Paragus Co-managed It service Terms

1. How These Service Terms Work

1.1 What these are. These Service Terms describe how Paragus delivers the Co-Managed program. They apply where Client’s Statement of Work states that Client is enrolled in Co-Managed. Where Client is enrolled in Fully Managed, the Fully Managed Service Terms apply instead.

1.2 What is not here. These Service Terms contain no legal or risk-allocation content. Those terms are in the signed Client Service Agreement and the Universal Service Terms, and §3 of the Universal Service Terms governs precedence.

1.3 Amendment. Paragus may amend these Service Terms only as §4.3 of the Client Service Agreement provides.

1.4 Targets, not guarantees. Response figures, onboarding windows and deliverable dates in these Service Terms and in Client’s SOW are targets and carry no service-level remedy. §12.4 of the Universal Service Terms applies to all of them.

2. The Program

2.1 What Co-Managed is. Co-Managed supplements Client’s internal IT function rather than replacing it. Client retains ownership of its environment and retains its internal IT staff. Paragus supplies the services Client selects in its SOW, and no others.

2.2 The program is built from selections, not plan levels. Co-Managed has no tiers. Client’s SOW states, independently of one another:

(a) the Remote Help Desk type and availability, or that no remote help desk is in scope;

(b) the Recurring Onsite skill level, duration and monthly frequency, or that no recurring onsite is in scope;

(c) which Managed Services from Section 4 are in scope;

(d) which IT Team Tools from Section 5 are licensed; and

(e) the counts in Section 13 against which the above are priced.

2.3 The dedicated team. Paragus assigns an Account Relationship Manager for strategic alignment, a Network Engineer who maintains the environment and its security, and a Client Support Manager who owns the day-to-day support experience. An Account Relationship Manager is always assigned. A Network Engineer is assigned where Client’s SOW includes managed services, and a Client Support Manager where it includes a remote help desk or recurring onsite services. Where a role is not assigned, any obligation in these Service Terms expressed by reference to that role is performed by Paragus and may be performed by any suitable Paragus personnel.

2.4 No long-term commitment. Co-Managed carries no minimum term. Client’s SOW states a flat Notice Period and that the Initial Period Right does not apply, so the tier table in §4.4 of the Universal Service Terms and §4.6 of those Terms do not operate.

3. The Remote Help Desk and the Service Boundary

3.1 Why this Section exists. Co-Managed divides support between Client’s internal IT function and Paragus. The division is the single most important term of the engagement, because it determines who a user contacts, who owns a case, what Paragus is priced to absorb, and what is billable. This Section defines it. Client’s SOW selects one type.

3.2 The four types.

3.3 Minimum internal capability. Under Overflow, Backup and Escalated Support, Client’s internal IT function is the first point of contact. Client shall maintain an internal IT function capable of performing that role. Where Client ceases to maintain one, Paragus is not obliged to perform the first-contact role in its place, and Section 3.6 applies.

Under Primary Support there is no minimum internal capability, because Paragus performs the first-contact role.

3.4 Who may contact the help desk. Under Primary Support, any of Client’s users may contact Paragus directly. Under Overflow, Backup and Escalated Support, only the individuals Client names in writing, including during onboarding, may raise a case with Paragus, and Paragus is entitled to direct any other person to Client’s internal IT function. Client shall keep that list current in writing and Paragus may rely on the most recent list Client has provided.

3.5 Availability and hours. Client’s SOW states:

(a) Availability – Business Hours, or 24X7; and

(b) Help desk hours – Standard, being Monday to Friday 8:00am to 5:30pm Eastern excluding Paragus holidays; or Always On, being 24 hours a day, 7 days a week, 365 days a year. Paragus holidays are New Year’s Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Thanksgiving Day and Christmas Day.

Outside the hours Client’s SOW states, Section 9 governs.

3.6 Where the boundary moves in practice. Each type is priced to a different expected share of Client’s total support volume. Where the volume Paragus actually absorbs materially exceeds the share the selected type was priced to provide – including where Client’s internal IT function stops performing the first-contact role, or where users route to Paragus directly contrary to Section 3.4 – §5.1A of the Universal Service Terms applies. Paragus will raise the position with Client before giving notice under that Section.

3.7 Case assignment. Paragus assigns each case on urgency, impact and the nature of the work. Response targets, where Client’s SOW states any, are targets under Section 1.4. Co-Managed publishes no response time guarantee and none is given.

4. Managed Services

4.1 Scope. Only the Managed Services Client’s SOW lists are in scope. A service not listed is not in scope, is not implied by any other service, and is quoted separately.

4.2 The available services. Each is priced on the basis shown and is stated in Client’s SOW with its monthly charge:

The three advanced email security options are alternatives to one another, as are the two server and network monitoring options. Client’s SOW states which one applies.

4.3 Monitoring is not remediation. Where a monitoring, detection or alerting service is in scope, Paragus’s commitment is to monitor and to notify Client in accordance with that service. Investigation, remediation and recovery are not included in the monthly charge and are billed under Section 9 or as a Project, except where Client’s SOW states otherwise.

4.3A Backup. Where Microsoft 365 backup is in scope, Paragus configures it to the retention recorded under Section 11.7 and monitors it. Paragus commits to that retention only. No recovery point objective, recovery time objective or time-to-restore is committed, and any such figure appearing in any document is expressly disclaimed.

4.4 Patching windows. Operating system and security patching is deployed during maintenance windows agreed with Client during onboarding and recorded under Section 11.7. Where Client declines a patch or a window, §7.2 of the Universal Service Terms applies.

5. IT Team Tools

5.1 What these are. The tools in this Section are licensed per IT Employee and give Client’s internal team the platforms Paragus’s own engineers use. Client’s SOW states which are licensed and the IT Employee count they are licensed against.

5.2 Licensing and access. A tool licensed under this Section is licensed for the duration of the Agreement and for Client’s internal IT personnel only. Client shall not provide access to any third party without Paragus’s written agreement. §6.3 of the Universal Service Terms applies to Client’s own licensing obligations.

5.3 Data in the tools on termination. §9.4 of the Universal Service Terms governs Client Data held in a tool licensed under this Section. Client shall export what it requires before the effective date of termination, and Paragus will make that export available on request under §9.4.

5.4 Count changes. Where Client’s IT Employee count changes, the charge under this Section changes with it, counted as Section 13 provides.

6. Service Escalation Path

6.1 What this Section is for. §4.8(e) of the Universal Service Terms provides that a Notice of Material Breach is not effective unless Client confirms it has exhausted this path. This Section is that path.

6.2 Step 1 – raise it. Client notifies its Account Relationship Manager in writing, or gives written notice to Paragus’s notice address under §20 of the Universal Service Terms, describing the concern and what it wants addressed. Notice given either way starts the period in Section 6.3, whether or not the Account Relationship Manager is available.

6.3 Step 2 – service review. Paragus will convene a service review within ten (10) business days of Client’s notice under Section 6.2, including the members of Client’s dedicated team assigned under Section 2.3, and will give Client a written summary of its findings and the actions it will take within five (5) business days after the review.

6.4 Step 3 – executive review. Where the actions in that written summary do not resolve the concern within thirty (30) calendar days after Client receives it, Client may request an executive review in writing with the Director of Client Strategy. Paragus will convene it within ten (10) business days of the request and will confirm the outcome in writing.

6.5 Deemed completion. Where Paragus does not convene a review within the period stated for that step, that step is deemed complete and Client may proceed to the next step.

6.6 What this path does not affect. This path is a condition only of a termination for cause (§4.8(e) of the Universal Service Terms) and of a proceeding under §7.1(c) of the Client Service Agreement. It does not delay or condition any other right to end the Agreement.

6.7 Individual requests. This Section concerns the overall service relationship. Escalation of an individual support request is an internal operational process and is not part of the Agreement.

7. Recurring Onsite Services

7.1 What this is. Where Client’s SOW states recurring onsite services, a Paragus technician attends Client’s site on a scheduled basis to resolve physical issues, inspect equipment and meet Client’s staff in person.

7.2 Skill level and duration. Client’s SOW states the skill level, being a Level 1 Resource or a Level 2 Resource, and the duration, being a half day of four and a half (4.5) hours or a full day of eight and a half (8.5) hours, together with the number of visits per month.

7.3 No carry-over. Each month’s visits must be used in that month. Unused visits do not carry over and have no cash value.

7.4 Scheduling. Visits are scheduled in advance by agreement. A visit Client cancels with less than two (2) business days’ notice is treated as used.

7.5 Travel. Travel to Client’s sites recorded under Section 11.7 is included. Travel to any other location is billed under Section 9.

8. Supported Environment

8.1 What Paragus supports. Paragus supports equipment and software that is:

(a) within the counts stated in Client’s SOW;

(b) running a version the vendor currently supports with security updates;

(c) capable of running the tooling the services in scope require, and on which that tooling is installed and reporting; and

(d) owned or lawfully licensed by Client.

8.2 What falls outside. Equipment or software failing any limb of Section 8.1 is outside the supported environment. Paragus will identify it, handle it under Section 14.4, and may decline to support it or may support it on a best-efforts basis billed under Section 9. §7.2 of the Universal Service Terms applies where Client elects to retain it.

8.3 No product list. This Section defines support by criteria rather than by naming products, so that it does not go out of date. Paragus will tell Client which specific products meet the criteria on request.

9. Billed Hourly Work

Work billed under this Section is a Non-Routine Service for the purposes of the Universal Service Terms and the Compliance Addendum.

9.1 Rates. Work billed under this Section is billed at the following rates. Business hours are Monday to Friday, 8:00am to 5:30pm Eastern, excluding Paragus holidays.

(a) Where Client’s SOW includes no remote help desk and no recurring onsite services, work outside the services in scope is Escalated Technical Support:

(b) Where Client’s SOW includes a remote help desk or recurring onsite services, remote support during Client’s help desk hours is included where Client has a remote help desk, and:

Remote support within Client’s help desk hours remains included even where those hours fall outside business hours.

9.2 Who may authorize it. Only an Authorized Requester designated under §6.2 of the Universal Service Terms may authorize billable work. §6.2 of the Universal Service Terms applies. Where work that would be billable is requested by someone who is not an Authorized Requester, Paragus will seek authorization before incurring it, except where Section 12 applies.

9.3 Notice before incurring. Paragus will tell Client that a request is billable before beginning the work, and will give an estimate where Client asks for one. An estimate is a target under Section 1.4.

9.4 Rate changes. Section 1.3 applies to a change in these rates. A rate change does not affect work already authorized at a stated rate.

10. Additional Services

10.1 Available on a separate Statement of Work. The following are outside the Co-Managed program and are scoped, quoted and authorized separately:

• IT projects

• Log aggregation and archiving with 24X7 monitoring

• Microsoft 365 licensing and management

• Assistance with compliance documentation

• On-premises disaster recovery and business continuity services

10.2 How they are added. Each is added by a separate SOW under the same Agreement. A signed SOW is required before work begins. §5.14 of the Universal Service Terms applies across every SOW under the Agreement.

10.3 Projects. A request is generally a Project where it will take at least ten (10) hours, where it requires coordinating multiple resources or vendors, or where it warrants a professional project manager. Projects are separately scoped, quoted as a fixed fee, and authorized.

11. Onboarding

11.1 Onboarding fee. Co-Managed carries a flat onboarding fee equal to Client’s first month’s invoice, stated in Client’s SOW and invoiced once. It is not part of the recurring monthly investment and is not included in any annual figure Paragus quotes.

11.2 What it recovers. The fee recovers Paragus’s front-loaded cost of taking on Client’s environment, which is incurred in full at the outset and includes environment discovery and documentation, tooling deployment and validation, and the period of parallel operation with Client’s internal team or prior provider. It scales with the size of the environment onboarded, which is what drives that cost. It is a recovery of cost and not a penalty or a charge for terminating.

11.3 Paid in full. The onboarding fee is invoiced in full and is not waived or reduced. As each Co-Managed SOW provides, §4.5 of the Universal Service Terms does not apply.

11.3A Onboarding team. Paragus assigns a dedicated onboarding team, and onboarding is managed as a project based on the services Client selects.

11.4 Billing begins on the Service Commencement Date. Onboarding does not defer the commencement of fees. §§4.1A and 4.2 of the Universal Service Terms apply.

11.5 Credentials and prior access. Client shall provide the access the services in scope require. Paragus removes access held by any prior provider the services replace, during onboarding and with Client’s cooperation. Paragus has no monitoring, detection or alerting obligation in respect of any system until Paragus’s tooling is installed on it and reporting. The date Paragus’s tooling first records the system reporting is that date, and the tooling’s own record is the evidence of it.

11.6 Onboarding Completion Date. The Onboarding Completion Date is the date on which Paragus’s tooling first records the last system in scope reporting under Section 11.5.

11.7 The onboarding record. During onboarding Paragus records, in the Responsibility Matrix: (a) the systems in scope for each Managed Service, and the retention for any backup service; (b) the agreed maintenance windows; (c) Client’s sites; (d) the individuals who may raise a case under Section 3.4, and Client’s Authorized Requesters; (e) every person other than Paragus holding administrative or other privileged access to Client’s environment, whether a member of Client’s personnel or a third party, and the access each holds; and (f) the role of each party on each line under Section 14. Paragus keeps the record current as things change. Each change is a new version, and the most recent version is available to Client in the client portal. Client’s signature on a version acknowledges receipt; a version takes effect when Paragus delivers it, subject to Section 14.3. The record does not amend Client’s SOW. Client shall tell Paragus promptly if anything in it is wrong.

12. Incident Response

12.1 Authority. §16 of the Universal Service Terms governs Paragus’s authority to contain a suspected security incident, including where the affected system is one Client’s internal IT function administers.

12.2 Rate. Incident investigation, forensics, remediation and recovery are billed under Section 9 unless Client’s SOW states otherwise. A monitoring or detection service in scope under Section 4 does not include them.

12.3 Client obligations. §16.6 of the Universal Service Terms applies, including to an incident Client’s internal IT function identifies first.

12.4 Pre-existing compromise. Paragus’s obligations do not extend to compromise, persistence or exposure existing before Paragus’s tooling was installed and reporting.

13. Counting Users and Devices

13.1 Five counts. Client’s SOW states each of:

13.2 Which count prices what. The Remote Help Desk is priced on End Users with an Assigned Workstation. IT Team Tools are priced on IT Employees. Each Managed Service is priced on the basis shown in Section 4.2. A single individual or device may fall into more than one count, and each count operates independently of the others.

13.3 Exclusions from Licensed Microsoft 365 Users. Shared mailboxes (for example info@, sales@, support@), resource and room mailboxes, and service accounts are excluded.

13.4 When counts are taken. On or about the fifteenth (15th) day of each month, applying to the following month’s invoice. Counts move in both directions, and each change appears on the invoice.

14. Responsibility Matrix and the Conditions Register

14.1 Why Co-Managed needs one. Because Client retains its internal IT function, a line that is unallocated is a line nobody performs. Paragus and Client prepare a Responsibility Matrix during onboarding, stating the role each party plays on each line, with exactly one owner for each line, and Paragus records it under Section 11.7. Until a line is allocated, each party continues to perform what it performed before the Service Commencement Date, and Paragus performs the services selected in Client’s SOW as these Service Terms describe them.

14.2 How to read the Matrix. Paragus is accountable for a line only where the Matrix shows Paragus as “Owns”, which means Paragus holds the administrative rights, receives the alerts, and is responsible for detecting a problem and driving it to resolution. Under any other role, Paragus does only what that role states. Under “Supports” in particular, Paragus assists on request but does not own the outcome, does not monitor for problems, and is not responsible for detecting a failure. Where Client owns a line, Client’s internal IT function performs it and Paragus has no obligation in respect of it beyond the role the Matrix gives Paragus. The Matrix defines each role it uses.

14.3 Provisional on its face. Each line takes effect on clearance during onboarding. Where onboarding establishes that a line cannot be performed as allocated, Paragus lists the condition in the register under Section 14.4 and raises it with Client, and the line is not performed as allocated until the condition is cleared.

14.4 Conditions and Exceptions register. The register is the Documented Exceptions section of the Responsibility Matrix. Paragus opens it at onboarding and maintains it for the duration of the Agreement. A condition found after onboarding is handled as a Documented Exception under §8 of the Universal Service Terms. When a condition is cleared, Paragus removes it from the register, and for a Documented Exception that removal is the written confirmation under §8.4 of those Terms.

14.5 Third-party administrative access. Client shall disclose every third party holding administrative access to any part of the environment, including any party Client’s internal IT function has engaged. §6.5 of the Universal Service Terms applies.

14.6 Changes made by Client’s internal IT function. Client’s internal team retains administrative control of Client’s environment. Paragus is not responsible for the consequences of a change Client’s internal team makes to a system within a Managed Service in scope, and will handle the change under Section 14.4 where it affects a line of the Matrix. Where remediation is required, it is billed under Section 9.

15. Licensing and Procurement

15.1 Microsoft 365 and Google. Where Client’s SOW states it, Paragus will become Client’s partner of record and will include license charges on Client’s monthly invoice at the publisher’s standard published rates.

15.2 Pass-through. License charges are pass-through. They are excluded from the Recurring Fee for the purposes of §4.14 of the Universal Service Terms and §10.1 of the Client Service Agreement, and §5.10 of the Universal Service Terms governs third-party charges, including term-committed subscriptions.

15.3 Client’s licensing obligation. §6.3 of the Universal Service Terms applies.

16. Required Security Measures

16.1 Client shall implement and maintain, and shall permit Paragus to implement and maintain where Paragus’s services extend to them, the following:

(a) Multi-factor authentication on all user accounts with access to Client email or Client data.

(b) No shared or standing global or enterprise administrator accounts. Elevated permissions shall be scoped to the minimum required for the role, including for Client’s own IT personnel.

(c) Supported versions of all hardware, operating systems and applications within scope, as Section 8 provides.

(d) Properly licensed software. Client shall hold a valid license for all software in its environment, and shall not share, reuse or transfer license keys otherwise than as the publisher permits.

(e) Endpoint detection and response on every workstation and server within scope, where that service is selected in Client’s SOW.

16.2 Where Client declines. §7.2 of the Universal Service Terms applies.

16.3 Client’s internal team. Because Client’s internal IT function retains administrative access, these measures bind Client’s own IT personnel as much as its users. A change Client’s internal team makes that removes or weakens a measure is a failure to maintain it.

16.4 Changes to this list. Paragus may add to or modify this Section under Section 1.3. §7.3 of the Universal Service Terms governs when a new or modified measure takes effect for Client.

17. Order of Precedence

§3 of the Universal Service Terms governs precedence, including how far an SOW reaches (§3.1A).