Professional Services Schedule

Managed vCISO and advisory engagements

1. What this Schedule is, and how it fits with the Terms

This Schedule sets out the terms on which CyberWave provides Professional Services. These are advisory work performed by people, as distinct from access to the Sentinel platform, which the Terms of Service govern. It applies to Managed vCISO Lite, Managed vCISO, the Cyber Insurance Submission Pack and any other advisory or service item CyberWave agrees to perform.

CyberWave is CYBER WAVE INC., an Ontario corporation (Ontario Corporation Number 1000780137), located in Markham, Ontario, Canada.

Three points of construction decide every later question.

1. This Schedule is part of the Agreement and is subordinate to the Terms. Terms §40.2 ranks the Terms above it, so where the two conflict the Terms prevail. This Schedule adds detail; it does not override.
2. A signed Statement of Work prevails over both, for what it covers (Terms §40.2, rank 1), with one exception: Terms §32 always applies, and Professional Services Fees and subscription Fees count towards the same single liability cap.
3. Capitalised terms carry the meanings given in the Terms unless defined differently below. Nothing here creates a separate contract or a separate contracting party.

2. Definitions

"Advisor": the CyberWave individual assigned to the Customer's Engagement.

"Advisory Session": a scheduled, pre-arranged working meeting between the Advisor and the Customer's personnel, held remotely unless an SOW provides otherwise.

"Deliverable": a written work product CyberWave prepares for the Customer under an Engagement and issues to it as a Deliverable. Section 8 says what is and is not one.

"Engagement": the Professional Services purchased, whether as part of a Plan or under an SOW.

"Professional Services": advisory, review, reporting-support and service-item work performed by CyberWave personnel.

"Roadmap": a prioritised, sequenced set of recommendations prepared for the Customer.

"Statement of Work" or "SOW": a document signed by both parties describing an Engagement.

3. What CyberWave offers, and how scope is agreed

Amounts are in US dollars and exclude taxes. Annual amounts are the published annual totals charged, stated rather than derived from the monthly amount. "From $2,499" means an Engagement starts at that monthly amount and is scoped in an SOW. Additional user seats are priced under Terms §5.2.

A Statement of Work states scope, Deliverables, the assumptions relied on, schedule, Customer dependencies, fees and invoicing basis, term, and any review process. If a term is not in the SOW, it is not part of the Engagement.

4. The advisory model: CyberWave advises, the Customer decides

Managed vCISO is an advisory service. An Advisor advises; the Customer decides, approves and implements. The Customer's management retains decision authority and remains accountable for what it decides. That includes risk acceptance, control implementation, policy approval, remediation priorities, regulatory filings, and what it presents to an auditor, insurer, broker, regulator or customer.

By performing Professional Services, no CyberWave Advisor:

• becomes an officer, director, employee or agent of the Customer;
• occupies or assumes a statutory, fiduciary or regulatory office the Customer is required to fill;
• accepts a duty the Customer owes to a third party; or
• acquires authority to approve, sign, certify or commit the Customer to anything.

Recommendations are professional opinions based on the information the Customer makes available. They are not certifications, audit conclusions, attestations, legal opinions or insurance advice. Terms §27 and §28 apply in full:

• CyberWave does not certify compliance, issue audit opinions, guarantee compliance, or replace independent auditors, certification bodies or legal counsel.
• CyberWave is not an insurer or an insurance broker, does not bind coverage, and does not guarantee coverage, premium reduction, insurer acceptance or any claim outcome.

The Cyber Insurance Readiness Disclaimer also applies.

5. What is NOT included — read this section

The following are excluded from every Engagement, and CyberWave does not provide them. Purchasing Managed vCISO Lite or Managed vCISO does not obtain any of them.

Two more exclusions follow from the same boundary:

• Technical security testing. Professional Services do not include penetration testing, vulnerability scanning, red-teaming or configuration auditing.
• Remediation. CyberWave advises what to fix and in what order. The Customer, or a provider it engages, does the fixing.

Because emergency response is excluded, the Customer should have its own incident response arrangements in place. This is a real gap, not a formality, and it is better closed before an incident than during one.

6. Customer cooperation and dependencies

Professional Services depend on the Customer. CyberWave will use reasonable skill and care, but cannot perform unless the Customer provides the following in good time:

• accurate and reasonably complete information about its environment, obligations and programme;
• access to the people who hold that information, and to someone with authority to decide;
• decisions and approvals when the work needs one;
• a designated contact who can coordinate scheduling and internal follow-through; and
• where an SOW requires it, access to a system or document set under the Customer's own access controls.

CyberWave is not responsible for a delay, a reduced Deliverable or an unachieved outcome caused by the absence of any of the above. Time spent waiting is not made up later unless CyberWave agrees in writing.

CyberWave does not verify what the Customer provides (Terms §11.4). Where the input is wrong or incomplete, the advice built on it will be too. An Advisor works from the records the Customer keeps and does not investigate them independently.

7. Advisory Sessions and cadence

Advisory Sessions are scheduled by agreement in advance, held remotely, and conducted in English. Each Engagement has an agreed cadence:

• Managed vCISO Lite: the cadence agreed between CyberWave and the Customer when the plan is purchased.
• Managed vCISO: the cadence stated in the SOW.

This Schedule contains no response-time commitment, no availability commitment and no service credit. Terms §30.3 applies: any such commitment exists only if an Order Form or SOW states it.

8. Deliverables, and what a Deliverable is

A Deliverable is a written work product CyberWave prepares for the Customer and issues to it as a Deliverable. Typical Deliverables are a written risk or readiness review, a Roadmap, a board or executive reporting pack, a policy or programme document, and the Cyber Insurance Submission Pack.

The following are not Deliverables, and no obligation attaches to them as though they were:

• discussion in an Advisory Session;
• a verbal recommendation;
• notes, slides or unfinished working documents exchanged during the work;
• email correspondence;
• a report the Customer generates itself in the platform; and
• any AI Feature output the Customer produces.

Platform output is governed by the Terms and the AI Features & Data Use Notice. Where CyberWave uses AI assistance in preparing a Deliverable, the Advisor reviews it before issue and the Deliverable remains CyberWave's work.

Deliverables are not subject to acceptance testing. A request for something the agreed scope did not include is a new Engagement. Where a Deliverable is affected by a failure to meet the performance standard, section 13 applies.

9. Roadmaps

A Roadmap is a planning artefact: recommendations, a suggested order of work, and indicative timing based on what the Customer has said about its resources and constraints.

A Roadmap is not:

• a commitment by CyberWave to perform the work in it;
• a project plan CyberWave manages or executes;
• a fixed-date schedule;
• an estimate of third-party cost; or
• a representation that completing it produces compliance, certification, insurance coverage, a particular premium or immunity from a security incident.

Dates and sequencing depend on the Customer's own resourcing and decisions. The Customer owns delivery.

10. Risk discussions

The Advisor reviews the Customer's risk register with it. The Advisor discusses how risks are described, rated, owned and treated, and identifies risks the Customer may not have recorded. That is advisory input to the Customer's own risk process.

Risk acceptance is the Customer's decision and cannot be delegated to CyberWave. A rating reached in discussion with an Advisor remains the Customer's rating.

A risk discussion is not a quantified risk assessment, a financial loss model or a technical security assessment. Nor is it a statement that the risks discussed are all the risks the Customer has. It reflects the information available in the session, and its value is limited by that information.

11. Executive and board reporting support

On Managed vCISO Lite, the Advisor helps the Customer prepare and interpret executive reporting:

• what to report;
• how to frame readiness and risk for a non-technical audience; and
• how to use the reporting the platform produces.

Attendance at a board or committee meeting is not included in Managed vCISO Lite. Stakeholder and board engagement is available under Managed vCISO, as scoped in the SOW.

The Customer's officers and directors remain responsible for what they report, approve and file. CyberWave does not sign, certify or attest to a report given to a board, auditor, insurer, regulator or customer. It does not report to the Customer's board in its own right.

12. Service boundaries

Personnel. CyberWave assigns the Advisor and determines the manner, means and personnel used. It may replace an Advisor with a person of comparable experience and will tell the Customer when it does. Naming an Advisor is not a guarantee that a specific individual remains available for the term.

Independent contractor. The parties are independent contractors; Terms §42 governs. No partnership, joint venture, employment, agency or fiduciary relationship arises, and neither party may bind the other.

Subcontracting. CyberWave may use a subcontractor and remains responsible for the work. A subcontractor who may access Customer Personal Information is engaged under the Data Processing Addendum (the DPA). The Subprocessor List and the change-notice process in DPA section 8 apply.

No exclusivity. CyberWave may advise other customers, including customers in the same industry. Section 15 protects the Customer here.

No third-party reliance. Professional Services are for the Customer's internal use. A Deliverable may be shared with the Customer's advisers, auditors, brokers, insurers and customers. CyberWave owes no duty to them and accepts no liability to them. It does not consent to anyone relying on a Deliverable as though CyberWave had been engaged by them.

Language. Delivery is in English. Where Applicable Law requires French for a particular Customer, Terms §2.5 applies.

13. Performance standard

CyberWave warrants that Professional Services will be performed in a professional and diligent manner by personnel with skills and experience appropriate to the work.

If they are not, the Customer must notify CyberWave within 30 days of the affected work, with enough detail to identify the failure. CyberWave will then re-perform the affected Professional Services. That is the Customer's sole remedy and CyberWave's entire liability for breach of this section. This does not limit Terms §31 or §32.

14. Fees, order terms and expenses

14.1 Fees.

• Managed vCISO Lite is purchased through a sales conversation with CyberWave. It is charged in advance at the published price for the billing frequency chosen ($999 per month or $11,388.60 per year) and renews under Terms §9.
• Managed vCISO is charged as the SOW states.
• The Cyber Insurance Submission Pack is a one-time $499 fee, invoiced as agreed.

All amounts are in US dollars and exclude taxes. Taxes are addressed in Terms §8.3, late payment in §8.4 and disputed invoices in §8.6.

14.2 Fees are for the service, not for an outcome. Professional Services Fees are earned by performing the work. They are not contingent on an audit result, a certification, an insurance decision, a premium or a readiness score, and none of those outcomes is promised.

14.3 Refunds. Terms §8.7 governs refunds and lists every route to one. This Schedule creates no refund right that is not listed there.

14.4 Expenses. Delivery is remote and no expenses are charged by default. Travel and other out-of-pocket expenses are reimbursable only where the Customer has approved them in writing in advance. They are charged at cost, with documentation.

14.5 No free trial on advisory plans. Managed vCISO Lite, Managed vCISO and Custom carry no free trial. The 14-day free trial is available on Essentials and Full Platform only, and is a trial of the plan the Customer selects.

• No payment card is required, there is no automatic charge, and a trial does not convert to a paid subscription automatically.
• A trial is not a paid plan and includes no fees.
• Continuing after a trial means choosing a paid subscription.
• Customer Data is not deleted because a trial has ended (Terms §6.4, §25.7).

15. Confidentiality

Terms §16 governs confidentiality and applies to Professional Services in full. Advisory work concentrates sensitive information in a way platform access does not, so the following consequences are stated here.

The Customer's information. An Advisor learns where the Customer is weakest. The following are the Customer's Confidential Information: findings, gaps, unremediated risks, incident history, board discussions, and anything said in an Advisory Session. CyberWave will not disclose them or use them for any purpose other than performing the Engagement.

Statements of Work. The terms of a negotiated SOW are confidential to both parties.

CyberWave's materials. CyberWave's methodologies, templates, questionnaire libraries and framework mappings are CyberWave's Confidential Information. A Deliverable that embodies them may be used under section 16, but they must not be extracted from it or redistributed as a template.

Personal Information and publicity. Where an Advisor handles Personal Information, the DPA applies, including its section 6 on personnel. CyberWave will not name the Customer publicly as a Managed vCISO customer, or use its logo, without prior written consent (Terms §19.3).

16. Intellectual property in Deliverables

On payment of the Fees for the Engagement, a Deliverable is the Customer's property. The Customer may use, copy, modify and share it for its own internal business purposes without further permission or fee. That includes sharing it with its advisers, auditors, brokers and insurers.

CyberWave retains ownership of what it brings to the work, and of any general improvement to it, whether or not developed while performing an Engagement. That includes pre-existing materials, methodologies, framework mappings, control catalogues, questionnaire libraries, scoring and readiness methodologies, templates, tools, software and know-how.

A Deliverable carries a non-exclusive licence to use those materials as embodied in it, for the purpose it was prepared for. CyberWave may reuse its own methodologies, know-how and general learning on other engagements. This is always subject to section 15: no Customer Confidential Information, and nothing that identifies the Customer, is reused.

Customer Data remains the Customer's (Terms §12.1). Feedback is governed by Terms §20, which expressly does not capture Customer Data or Confidential Information.

17. Rescheduling and cancelling Advisory Sessions

Either party may reschedule an Advisory Session on reasonable advance notice, and both will act reasonably in finding an alternative time.

This Schedule states no forfeiture rule. CyberWave will not treat a Session as forfeited without telling the Customer in advance that it will be.

18. Term and termination

18.1 Term. A Managed vCISO Lite Engagement runs with the subscription. It begins when the subscription begins and continues for each Subscription Period until cancelled under Terms §9.2. An SOW Engagement runs for the term stated in the SOW.

18.2 Termination. Terms §23 governs termination and applies to Professional Services. Cancelling a Managed vCISO Lite subscription ends the Engagement at the end of the Subscription Period already paid for, and Advisory Sessions continue until then. Either party may terminate for the other's uncured material breach under Terms §23.2.

18.3 On termination.

• If the Customer asks, CyberWave will deliver work in progress in whatever state it has reached.
• The Customer will pay for Professional Services performed up to the effective date.
• Deliverables already paid for remain the Customer's.
• Sections 4, 5, 12, 15 and 16 survive, together with the provisions of the Terms that survive under Terms §24.2.

19. Liability, notices and contact

Terms §32 limits liability for Professional Services as it does for the subscription. There is a single aggregate cap across both (Terms §32.3). The cap, the excluded types of loss and the liabilities that are not capped are set out in Terms §32 and are not restated here.

Notices are given as Terms §36 provides. CyberWave publishes its corporate location rather than a postal service address, so email is the operative notice channel. Notices to CyberWave are given by email to support@cyberwave.ca. A legal notice must be identified as such in the subject line (Terms §36.2).

For questions about Professional Services, write to support@cyberwave.ca with the topic in the subject line.