These Service Terms apply to cybersecurity and firewall management services provided by Spider Consulting Services, LLC ("Spider Consulting" or "Provider"). They are part of the Agreement together with the Order and the Master Service Terms. Capitalized terms not defined here have the meanings in the Master Service Terms. These Service Terms supplement the Master Service Terms and, where stated, override the Master Service Terms defaults; anything they do not address is governed by the Master Service Terms, and an Order may override both as described in Section 3.2 of the Master Service Terms.
1. Services
1.1 Scope. Spider Consulting provides ongoing assistance with Client's existing cybersecurity and firewall management environments, specializing in Palo Alto Networks products (the "Consulting Services"). Depending on the Order, the Consulting Services may include:
- security and firewall assessments;
- implementations and initial setup;
- maintenance, upgrades, and troubleshooting;
- day-to-day management, monitoring, and tuning; and
- general cybersecurity guidance.
1.2 In-scope environment. The Order identifies the systems, devices, and sites covered (the "In-Scope Environment"). Work outside the In-Scope Environment requires a change request under Section 6.
1.3 Advice and decisions. Provider gives recommendations based on information available at the time. Client makes the final decisions about its security program, policies, and risk acceptance. Assessments are point-in-time reviews and may not identify every vulnerability.
2. Reserved Hours
2.1 Reserved Hours. The Order states the number of hours Provider reserves for Client each calendar month, up to a maximum of forty (40) hours per month ("Reserved Hours"). Reserved Hours have guaranteed availability each month. Provider does not overbook Reserved Hours: time reserved for Client is held for Client and not sold to other clients.
2.2 Rates. Spider Consulting does not publish rates. Rates are negotiated for each client or project, and Reserved Hours and Flex Hours are billed at the rates stated in your Order. This overrides the default rate provision in Section 4.1 of the Master Service Terms.
2.3 Prepaid and non-refundable. Reserved Hours are billed monthly in advance at the rates stated in your Order. Reserved Hours are prepaid and non-refundable, whether or not Client uses them.
2.4 No carryover, except Provider rescheduling. Unused Reserved Hours expire at the end of the calendar month and do not carry over to the next month. The only exception is Reserved Hours affected when Provider needs to reschedule booked or reserved time; those hours carry over as described in Section 3.5.
2.5 How time is counted. Time is recorded in increments of [BILLING INCREMENT, E.G., 15 MINUTES] and includes remote and on-site work, meetings, research, documentation, and reporting performed for Client. Travel time and expenses for on-site work are [TRAVEL POLICY]. Provider will make a monthly summary of time used available to Client.
3. Booking time
3.1 Pre-booking. Client may schedule some or all Reserved Hours in advance for the month (for example, a recurring weekly block).
3.2 As-needed booking. Client may book Reserved Hours as needed with at least twenty-four (24) hours' notice. Provider will try to accommodate shorter notice, but does not guarantee it.
3.3 How to book. Bookings are made through [BOOKING METHOD, E.G., CLIENT PORTAL, EMAIL, OR PHONE].
3.4 Client cancellations. If Client cancels or reschedules a booked session with less than [CANCELLATION NOTICE, E.G., 24] hours' notice, or is unavailable at the scheduled time, the booked time [COUNTS AS USED / MAY BE RESCHEDULED WITHIN THE SAME MONTH AT PROVIDER'S DISCRETION]. [CONFIRM: LATE CANCELLATION RULE]
3.5 Provider rescheduling. If Provider needs to reschedule booked or reserved time, it will offer a replacement time within the same month where possible. Any affected Reserved Hours that are not provided in that month carry over to the following month.
3.6 Rescheduled hours when an Order ends. If Reserved Hours affected by Provider rescheduling under Section 3.5 remain unused when an Order ends or expires, Provider will, at its option and in consultation with Client, either (a) extend the Order for up to thirty (30) days solely to provide those hours, or (b) issue a credit for those hours toward a future project or Order, valid for twelve (12) months after issue. These hours are not refunded in cash. Any of these hours still unused at the end of a thirty (30) day extension expire unless Provider converts them to a credit under (b).
4. Flex Hours
4.1 Additional time. If Client needs more time than its Reserved Hours, Client may request additional hours ("Flex Hours"). Flex Hours are made available in blocks of up to forty (40) hours.
4.2 Subject to availability. Flex Hours are subject to Provider's availability and are not guaranteed. Provider will not reduce another client's Reserved Hours to provide Flex Hours.
4.3 Post-paid, actual hours only. Flex Hours are post-paid and invoiced monthly in arrears, at the rates stated in your Order, only for the Flex Hours actually used, up to the forty (40) hours in the approved block. Client is not charged for unused Flex Hours in a block. Using more than forty (40) Flex Hours requires approval of a new block.
4.4 Approval. Provider will not start using Flex Hours without Client's approval, which may be given in advance (for example, a standing authorization for urgent incidents) or per request by email.
4.5 Unused Flex Hours carry over. Unused Flex Hours in an approved block do not expire at the end of the month. They carry over from month to month and remain available while the Order remains in effect (including any renewal term). Carried-over Flex Hours are billed only if and when used and remain subject to Section 4.2.
5. Term
5.1 Each Order for Consulting Services has a term of up to twelve (12) months, as stated in the Order. Renewal and termination are governed by Section 6 of the Master Service Terms.
5.2 If an Order ends mid-month, Reserved Hours for that month are not prorated or refunded. Reserved Hours affected by Provider rescheduling are instead handled under Section 3.6.
6. Change requests
6.1 Either party may propose changes to the scope, In-Scope Environment, number of Reserved Hours, or deliverables. Changes take effect only when documented in a change order or amended Order accepted by both parties.
6.2 Small, in-scope adjustments that fit within Client's Reserved Hours do not require a change order, but Provider may ask Client to confirm them by email.
6.3 Changes to the number of Reserved Hours take effect at the start of the next calendar month.
7. Client access, credentials, and changes
7.1 Access. Client will provide the access Provider needs, such as administrator accounts, VPN or remote access, and console access, for the In-Scope Environment. Client should create named, dedicated accounts for Provider with the least privilege required, protected with multi-factor authentication.
7.2 Credential handling. Provider will use credentials only for the Consulting Services, store them in encrypted form, and not share them outside the personnel assigned to Client. Client will disable or rotate credentials issued to Provider when an Order ends, and Provider will delete its copies.
7.3 Change control. Provider will follow Client's reasonable change-control process if Client provides one. Before making significant configuration changes, Provider will back up the existing configuration where the platform allows. Client is responsible for approving changes that may affect business operations, and for scheduling maintenance windows.
7.4 Changes by others. Provider is not responsible for changes made to the In-Scope Environment by Client or third parties, or for issues those changes cause. Time spent investigating or correcting them is billable against Reserved Hours or Flex Hours.
7.5 Logs and data. In performing the Consulting Services, Provider may view logs and configuration data that include personal information about Client's users. Provider handles that information as Client's service provider/processor under the Master Service Terms and the Privacy Policy.
8. Palo Alto Networks and other vendor products
8.1 Third-party products. Palo Alto Networks hardware, software, subscriptions, and cloud services, and any other vendor products in Client's environment, are third-party products under Section 11 of the Master Service Terms. They are governed by the vendor's terms, warranties, and end-user license agreements.
8.2 Licenses and support. Unless the Order says otherwise, Client is responsible for purchasing and maintaining valid licenses, subscriptions, and vendor support contracts. Some work (for example, hardware replacement or software defects) may require the vendor's support, and Provider can open and manage vendor cases on Client's behalf where Client's support contract permits.
8.3 No affiliation. Palo Alto Networks is a trademark of Palo Alto Networks, Inc. Spider Consulting is an independent service provider and is not an agent of, or endorsed by, Palo Alto Networks unless otherwise stated. [CONFIRM: ANY PALO ALTO NETWORKS PARTNER STATUS]
8.4 Vendor issues. Provider is not responsible for product defects, vulnerabilities, end-of-life decisions, outages of vendor cloud services, or license changes made by vendors, though Provider will help Client respond to them within the Consulting Services.
9. Deliverables
Reports, assessments, configuration documentation, and recommendations prepared for Client are licensed to Client under Section 10.3 of the Master Service Terms and are Client's Confidential Information.
10. Payment and late payment
This Section 10 states the payment and late-payment terms for Consulting Services. For Consulting Services it overrides Sections 4.3 and 4.5 of the Master Service Terms where they conflict. Anything this Section 10 does not address (including the invoice dispute process in Section 4.4 of the Master Service Terms and Client's responsibility for reasonable collection costs under Section 4.5 of the Master Service Terms) remains governed by the Master Service Terms, and an Order may override this Section 10 as described in Section 3.2 of the Master Service Terms.
10.1 Reserved Hours are prepaid. Invoices for Reserved Hours must be paid before the hours become available. Reserved Hours cannot be booked, and work under them does not begin, until Provider receives payment.
10.2 No late charges or suspension of paid Reserved Hours. Because Reserved Hours are prepaid, late charges do not apply to Reserved Hours. The suspension provisions in Section 4.5 of the Master Service Terms do not permit Provider to stop delivering Reserved Hours that Client has already paid for. Paid Reserved Hours continue even if a Flex Hours invoice is past due.
10.3 Flex Hours follow the Master Service Terms defaults. Flex Hours are post-paid and invoiced for the Flex Hours actually used (Section 4.3 of these Service Terms). Flex Hours invoices are due upon receipt. Any undisputed amount not paid within fifteen (15) days after its due date is past due, and past-due amounts accrue a late charge of 1.5% per month, or the maximum rate permitted by law if lower, from the date they become past due until paid.
10.4 Pause of Flex Hours. If any undisputed amount on a Flex Hours invoice remains unpaid thirty (30) days after its due date, Provider may, after giving Client at least five (5) business days' written notice, pause Flex Hours work until all past-due amounts are paid. A pause applies only to Flex Hours; paid Reserved Hours continue under Section 10.2.
10.5 Carryover unaffected. A pause does not affect the carryover of unused Flex Hours under Section 4.5 of these Service Terms. Unused Flex Hours in an approved block remain available when Flex Hours work resumes.