Exhibits
EXHIBIT C – CMMC AND NIST SP 800-171 EXHIBIT
Version 1.0 – Effective December 1, 2026
EXHIBIT P – PCI DSS EXHIBIT
Version 1.0 – Effective December 1, 2026
1. What This Exhibit Does
1.1 This Exhibit applies where the Compliance Addendum marks CMMC and NIST SP 800-171 as applying to Client. It allocates responsibility between Paragus and Client for the security requirements in scope of Client’s own assessment, to the extent Paragus’s services touch them.
1.2 It is a contractual allocation, not a statement of the rule. Nothing in this Exhibit determines the scope of Client’s assessment, the assessment level that applies to Client, whether any Paragus asset or service is within that scope, or how any regulatory provision applies to Client. Those are determined by the framework, by Client’s own contracts, and by Client’s assessor. §3.3 of the Compliance Addendum applies.
1.3 No certification claim. Paragus does not represent that it holds a CMMC certification or assessment at any level, that any Paragus platform is FedRAMP authorized or FedRAMP equivalent, or that Client’s use of Paragus will result in Client passing an assessment. §3.4 of the Compliance Addendum applies.
2. Definitions
2.1 Terms used in this Exhibit and not defined here have the meaning given in the CMMC Program regulations at 32 C.F.R. Part 170 and in NIST SP 800-171, as applicable to Client’s assessment. This includes Controlled Unclassified Information, External Service Provider, Security Protection Data, Security Protection Asset and Organization Seeking Assessment or Certification.
2.2 “CUI” means Controlled Unclassified Information that Client identifies to Paragus under §3.2 of the Compliance Addendum.
2.3 “SPD” means Security Protection Data, being data Paragus generates, holds or processes that is used to protect Client’s assessed environment. It includes log, alert and monitoring data, vulnerability scan output, configuration baselines and the contents of Paragus’s management and security tooling as they relate to Client.
2.4 “CRM” means the Customer Responsibility Matrix for Client’s engagement, prepared under §4 during onboarding and attached to the Compliance Addendum as a schedule once both parties accept it in writing.
2.5 “Regulated Data” has the meaning given in §3.1 of the Compliance Addendum and, for this Exhibit, means CUI and SPD.
2.6 “Framework Requirements” means the security requirements against which Client’s assessment is conducted, being NIST SP 800-171 at the revision applicable to Client’s assessment, together with the assessment objectives in NIST SP 800-171A.
3. Scope
3.1 Client identifies CUI. Client is solely responsible for identifying its CUI, for determining what is and is not CUI, and for telling Paragus in writing which systems, applications, repositories, mailboxes and locations hold it, under §3.2 of the Compliance Addendum. Paragus does not make CUI determinations.
3.2 Systems in scope. The systems, applications and locations within scope of this Exhibit are those identified under §3.1 and recorded in Client’s onboarding record under the Service Terms.
3.3 Where Client places CUI outside scope. §6.2 of the Compliance Addendum applies. Paragus’s obligations under this Exhibit do not extend to CUI Client places outside the identified scope until the parties record it in writing.
3.4 Security Protection Data. The parties acknowledge that Paragus’s management and security tooling holds SPD relating to Client’s environment as an ordinary consequence of the Services. Paragus shall protect SPD in accordance with §5.2 of the Compliance Addendum and this Exhibit. Whether any Paragus asset holding SPD falls within the scope of Client’s assessment, and against which Framework Requirements it is assessed, is determined by Client’s assessor and not by this Exhibit.
3.5 Cooperation on scoping. Paragus will cooperate with Client and Client’s assessor to document the Paragus services, assets and data flows relevant to Client’s assessment, to the extent §4 requires. Cooperation beyond that is within §6.
4. What Paragus Commits To
4.1 The committed scope. Where this Exhibit applies, and for the Recurring Fee, Paragus shall:
(a) produce a Customer Responsibility Matrix for Client’s engagement, identifying, for each Framework Requirement in scope, whether responsibility sits with Paragus, with Client, or is shared, and what each party does, within ninety (90) days after the Service Commencement Date. Until the CRM is accepted, no Framework Requirement is allocated to Paragus by it;
(b) use the CRM as the description of the services Paragus provides to Client that are relevant to Client’s assessment; no separate description is produced;
(c) keep the document in (a) current, reissuing it where the Services materially change and on Client’s reasonable written request;
(d) where §4.1A is satisfied, operate Paragus’s own internal processes and policies so as to meet the Framework Requirements that apply to the services Paragus provides, to the extent the CRM allocates those requirements to Paragus, so that Paragus’s performance does not jeopardize Client’s compliance;
(e) maintain those Required Security Measures that Client’s Statement of Work places within Paragus’s services;
(f) protect SPD and restrict access to CUI and SPD to personnel who need it to perform the Services, in accordance with §§5.2 and 5.3 of the Compliance Addendum;
(g) bind subcontractors and third-party providers that process CUI or SPD in accordance with §5.4 of the Compliance Addendum, and flow down any term the framework or Client’s prime contract requires, subject to §6.3 of that Addendum; and
(h) report incidents in accordance with §5.
4.1A When §4.1(d) applies. The commitment in §4.1(d) applies only for so long as both of the following are true. Where either ceases to be true, the commitment ends thirty (30) days after Paragus gives Client written notice identifying which condition has failed, unless the condition is restored within that period:
(a) a Statement of Work for compliance maintenance under this Exhibit is in effect and Client is paying for it; and
(b) Client is compliant, meaning either that Paragus has confirmed in writing that Client’s readiness and remediation work is complete and that Client’s environment meets the Framework Requirements the CRM allocates to Client, or that Client holds a current CMMC status at the level its contracts require, whether a final self-assessment posted in the Supplier Performance Risk System or a certification issued by a C3PAO.
Until then, the remainder of §4.1 applies and §4.1(d) does not.
4.1B Mandatory flow-down. Where Client’s contract with the Department of Defense or a higher-tier contractor includes DFARS 252.204-7012, and the Services involve covered defense information, Paragus accepts the flow-down of that clause and shall meet the obligations it places on a subcontractor, including:
(a) providing adequate security for covered defense information on Paragus’s own information systems, in accordance with NIST SP 800-171;
(b) reporting a cyber incident affecting covered defense information to the Department of Defense within seventy-two (72) hours of discovery, as that clause requires of a subcontractor, notifying Client within twenty-four (24) hours of discovery or, where discovery is outside Client’s help desk hours under its Service Terms, by the end of Client’s next business day, whichever is later, and giving Client the incident report number and the information Client needs for its own reporting;
(c) preserving and protecting images of affected systems and relevant monitoring and packet capture data for at least ninety (90) days from the report;
(d) providing access to information and equipment needed for a Department of Defense forensic analysis or damage assessment;
(e) where Paragus uses an external cloud service to store, process or transmit covered defense information, using one that meets the security requirements that clause specifies; and
(f) flowing the clause down to Paragus’s own subcontractors where it requires.
These obligations are not conditional on §4.1A, on Client’s purchase of compliance maintenance, or on any fee, and apply notwithstanding §§1.3, 4.6, 5.3, 5.4 and 6 to the extent of any conflict. Client shall give Paragus the flow-down language in writing under §6.3 of the Compliance Addendum, and Paragus’s obligations under this Section begin when it does.
4.2 Nothing else is committed. The committed scope is §§4.1 and 4.1B and nothing else. Section 6 states what is not included and how it is provided.
4.3 The CRM controls the allocation. Where the CRM and this Exhibit conflict as to which party is responsible for a Framework Requirement, the CRM controls. The CRM is specific to Client’s environment and assessment scope; this Exhibit is not.
4.4 Client’s System Security Plan is Client’s. Client is responsible for its own System Security Plan, for its accuracy and completeness, and for documenting its use of Paragus in it. The CRM does not make Paragus responsible for Client’s System Security Plan, and §4.1 does not include authoring it.
4.5 Reliance. The CRM describes Paragus’s services as at its date. It is not a warranty of compliance, of assessment outcome, or of the adequacy of Client’s environment. §§1.2 and 1.3 of this Exhibit and §3.4 of the Compliance Addendum apply.
4.6 No FedRAMP representation. Paragus does not represent that any Paragus platform is FedRAMP authorized or FedRAMP equivalent. Where the framework or Client’s prime contract requires a FedRAMP authorization or equivalence for a service that processes, stores or transmits CUI, Client is responsible for determining whether that requirement applies to a given service, and Paragus will provide the information it holds to support that determination. Where a required authorization is absent, §8 of the Universal Service Terms applies, and Paragus’s obligations as to that service and that data are suspended until the parties record a resolution in writing.
5. Incidents
5.1 §16 of the Universal Service Terms and §5.6 of the Compliance Addendum govern Paragus’s incident response authority and obligations.
5.2 Reporting to Client. Paragus shall notify Client of any incident it becomes aware of that involves, or that Paragus reasonably believes may involve, unauthorized access to, or loss of, CUI or SPD, without unreasonable delay and in no event later than twenty-four (24) hours after Paragus becomes aware of it.
5.3 Client’s own reporting obligations. Except as §4.1B requires of Paragus, reporting to the Department of Defense, to a prime contractor, or to any other authority is Client’s obligation, and Client is responsible for making it within the periods its own contracts and the applicable regulations require. Paragus shall provide the information it holds and shall cooperate reasonably with Client’s reporting. Cooperation beyond providing that information is within §6.
5.4 Flow-down reporting periods. Where Client’s prime contract requires reporting within a period shorter than §5.2, that period binds Paragus only where the parties record it in writing under §6.3 of the Compliance Addendum.
6. What Is Not Included
6.1 Outside the committed scope. The following are not included in the Recurring Fee and are not Paragus’s responsibility under this Exhibit:
(a) authoring or maintaining Client’s System Security Plan;
(b) developing or maintaining Client’s Plan of Action and Milestones;
(c) collecting, organizing or maintaining Client’s assessment evidence, including any evidence index;
(d) maintaining Client’s continuous compliance between assessments;
(e) conducting a gap assessment, self-assessment or readiness assessment;
(f) remediating Client-side gaps, including gaps in systems, processes or documentation Paragus does not manage;
(g) developing Client’s policies or procedures;
(h) assessment support, including attendance at interviews, workshops and working sessions, and responding to an assessor’s or a regulator’s request beyond providing the CRM;
(i) representing Client to a C3PAO, an assessor, or the Department of Defense;
(j) submitting or maintaining Client’s score in the Supplier Performance Risk System; and
(k) work arising from a change in the Framework Requirements, beyond reissuing the CRM under §4.1(c).
6.1A Compliance maintenance. Where a Statement of Work for compliance maintenance under this Exhibit is in effect, evidence collection, maintenance of the evidence index and continuous compliance between assessments are provided under it for the fee it states, rather than under §6.2.
6.2 How they are provided. Each item in §6.1 is scoped, quoted and authorized on a separate Statement of Work, developed when Client requires it. A signed Statement of Work is required before work begins. §5.14 of the Universal Service Terms applies across every Statement of Work under the Agreement.
6.3 Requirements arising after signature. Where Client’s prime contract or assessor imposes a requirement on Paragus that was not within §4.1 when Client’s Statement of Work took effect, Paragus will quote it before performing it, and §6.2 applies to it.
6.4 Fees generally. §5.10 of the Compliance Addendum applies.
7. Term, Amendment and General
7.1 Amendment. This Exhibit is an incorporated exhibit under §18.10(b) of the Universal Service Terms and is amendable as §4.3 of the Compliance Addendum provides. §4.4 of the Compliance Addendum applies where the framework changes.
7.2 Version pinning. The version of this Exhibit that applies to Client is the version stated in §4.1 of Client’s Compliance Addendum, and §4.2 of that Addendum applies.
7.3 Precedence. §1.3 of the Compliance Addendum governs precedence. Within this Exhibit, the CRM controls as to the allocation of a Framework Requirement (§4.3).
7.4 Liability. §7 of the Compliance Addendum applies. §10 of the Client Service Agreement applies to all claims arising out of or relating to this Exhibit.
7.5 Survival. §§1.2, 1.3, 3.3, 4.5, 4.6 and 7.4 survive termination of the Agreement.
1. What This Exhibit Does
1.1 This Exhibit applies where the Compliance Addendum marks PCI DSS as applying to Client. It allocates responsibility between Paragus and Client for the PCI DSS requirements in scope of Client’s own assessment, to the extent Paragus’s services touch them.
1.2 It is a contractual allocation, not a statement of the standard. Nothing in this Exhibit determines the scope of Client’s Cardholder Data Environment, which assessment route or self-assessment questionnaire applies to Client, Client’s merchant or service provider level, whether any Paragus asset or service is within scope of Client’s assessment, or how any PCI DSS requirement applies to Client. Those are determined by the standard, by Client’s acquirer, by the applicable payment brands, and by Client’s assessor. §3.3 of the Compliance Addendum applies.
1.3 No validation claim. Paragus does not represent that it holds a PCI DSS Attestation of Compliance, that it has been assessed by a Qualified Security Assessor, that it appears on any payment brand’s list of validated service providers, or that Client’s use of Paragus will result in Client validating compliance. §3.4 of the Compliance Addendum applies.
2. Definitions
2.1 Terms used in this Exhibit and not defined here have the meaning given in PCI DSS and in the PCI Security Standards Council’s published glossary, as applicable to Client’s assessment. This includes Cardholder Data, Sensitive Authentication Data, Cardholder Data Environment, Third-Party Service Provider, Qualified Security Assessor, Report on Compliance, Self-Assessment Questionnaire and Attestation of Compliance.
2.2 “CHD” means Cardholder Data that Client identifies to Paragus under §3.2 of the Compliance Addendum.
2.3 “SAD” means Sensitive Authentication Data, being the full track data, card verification code or value, and PIN or PIN block.
2.4 “CDE” means Client’s Cardholder Data Environment as Client identifies it under §3.1 below.
2.5 “PCI Responsibility Matrix” means the PCI DSS responsibility matrix for Client’s engagement, prepared under §4 during onboarding and attached to the Compliance Addendum as a schedule once both parties accept it in writing.
2.6 “Regulated Data” has the meaning given in §3.1 of the Compliance Addendum and, for this Exhibit, means CHD and SAD.
2.7 “PCI DSS” means the Payment Card Industry Data Security Standard at the version applicable to Client’s assessment, together with the testing procedures published with it.
3. Scope
3.1 Client identifies its CDE. Client is solely responsible for identifying its Cardholder Data Environment, for determining which systems, applications, networks, devices and locations store, process or transmit CHD or could affect the security of the CDE, and for telling Paragus that scope in writing, under §3.2 of the Compliance Addendum. Paragus does not determine Client’s CDE scope.
3.2 Systems in scope. The systems, applications, networks and locations within scope of this Exhibit are those identified under §3.1 and recorded in Client’s onboarding record under the Service Terms.
3.3 Segmentation. Where Client relies on network segmentation to reduce the scope of its assessment, the adequacy of that segmentation is determined by Client and Client’s assessor. Where Paragus implements or maintains a segmentation control, it does so as the PCI Responsibility Matrix allocates, and Paragus’s performance of that control is not a representation that the segmentation achieves any particular scope reduction.
3.4 Where Client places CHD outside scope. §6.2 of the Compliance Addendum applies. Paragus’s obligations under this Exhibit do not extend to CHD Client places outside the identified scope until the parties record it in writing.
3.5 Sensitive Authentication Data. Paragus does not store SAD and does not accept SAD. Where Paragus becomes aware that SAD is present in a system Paragus manages, or in any Paragus system or tooling, Paragus will notify Client and will securely delete it, and §5 applies where the circumstances amount to an incident.
3.6 Paragus tooling and CHD. Paragus’s management, monitoring and security tooling is not configured or intended to capture CHD. Where CHD nevertheless reaches that tooling, Paragus will notify Client, will treat it as Regulated Data under the Compliance Addendum until deleted, and will securely delete it unless Client directs otherwise in writing.
4. What Paragus Commits To
4.1 The committed scope. Where this Exhibit applies, and for the Recurring Fee, Paragus shall:
(a) produce a PCI DSS responsibility matrix for Client’s engagement, identifying, for each PCI DSS requirement within the scope Client identifies under §3.1, whether responsibility sits with Paragus, with Client, or is shared, and what each party does, within ninety (90) days after the Service Commencement Date. Until the PCI Responsibility Matrix is accepted, no PCI DSS requirement is allocated to Paragus by it;
(b) use the PCI Responsibility Matrix as the description of the services Paragus provides to Client that are relevant to Client’s assessment; no separate description is produced;
(c) keep the document in (a) current, reissuing it where the Services materially change and on Client’s reasonable written request;
(d) where §4.1B is satisfied, operate Paragus’s own internal processes and policies so as to meet the PCI DSS requirements allocated to Paragus in the PCI Responsibility Matrix, so that Paragus’s performance does not jeopardize Client’s compliance;
(e) maintain those Required Security Measures that Client’s Statement of Work places within Paragus’s services;
(f) restrict access to CHD to personnel who need it to perform the Services, in accordance with §5.3 of the Compliance Addendum, and not store, process or transmit CHD outside the scope Client identifies;
(g) bind subcontractors and third-party providers that store, process or transmit CHD, or that could affect the security of the CDE, in accordance with §5.4 of the Compliance Addendum, and flow down any term PCI DSS requires; and
(h) report incidents in accordance with §5.
4.1A Acknowledgment of responsibility. Paragus acknowledges that it is responsible for the security of account data it stores, processes or transmits on Client’s behalf, and for the extent to which it could affect the security of Client’s CDE, in each case to the extent the PCI Responsibility Matrix allocates the relevant PCI DSS requirements to Paragus. This acknowledgment is given for the purposes of PCI DSS Requirement 12.9.1.
4.1B When §4.1(d) applies. The commitment in §4.1(d) applies only for so long as both of the following are true. Where either ceases to be true, the commitment ends thirty (30) days after Paragus gives Client written notice identifying which condition has failed, unless the condition is restored within that period:
(a) a Statement of Work for compliance maintenance under this Exhibit is in effect and Client is paying for it; and
(b) Client is compliant, meaning either that Paragus has confirmed in writing that Client’s readiness and remediation work is complete and that Client’s environment meets the PCI DSS requirements the PCI Responsibility Matrix allocates to Client, or that Client holds a current validation of PCI DSS compliance accepted by its acquirer, whether a Report on Compliance or a Self-Assessment Questionnaire with its Attestation of Compliance.
Until then, the remainder of §4.1 applies and §4.1(d) does not. §4.1A applies in every case.
4.2 Nothing else is committed. The committed scope is §§4.1 and 4.1A and nothing else. Section 6 states what is not included and how it is provided.
4.3 The PCI Responsibility Matrix controls the allocation. Where the PCI Responsibility Matrix and this Exhibit conflict as to which party is responsible for a PCI DSS requirement, the PCI Responsibility Matrix controls. The PCI Responsibility Matrix is specific to Client’s environment and assessment scope; this Exhibit is not.
4.4 Client’s assessment is Client’s. Client is responsible for its own Self-Assessment Questionnaire or Report on Compliance, for its accuracy and completeness, and for documenting its use of Paragus in it. The PCI Responsibility Matrix does not make Paragus responsible for Client’s assessment, and §4.1 does not include completing it.
4.5 Reliance. The PCI Responsibility Matrix describes Paragus’s services as at its date. It is not an Attestation of Compliance, not a warranty of compliance, and not a warranty of assessment outcome or of the adequacy of Client’s environment. §§1.2 and 1.3 of this Exhibit and §3.4 of the Compliance Addendum apply.
4.6 Payment applications and devices. Paragus does not represent that any payment application is PA-DSS validated or listed under the PCI Software Security Framework, or that any point-of-interaction device is PCI PTS approved. Selecting a compliant application or device is Client’s responsibility. Paragus will provide the information it holds to support Client’s determination, and where a required validation or approval is absent, §8 of the Universal Service Terms applies and Paragus’s obligations as to that application or device are suspended until the parties record a resolution in writing.
5. Incidents
5.1 §16 of the Universal Service Terms and §5.6 of the Compliance Addendum govern Paragus’s incident response authority and obligations.
5.2 Reporting to Client. Paragus shall notify Client of any incident it becomes aware of that involves, or that Paragus reasonably believes may involve, unauthorized access to, or loss of, CHD or SAD, without unreasonable delay and in no event later than twenty-four (24) hours after Paragus becomes aware of it.
5.3 Client’s own reporting obligations. Reporting to an acquirer, a payment brand, a regulator or any other authority is Client’s obligation, and Client is responsible for making it within the periods its own agreements and the applicable rules require. Paragus shall provide the information it holds and shall cooperate reasonably with Client’s reporting. Cooperation beyond providing that information is within §6.
5.4 Forensic investigation. Where a payment brand or acquirer requires a forensic investigation, engaging the investigator and bearing its cost are Client’s, and the investigator is Client’s or the brand’s appointee rather than Paragus’s. Paragus will cooperate reasonably, and Paragus’s time is within §6.
5.5 Shorter reporting periods. Where Client’s agreement with its acquirer or a payment brand requires reporting within a period shorter than §5.2, that period binds Paragus only where the parties record it in writing under §6.3 of the Compliance Addendum.
6. What Is Not Included
6.1 Outside the committed scope. The following are not included in the Recurring Fee and are not Paragus’s responsibility under this Exhibit:
(a) determining Client’s CDE scope, merchant or service provider level, or applicable assessment route;
(b) completing or maintaining Client’s Self-Assessment Questionnaire, Report on Compliance or Attestation of Compliance;
(c) providing an Attestation of Compliance for Paragus, or undergoing a PCI DSS assessment of Paragus;
(d) engaging or acting as a Qualified Security Assessor, Internal Security Assessor or Approved Scanning Vendor;
(e) conducting a gap assessment, readiness assessment, penetration test or approved scanning vendor scan;
(f) remediating Client-side gaps, including gaps in systems, processes or documentation Paragus does not manage;
(g) developing Client’s policies or procedures;
(h) assessment support, including attendance at interviews, walkthroughs and working sessions, and responding to an assessor’s, acquirer’s, payment brand’s or regulator’s request beyond providing the PCI Responsibility Matrix;
(i) representing Client to an assessor, an acquirer, a payment brand or a regulator;
(j) forensic investigation, and the cost of any investigator a payment brand or acquirer requires; and
(k) work arising from a change in PCI DSS, beyond reissuing the PCI Responsibility Matrix under §4.1(c).
6.1A Compliance maintenance. Where a Statement of Work for compliance maintenance under this Exhibit is in effect, evidence collection, maintenance of the evidence index and continuous compliance between assessments are provided under it for the fee it states, rather than under §6.2.
6.2 How they are provided. Each item in §6.1 is scoped, quoted and authorized on a separate Statement of Work, developed when Client requires it, except §6.1(c) and §6.1(d), which Paragus does not provide. A signed Statement of Work is required before work begins. §5.14 of the Universal Service Terms applies across every Statement of Work under the Agreement.
6.3 Requirements arising after signature. Where Client’s acquirer, payment brand or assessor imposes a requirement on Paragus that was not within §4.1 when Client’s Statement of Work took effect, Paragus will quote it before performing it, and §6.2 applies to it.
6.4 Fines, penalties and assessments. Any fine, penalty, assessment, non-compliance fee or increased transaction cost imposed on Client by an acquirer or payment brand is Client’s, except to the extent it is a loss caused by Paragus’s breach of the Agreement or its negligence, in which case §7 of the Compliance Addendum and §10 of the Client Service Agreement govern recovery of it.
6.5 Fees generally. §5.10 of the Compliance Addendum applies.
7. Term, Amendment and General
7.1 Amendment. This Exhibit is an incorporated exhibit under §18.10(b) of the Universal Service Terms and is amendable as §4.3 of the Compliance Addendum provides. §4.4 of the Compliance Addendum applies where PCI DSS changes.
7.2 Version pinning. The version of this Exhibit that applies to Client is the version stated in §4.1 of Client’s Compliance Addendum, and §4.2 of that Addendum applies.
7.3 Precedence. §1.3 of the Compliance Addendum governs precedence. Within this Exhibit, the PCI Responsibility Matrix controls as to the allocation of a PCI DSS requirement (§4.3).
7.4 Liability. §7 of the Compliance Addendum applies. §10 of the Client Service Agreement applies to all claims arising out of or relating to this Exhibit.
7.5 Survival. §§1.2, 1.3, 3.4, 3.5, 4.5, 4.6, 6.4 and 7.4 survive termination of the Agreement.