. Acceptance

Each Deliverable is deemed accepted on the earlier of (a) Customer's written acceptance, or (b) ten (10) business days after delivery, unless within that period Customer delivers a written rejection identifying, in reasonable detail, the specific material nonconformity with this SOW. AccuSights will correct a properly identified nonconformity and redeliver, and the same acceptance process applies to the redelivery, limited to the identified nonconformity. Use of a Deliverable in Customer's compliance program or provision of it to an assessor constitutes acceptance. Acceptance is not withheld for matters of preference or for items outside Section 3 and 4.

10. Change Orders

Either party may request a change to scope, schedule, assumptions or Deliverables. AccuSights will provide a written change order describing the change and its effect on fees and schedule (a "Change Order"). No change is effective, and AccuSights has no obligation to perform it, until the Change Order is accepted by both parties in the Platform or in writing. Work performed at Customer's request outside this SOW without an accepted Change Order is billable at AccuSights' then-current rates.

11. Readiness Re-Performance Commitment

The Readiness Re-Performance Commitment in Terms §11 applies to this Project with respect to controls marked "Ready" in the Readiness Completion Report (D5), for six (6) months after its delivery, subject to the conditions and exclusions in Terms §11.2 and §11.5. Re-performance is Customer's sole and exclusive remedy for any assessment outcome (Terms §11.4). This SOW does not guarantee any certification, attestation, score or assessment result.

12. Project Governance

Weekly status calls; a shared Project plan and task tracker in the Platform; escalation first to the AccuSights engagement lead, then to Kashmala Khalid, Managing Partner ([email protected]), and Customer's Project sponsor. Either party may replace its personnel on notice; AccuSights will use reasonable efforts to maintain continuity.

13. Term and Termination

This SOW begins on the SOW Effective Date and ends on acceptance of D5 and payment of all fees, unless earlier terminated under Terms §17. If Customer terminates for convenience (which requires AccuSights' written consent), or AccuSights terminates for Customer's uncured breach, Customer will pay for all milestones reached and, for the milestone in progress, a pro-rata portion based on work performed.

14. Signatures

Executed in the AccuSights Platform (E-SIGN / UETA electronic signature); DocuSign fallback per the Order Form.

Annex A — Control Families and Policy Set

Annex B — Evidence Request Schedule (summary)