Skip to content

Legal Exhibit B — vCISO Service Schedule

AccuSights LLC

Exhibit B — vCISO Service Schedule

Version 2026.10 · Effective November 1, 2026 · Download the PDF (Exhibits A to C in one file)

Contents (5 sections)

© 2026 AccuSights LLC. All rights reserved.

This Exhibit B is incorporated into the AccuSights Protect Services Agreement (the "Agreement") and applies only if a vCISO package is ordered in an Order Form. Capitalized terms have the meanings in the Agreement. Section 9 of the Agreement governs the vCISO Services and controls over this Exhibit.

B-1. Packages

All packages are delivered remotely by a named lead vCISO with support from AccuSights' advisory team. Hours are monthly allocations of advisory time, including meetings, document preparation, review and correspondence. Package prices and the hourly overage rate are stated on the Order Form.

vCISO Advisory vCISO Program vCISO Executive
Monthly hours 8 hours / month 16 hours / month 32 hours / month
Monthly fee As stated on the Order Form As stated on the Order Form As stated on the Order Form
Typical fit Businesses that need a standing security advisor, policy owner and a quarterly leadership briefing Businesses building or maturing a security program against a framework (CMMC, HIPAA, SOC 2, ISO 27001, PCI DSS) with audit or assessment ahead Regulated or multi-site businesses needing near-weekly executive engagement, board reporting and vendor/customer-facing security leadership support
Cadence Monthly working session (60 min) + ad hoc Bi-weekly working sessions + monthly leadership check-in Weekly working sessions + monthly leadership briefing + quarterly board/owner briefing
Roll-over Unused hours do not roll over Unused hours do not roll over Unused hours do not roll over
Overage Hourly rate stated on the Order Form, pre-approved by an Authorized Contact Hourly rate stated on the Order Form, pre-approved by an Authorized Contact Hourly rate stated on the Order Form, pre-approved by an Authorized Contact
Term Annual plan (12 months) or monthly plan, as stated on the Order Form (Agreement §15.2) Annual plan (12 months) or monthly plan, as stated on the Order Form (Agreement §15.2) Annual plan (12 months) or monthly plan, as stated on the Order Form (Agreement §15.2)
Requires Protect subscription? No; may be ordered with or without Protect No; may be ordered with or without Protect No; may be ordered with or without Protect

Hours are tracked in the Portal and reported monthly. Time is recorded in 15-minute increments. Travel, if requested and approved, is billed at hourly rates plus expenses.

B-2. Deliverables by package

Deliverables are recommendations and work product for Customer's internal use (Agreement §§9.5, 9.7). Frequency shown is the default; Customer may re-prioritize within the monthly hours.

Deliverable Advisory Program Executive
Security program roadmap — 12-month prioritized plan mapped to Customer's chosen framework(s), with owners, effort estimates and dependencies Annual (light) Annual, reviewed quarterly Annual, reviewed monthly
Risk register — maintained list of identified risks, likelihood/impact ratings, treatment decisions and open Risk Acceptances (Agreement §10) Reviewed quarterly Reviewed monthly Reviewed monthly
Policy review and drafting — review of existing policies; drafting or updating from AccuSights templates (information security, acceptable use, access control, incident response, backup, vendor management, etc.) Up to 4 policies / year Up to 10 policies / year Full policy set maintained
Leadership / board briefing — written summary and live presentation of posture, incidents, risk trends, roadmap status and budget needs Quarterly (written) Quarterly (written + live) Monthly written; quarterly live board/owner briefing
Vendor and third-party risk — questionnaire review, risk tiering, contract security-clause guidance for Customer's key vendors Up to 5 vendors / year Up to 15 vendors / year Ongoing, up to 30 vendors / year
Customer / prime security questionnaire support — drafting responses for Customer's officers to review, approve and sign Up to 2 / year Up to 6 / year Ongoing
Incident response plan — plan development or refresh aligned to Protect Response Modes and Playbooks Review only Develop or refresh annually Develop or refresh annually
Tabletop exercise — facilitated scenario exercise for leadership and IT, with after-action report Not included (add-on) Annual Semi-annual
Audit and assessment support — readiness planning, evidence organization, assessor-liaison coaching, remediation tracking (preparatory only; Agreement §9.9) Not included (add-on) Included for one framework / year Included for up to two frameworks / year
Cyber-insurance application support — assistance preparing control information for Customer's broker; Customer's officer signs Included Included Included
Security awareness program oversight — review of Protect training results, targeted campaigns Included Included Included
Budget and staffing guidance — security spend benchmarking, tooling rationalization, hiring profiles On request within hours Annual Semi-annual
Metrics dashboard — KPI set (Agent coverage, MFA, patch compliance, phishing rate, open risks) reported monthly — Included Included
Executive representation — participation in Customer's leadership meetings, customer or prime security calls, and regulator or auditor meetings as Customer's advisor (never as Customer's officer or signatory) Not included Up to 2 events / quarter Up to 2 events / month

B-3. Exclusions

The vCISO Services do not include, and AccuSights will not perform under a vCISO package:

  1. Acting as Customer's HIPAA Security Official or Privacy Official, CMMC Affirming Official, SEC disclosure signatory, Data Protection Officer, PCI responsible officer, 23 NYCRR 500 / FTC Safeguards "Qualified Individual," or any other statutory, regulatory, contractual or fiduciary role (Agreement §9.3).
  2. Signing, certifying, attesting, affirming, submitting or filing any assessment, self-assessment, SPRS score, attestation of compliance, regulatory filing, insurance application, security questionnaire, contract representation or public statement (Agreement §9.4).
  3. Legal advice, legal opinions or interpretation of law for Customer; Customer should consult its own counsel.
  4. Audit, attestation or certification services (SOC 2, ISO 27001, PCI ROC, CMMC certification assessment), or participation in Customer's CMMC Level 2 certification assessment within three years of consulting (Agreement §9.9).
  5. Hands-on engineering, system administration, configuration changes, patching or implementation of controls on Customer's systems (available from AccuSights or Customer's MSP under separate scope).
  6. Incident response operations, forensic investigation, breach notification, or crisis communications (see Exhibit A add-ons and Customer's cyber-insurance carrier); the vCISO may advise Customer's incident commander within package hours.
  7. Penetration testing, red-team exercises, code review or application security testing.
  8. Compliance-readiness projects, evidence collection platforms and continuous-compliance subscriptions offered by AccuSights, Inc. (Assess, Comply, CMMC Accelerator), which are ordered separately from AccuSights, Inc.
  9. Supervision, management, hiring, discipline or performance review of Customer personnel; approval of Customer expenditures; or execution of contracts on Customer's behalf.
  10. Services to Customer's affiliates, customers or partners, unless named in the Order Form.
  11. On-site attendance, unless ordered and billed separately.
  12. Any guarantee that Customer will be free of security incidents, will pass any audit or assessment, or is or will be compliant with any law, regulation or framework (Agreement §12.3).

B-4. Working assumptions

  • Customer designates an executive sponsor and an internal point of contact with authority to schedule sessions, provide information and make decisions.
  • Customer provides timely access to documents, systems (read-only where required), personnel and its Customer's MSP.
  • AccuSights may use its templates, tools and AI-assisted drafting to produce deliverables; all deliverables are reviewed by the lead vCISO before delivery. AI outputs are reviewed by AccuSights personnel and may be inaccurate; Customer's management reviews before adoption.
  • Sessions are held remotely by video during Business Hours (8:00 a.m.–5:00 p.m. Central Time, Monday–Friday).
  • Package changes (upgrade at any time; downgrade at renewal) are made by Order Form addendum.

B-5. Acknowledgments (short form, for signature with the Order Form)

Customer's signatory confirms, on behalf of Customer, that Customer understands and agrees:

  1. Advisory only. The vCISO Services are advice and recommendations. Customer's management decides what to adopt, fund and implement, and is responsible for the outcome. (Agreement §§9.2, 9.5)
  2. Not an officer or employee. The vCISO is not Customer's officer, director, employee or agent, holds no corporate office, and has no authority to bind Customer or direct its personnel. The "CISO" title is descriptive of the service only. (Agreement §9.2)
  3. Not a statutory role. The vCISO is not Customer's HIPAA Security Official, CMMC Affirming Official, DPO, SEC disclosure signatory or any other statutory or regulatory official, unless a named individual separately accepts such a role in a signed Order Form. (Agreement §9.3)
  4. No signing or attesting. The vCISO will not sign, certify, attest to, affirm, submit or file any assessment, score, filing, questionnaire or public statement on Customer's behalf. (Agreement §9.4)
  5. No fiduciary duty; no third-party reliance. No fiduciary relationship is created, and no third party may rely on vCISO deliverables. Customer will not hold AccuSights out as having certified or assumed responsibility for its security or compliance. (Agreement §§9.6, 9.7)
  6. Not a certifier. AccuSights is not a C3PAO, auditor, CPA firm, QSA or certification body and does not guarantee any audit, assessment or compliance outcome. (Agreement §9.9)
  7. Non-exclusive. AccuSights may serve other clients, including Customer's competitors. (Agreement §9.8)
  8. Liability. The Limitation of Liability in Section 13 of the Agreement applies to the vCISO Services, measured against vCISO Fees (the greater of the vCISO fees paid in the prior 12 months and $1,000).
  9. Hours. Unused hours do not roll over; hours beyond the monthly allocation are billed at the hourly rate on the Order Form.

☐ I acknowledge the vCISO terms above on behalf of Customer.

Initials: ________ Name: ______________________ Title: ______________________ Date/time (UTC): ______________________

E-signature record: Signer ID ________ · IP ________ · Acknowledgment checkbox ID VCISO-2026.10 · SHA-256 ________