Excluded Services & Minimum Standards

Excluded Services

The following are not included under the Managed Services SOW and are subject to AdVran's then-current time and materials rates.

A Statement of Work may expressly include an item listed below. Where a Statement of Work does so, that Statement of Work controls for that engagement. Absent express inclusion in the applicable Statement of Work, the item is excluded.

• Any service not specifically identified as included under this SOW.
• Parts, equipment, or software not covered by vendor/manufacturer warranty or support.
• The cost of any software, licensing, or software renewal or upgrade fees.
• The cost of any 3rd party vendor or manufacturer support or incident fees.
• The cost to bring Customer's environment up to minimum standards required for services.
• Maintenance of application software packages, whether acquired from Company or any other source.
• Data restoration due to failed hardware or software corruption that is not covered by BDR Service (e.g. data that does not reside on covered workstations/servers).
• Any response to or remediation of an identified security incident (ransomware, business email compromise, data exfiltration, etc.).
• Projects (Moves, Adds, Changes): Any project work, including but not limited to: office moves, operating system migrations, installation of new servers/networking equipment. Project work requires a separate SOW agreed upon between the Client and MSP.
• Physical Layer/Cabling: Modifications to structure/physical cabling (e.g, replacing/running network cables throughout walls or ceilings).

Suitability of Existing Environment

• All operating systems, from any vendor, running on servers, desktops, laptops, virtual machines, and network appliances must be running a version that is within the vendor's supported lifecycle and still receiving security updates, and must have all current security updates installed.
• Hardware and software must not be end-of-sale or end-of-life. Replaceable parts must be reasonably available.
• All software must be genuine, properly licensed and vendor-supported.
• The entire IT environment must have a currently licensed, up-to-date, and vendor-supported server-based antivirus or EDR solution protecting all servers, desktops, laptops, and email.
• The environment must have a currently licensed, vendor-supported server-based backup solution.
• The environment must have a currently licensed, vendor-supported firewall between the internal network and the Internet.
• Any wireless data traffic in the LAN environment must be encrypted with industry standard, enterprise-level encryption.

Compliance with Minimum Standards

The Services provided under a Managed Services SOW are the ongoing, steady-state management of an environment that meets the Standards above. Bringing an environment into compliance with those Standards is not steady-state management. It is project work, and it is not included in any recurring fee.

AdVran will take on an environment that does not meet these Standards. Where AdVran agrees to do so:

• The deficiencies are identified and recorded in the applicable Statement of Work.
• Customer acknowledges that bringing those deficiencies into compliance is a condition of AdVran's continued provision of Services.
• Remediation is at Customer's cost and is scoped and quoted separately from any recurring fee.
• Until an item is remediated, AdVran may exclude it from the Services and from any service level objective, and gives no warranty as to any outcome arising from or affected by that item.

Where a deficiency arises after Services commence, AdVran will notify Customer in writing, identifying the item and the deficiency. Customer shall remediate within thirty (30) days of that notice, or immediately where the deficiency presents an active security risk - including an unsupported operating system reachable from an untrusted network, absent or disabled endpoint protection, absent multi-factor authentication on administrative or remote access, an unauthenticated service reachable from the Internet, or a known-exploited vulnerability.

Where an item remains non-compliant beyond the applicable period, AdVran may suspend Services to that item without relief from fees. Repeated or systemic non-compliance is a material breach.

Project Work

Project work is any work that changes the environment rather than maintains it. It includes remediation of the conditions described above, moves, adds and changes, operating system and platform migrations, installation of new servers or network equipment, and redesigns.

Project work is not included in any recurring fee. It requires a separate Statement of Work, scoped and priced for the specific work to be performed.