DOC2044403124.pdf

Procure-to-Pay

3835 Holdrege Street | Lincoln, NE 68583-0742 | 402.472.2126 nebraska.edu/p2p

University of Nebraska Contract Summary

CONTRACTOR/COMPANY INFORMATION

Supplier PLANET TECH INC Contact Juan Garza

Sourcing Agent Shanon Wright Email jgarza@go-planet.com

REQUESTING DEPARTMENT

Participating Campuses

U- wide/UNOP

Administrative Unit/Dept.

ITS

Department Contact Phil Redfern

CONTRACT DESCRIPTION/INFORMATION

Contract Summary (brief description and/ or event name)

SOW to assist the University in establishing an IT enclave that meets CMMC Level 2 requirement for the University's Microsoft365 GCC-High tenant. Planet Tech is the only supplier that provides the University with a smaller quantity of GCC licenses.

Contract Document Document Amt Total Amt Start Date End Date Notes

CW42279 $468,500.00 $468,500.00 03/02/2026 06/30/202

COMPETITION/BID INFORMATION

Bid Number

Competition NCPD

Contract Information

INTERNAL USE ONLY

CW42279

University of Nebraska Non-Competitive Procurement Documentation

RP-6.2.1.5.a requires small purchase procedures for purchases that equal or exceed the micro-purchase level and competitive proposals or bids for purchases of $250,000 or more. RP-6.2.1.5.b provides certain exceptions. This form must be approved by the Chief Procurement Officer for purchases of $250,000 or more where competitive proposals or bids are not obtained or by the Associate Chief Procurement Officer for small purchases where quotations are not obtained.

Requestor Name Requestor Email Non conflict statement: In accordance with RP-6.2.1.7, by submitting this form you affirm that you have no conflict of interest in the selection of this supplier, nor will you receive personal or financial benefit from this purchase.

Supplier Amount Contract, PR, or Invoice#

RP-6.2.1.5.b.1)iv Procurement by non-competitive proposals is procurement through solicitation of a proposal from only one source and may be used only when one or more of the following circumstances apply:

Select Circumstances for Procurement by Non-Competitive Proposals definitions for relevant capitalized terms are included on the following page

The Purchase of a unique Article or Service that is available only from a single source (without limiting the generality of the foregoing, examples include public utilities; books, periodicals, and other publications; and specially designed business, research, or scientific equipment and software). Unless an Article or Service is necessary for the operation of an existing Article or performance of an existing Service purchased by the University, a specification for a proprietary Article or Service does not justify a Purchase by noncompetitive proposal where there is more than a single source that can provide the Article or Service. See RP-6.2.1.5.b.1)iv.A.I; -6.2.1.5.b.1)iv.C.

The Purchase of an Article or Service that is necessary for the operation of an existing Article or performance of an existing Service purchased by the University. See RP-6.2.1.5.b.1)iv.A.II.

The Purchase is necessary to address an Emergency. See RP-6.2.1.5.b.1)iv.A.III.

The Purchase of Professional Services; provided, however, any contract for Licensed Professional Services, construction management, and design-build services shall be made in accordance with applicable law and Board of Regents policies. See RP-6.2.1.5.b.1)iv.A.IV; -6.2.1.5.b.1)iv.A.VII.

The Purchase is for maintenance or servicing of equipment made from the manufacturer of the equipment or the manufacturer's authorized service agent, where, in the judgment of the Authorized Signatory, such maintenance or service can be most effectively performed by the manufacturer or its authorized service agent.

See RP-6.2.1.5.b.1)iv.A.V.

The Purchase is to be made using federal funding and the federal awarding agency or pass-through entity expressly authorizes non-competitive proposals in response to a written request from the non-federal entity.

See RP-6.2.1.5.b.1)iv.A.VI.

This form must be accompanied by written justification for the non-competitive procurement from the requesting college, school, department, division, office, or other administrative subdivision.

Written Justification

Procurement Officer Approval Date

Rick Haugerud rhaugerud@nebraska.edu

Planet Technologies $468,500.00

The university must establish an IT enclave that meets CMMC Level 2 requirements to secure federal research funding for the NSRI UARC. Planet Technologies is uniquely qualified to deliver a cloud-only enclave in Microsoft GCC High, complete with the required technical compliance artifacts for CMMC Level 2, within 6-8 weeks. It is the only provider capable of meeting this timeline collaboratively and offering a solution without requiring enterprise-scale minimums.

Planet Technologies has already delivered this service to other BTAA members, with more expected to follow soon. After completing the implementation, Planet Technologies will maintain the enclave to ensure ongoing compliance with technical CMMC Level 2 assessment objectives.

CW42279

02/26/26 | 11:41 CST

Definitions

“Article” means any item of personal property, including all materials, products, supplies, furniture, equipment, printing, stationery, technology, and all other chattels, goods, wares, and merchandise.

“Authorized Signatory” means any person delegated signature authority to approve and execute a Contract pursuant to RP-6.3.1.

“Consideration” means the benefit or value, whether by promise, performance, or forbearance of a specific act, each party to a Contract bargains for and/or receives or expects to receive when entering the Contract.

“Contract” means any written agreement for a stated Consideration between the University and one or more other parties, creating obligations that are legally recognizable or enforceable.

“Emergency” means an event or occasional combination of circumstances that calls for immediate action or remedy, pressing necessity, exigency, a sudden or unexpected happening, or an unforeseen occurrence or condition where it is in the public interest for the University to take action and includes, but is not limited to, situations where the University must act to (i) avoid the loss of life, health, safety, or property; (ii) respond to a natural catastrophe, such as a tornado, storm, flood, snowstorm, manmade disaster, war, act of or serious threat of terrorism, or pandemic or widespread disease; (iii) respond to time limits established by a person or agency external to the University; or (iv) obtain cost savings for the University where the time constraints of Competitive Procurement would eliminate the cost savings.

"Licensed Professional Services" shall mean those services within the scope of the practice of architecture, professional engineering, landscape architecture, or registered land surveying as defined by the laws of the state of Nebraska, or those performed by any architect, professional engineer, landscape architect, or registered land surveyor in connection with his or her professional employment practice.

“Professional Service” means any Service that requires special knowledge as distinguished from skills and (i) requires a license or other legal authorization as a condition precedent to the rendering of the Service or (ii) is commonly recognized as a professional service. Examples of Professional Services include, but are not limited to, accounting and auditing; actuarial; legal;

personnel; financial; computing; management; marketing; educational program planning or evaluation; insurance and risk management; hotel booking; or travel booking. Examples of skilled professions not considered Professional Services include, but are not limited to, construction trades, cleaning, equipment operations or repair, fire or security systems, furniture repair or installation, landscaping, locksmith, moving, storage, painting, pest control, vehicle repair or maintenance, waste removal, recycling, printing, or catering.

“Purchase” means (i) the process of acquisition of any Article by the University by transfer of ownership or by lease or license for a stated Consideration paid to a Contractor; (ii) a Contract for any Service, including any Professional Service, to be provided by any Contractor for a stated Consideration; or (iii) a Contract for any labor, material, or equipment for construction, repair, alteration, remodeling, renovation, or demolition of any University building or other improvement to Real Property to be provided by a Contractor for a stated Consideration.

“Service” means the rendering of time or effort of a Contractor whose purpose is to perform an identifiable task rather than to furnish an Article.

University of Nebraska - GCCH

Secure Research

Statement of Work

Prepared for University of Nebraska

Date: 2/13/2026

Dan Nelson Juan Garza Planet Technologies, Inc.

VP Operations and

Delivery Director of DIB Sales

Ph (301) 721-0100

Fx (301) 721-0189 dnelson@go-planet.com jgarza@go-planet.com www.go-planet.com

All information contained in this document is Planet Technologies, Inc. proprietary and is limited to distribution between Planet Technologies, Inc., and University of Nebraska.

https://goplanet.sharepoint.com/sites/slge/SOW%20Templates/www.go-planet.com

University of Nebraska - GCCH University of Nebraska

Proposal | Table of Contents

Table of Contents

Executive Summary

CMMC Assessment Ready Compliance Services

Evolve GCCH End User Training

Advantage Services

Secure Research Framework (optional)

End User Support

Fixed Fee Pricing

About Planet Technologies

Operational Assumptions

Terms and Conditions

Signatures

Appendix A – Managed Services Service Descriptions

Appendix B – Evolve Description of Services

Appendix C – Compliance Meeting Matrix

Proposal | Page 3 of 63

Executive Summary

Planet Technologies will partner with University of Nebraska to deliver a secure, compliant, and scalable cloud-based solution purpose‑built to meet CMMC Level 2 and NIST 800‑171 technical control requirements and support their ongoing research practice. As a certified CMMC Level 2 partner with our own Microsoft GCC High tenant and a mature Managed Services program, Planet brings deep expertise in designing, deploying, and sustaining environments that support customers throughout their compliance lifecycle. This engagement focuses on the rapid deployment of a secure collaboration enclave within Microsoft GCC High, using proven best practices to accelerate both compliance readiness and operational security.

Planet recommends that organizations begin by establishing their GCC High tenant and completing a CMMC Level 2 self‑assessment, submitting results to SPRS to demonstrate initial compliance posture. In parallel, customers can advance toward full CMMC Level 2 certification, which emphasizes continuous security monitoring, documentation, and governance. University of Nebraska has expressed the need for a secure platform capable of handling sensitive information in alignment with CMMC Level 2—specifically, the protection of Federal Contract

Information (FCI) and Controlled Unclassified Information (CUI). With more than 400 customers operating at Microsoft GCC High, Planet is uniquely positioned to deliver this capability.

As part of this engagement, Planet Technologies will:

• CMMC L2 – Rapidly deploy a secure collaboration enclave for managing CUI contracts and sensitive data.

• CMMC L2 – Align all configurations with NIST 800‑171 technical controls to establish a compliant and defensible security foundation.

• CMMC L2 – Provide assessment‑ready compliance documentation and guide University of Nebraska through the C3PAO assessment process.

• CMMC L2 – Deliver ongoing technical, security, and compliance maintenance through

Planet’s Managed Services program to sustain long-term compliance.

The enclave is intentionally designed as a secure, purpose‑built environment for handling CUI— commonly referred to as a swivel‑seat model—and not intended to replace a customer’s full operational workspace. It includes a standardized suite of Microsoft tools (Word, Excel, PowerPoint, Outlook, Teams) with strict access controls and conditional policies. Users will access the environment through Azure Virtual Desktop (AVD) or Windows 365 after completing

CUI and insider‑risk training. Internet access is tightly restricted to the organization’s tenant or approved destinations to mitigate data‑loss and data‑exfiltration risks. Additionally, DoD‑aligned sensitivity labels and data‑protection controls are available to further enforce compliance requirements.

Planet will apply its extensive compliance and documentation expertise to accelerate the development of required artifacts, perform a mock assessment, and prepare University of

Nebraska for a successful C3PAO validation. Because compliance is an ongoing responsibility, Planet’s Managed Services team will continue to provide monitoring, updates, and support to ensure that University of Nebraska maintains a strong and compliant security posture over time.

Proposal | Page 4 of 63

By combining technical excellence, deep GCC High experience, and certified CMMC Level 2 capabilities, Planet Technologies is committed to helping University of Nebraska securely manage sensitive information and achieve long‑term success under CMMC Level 2.

Service Configuration and Compliance Artifacts

Service Configuration

Overview

This Statement of Work (SOW) details the deployment of the environment for University of

Nebraska that includes the configuration of the services listed below. This deployment requires

M365 E5 (or equivalent) licensing along with a valid Azure subscription.

• Microsoft Entra ID Premium Plan 2 (P2) o Conditional Access Policies

▪ MFA for all administrators

▪ MFA and Terms of Use for all users o Self-service password reset o Privileged Identity Management (PIM) o Group-based licensing

• Defender for Office 365 (MDO) o Anti-Spam o Anti-malware o Anti-phishing o Safe Attachments o Safe Links

• Defender for Endpoint (MDE) o Core Defender Vulnerability Management o Next-Generation Protection o Endpoint Detection and Response o Automated Investigation and Remediation

• Purview Information Protection (PIP)

• Data Loss Prevention (DLP)

• Microsoft Intune o Enable Mobile Device management for management of AVD or W365

• Teams

• OneDrive for Business (ODFB)

• SharePoint Online (SPO)

• Azure Landing Zone o Microsoft Sentinel o Azure Virtual Desktop (AVD or W365) o Defender for Cloud (DFC).

• Email Notification Service – Planet will deploy our proprietary email notification service.

This allows notifications to be sent from GCCH to the user’s primary email address so

Proposal | Page 5 of 63 they are aware when something may need their attention. Users can unsubscribe if this notification is not desired.

Deployment Process

The deployment process includes the following activities:

• Customer logistics meeting to review prerequisite information the customer must complete before the project kick off: questionnaire with tenant creation decision points, DNS networking changes required by University of Nebraska networking group to prepare for CAB board approval in advance, initial user list template, confirmation of necessary licensing. The project schedule will be established based on the results of this review.

• Contract Kickoff Meeting Microsoft 365 Government Community Cloud-High (GCC-H)

• Azure tenant enrollment and provisioning meeting

• User access training and basic tenant functionality testing

• Managed services (MSP) kickoff meeting

Deliverables

Planet provides the following artifacts upon completion of the configuration.

• Technical Design and Configuration Document

Project Assumptions

• The Planet delivery team will create the accounts needed to develop the GCCH tenant.

Those accounts will be removed at the handover to the Planet Managed Services team.

• The customer will begin to incur Azure charges for Azure firewall, Sentinel, and AVD upon enablement.

• Customer will need to provide the Planet compliance consultant with a GCCH license for delivery and management of CMMC audit evidence.

• Planet will establish a B2B cross tenant connection between customer’s new GCCH tenant and the Planet GCCH tenant for the MSP team to upload security evidence into the compliance repository using Guest access. Planet will provide a CUI Data Handling

Agreement with the customer, if necessary.

• The customer will be responsible for procuring and managing the Domain. This includes all necessary registrations and renewals.

• No devices are configured or enrolled as part of this deployment outside of AVD or

W365.

• The Azure deployment assumes a greenfield environment.

Voice Customization

As an extension to the Rapid Deploy, Planet can add additional capabilities to this baseline functionality at the request of the customer. The University of Nebraska has requested that

Proposal | Page 6 of 63

Planet provide support for adding audio conferencing capabilities which are being acquired through CallTower

Overview

Planet will work with the Customer to deploy and configure Microsoft Teams Audio

Conferencing using Direct Routing. The engagement will focus exclusively on enabling dial-in conferencing capabilities, ensuring seamless interoperability with a SIP service provider, and providing knowledge transfer to Customer IT staff.

Activities

• Coordinate with the chosen Direct Routing vendor to configure and enable Audio

Conferencing

• Validate required firewall ports for Teams Audio Conferencing are allowed

• Establish SIP trunk connectivity between the SBC and the Customer’s telephony provider for conferencing services

• Configure Teams Audio Conferencing settings o Dial-in numbers and conferencing bridge configuration o Conference policies and meeting settings o Audio conferencing dial plans and normalization rules

• Assist with assignment of required Microsoft Teams Audio Conferencing add-on licenses for in-scope users

• Support procurement of new numbers

• Configure reporting and monitoring tools for conferencing quality o Reporting labels o Call Quality Dashboard (CQD) setup focused on conferencing scenarios

CMMC L2 Assessment Artifacts

Planet will complete the following deliverables based on interviews with University of Nebraska and from the Planet’s technical design and configuration document. These interviews are spread across five initial meetings to be held in the first three weeks of the project and include the following areas:

• System Authorization

• Personnel Security, Account Authorization. Training, and Publicly Accessible Systems

• Incident Response (reporting procedures, TTX, ect.)

• Configuration Management

A sample meeting matrix can be found in Appendix C along with the customer leadership required to attend the meetings and sign off on policies.

This compliance package is based on Planet’s completed deployment and work as the managed services provider (MSP) for technical maintenance and compliance support. Should this not be the case, additional time and cost will be required for this work beyond what is outlined.

Proposal | Page 7 of 63

Deliverables

• Cloud-based compliance artifact repository within your GCCH tenant

• CMMC 2.0 / NIST 800-171 r2 Shared Responsibility Matrix

• Organizational policies and procedures aligned with NIST 800-171 r2 Control Families

(14)

• Assessment Boundary, CUI Data Flow, and Network Topology diagrams IAW Level 2

Scoping Guide

• System Security Plan (SSP) with implementation statements and evidence for the 110 relevant NIST 800-171 r2 Security Controls and their 320 Assessment Objectives (AOs)

• Asset Inventory (Hardware/Software) IAW CMMC Level 2 Scope Guide

• Incident Response Plan (IRP)

• Tabletop Exercise (TTX)

• Ports, Protocols, and Service Management list (PPSM)

• Configuration Management Plan (CMP)

• Acceptable Use Policy (AUP)

• Operation Plan of Actions (OPA)

• Risk Assessment

• Baseline SPRS score

Period of Performance

The period of performance (PoP) for the service configuration and compliance artifacts is five (5) weeks from the project kickoff. Prior to the end of the PoP, the contract may be amended via change order. Change Orders must indicate the reason for the change and any impact on scope, costs, deliverables, and the period of performance as applicable. If the PoP of the contract is not extended prior to the end date, in order for Planet to continue to provide services, Customer and Planet must agree in writing to a new SOW identifying the terms of the new agreement.

At the end of this PoP, the Planet Advantage Services (MSP) will begin.

Proposal | Page 8 of 63

CMMC Assessment Ready Compliance Services

Conduct a Mock Assessment

The goal of the mock assessment is to mimic aspects of the C3PAO assessment process. As a

Registered Provider Organization (RPO), Planet is well positioned to assist customers with this phase. This simulation will validate the organization’s technical, procedural, and artifact readiness. This allows the customer to prepare for how to answer assessors, identify any residual gaps, and increase confidence in passing the official certification assessment.

Typical Mock Assessment Schedule

Conduct a full CMMC Level 2 control evaluation aligned with the CMMC Assessment Guide. A typical schedule is as follows:

• Week prior to the assessment – prep all participants

• Mock assessment week o Day 1 – AC and IA controls o Day 2 – AU, IR, RA, and CA controls o Day 3 – CM and SC controls o Day 4 – MP, PE, MA, and SI controls o Day 5 – PS and AT controls

• Week post assessment – compile and present results

During this time, the assessor will request objective evidence, conduct live interviews and system demonstrations, and evaluate maturity, consistency, and implementation. For each assessment objective, the assessor will evaluate:

• Documentation – are the required policies and procedures in place?

• Implementation – are the controls effectively operational?

• Evidence – is objective proof available and mapped?

Assessment Results and Recommendations

Planet will score each control as met, not met, or not applicable. Planet will then flag controls with insufficient documentation, incomplete implementation, or weak/missing evidence. Finally, Planet will identify any systemic gaps such as inconsistent enforcement or poor logging.

A final report will be provided that includes:

• Summary of findings and scoring

• Key areas of concern and audit exposure

• An Operational Plan of Action (OPA) that covers technical, procedural, or evidentiary deficiencies

Planet will prepare and deliver a readout session with executive and technical leadership summarizing results and strategic recommendations.

Proposal | Page 9 of 63

Period of Performance

The period of performance (PoP) for the Mock Assessment is (3) three weeks.

C3PAO Assessment Support

The objective of this phase is to support University of Nebraska in coordinating and preparing for the formal CMMC Level 2 certification assessment, led by an authorized C3PAO. As the

Managed Service Provider (MSP) and trusted cybersecurity advisor, Planet’s role is to facilitate readiness, provide technical and documentation support, respond to C3PAO inquiries, and help to ensure the smooth, successful completion of the assessment process. Planet will act in support and advisory capacity during the following phases.

C3PAO Pre-Assessment Planning

Planet will work with University of Nebraska to provide final validation of documentation and diagrams, confirm availability of evidence such as logs, training records, policy manuals, facilitate a shared repository for evidence sharing (if required by C3PAO), and work with University of

Nebraska and their C3PAO to finalize schedule and logistics for the assessment.

C3PAO Assessment

During the assessment window, Planet will available as needed to:

• Assist in live demonstrations and control validations

• Retrieve supplemental evidence

• Clarify implementation details

• Provide rapid response support for any control disputes, clarification requests, or follow-up questions

Post-Assessment Support

Upon completion of the assessment, Planet will be available for a period of 2 weeks to:

• Assist the customer in understanding the C3PAO’s findings

• Support the preparation and submission of any corrective actions and POA&M resolutions

• Help finalize the evidence package and close any outstanding items requested by the assessor

Assumptions

• The customer has completed remediation and documentation prior to C3PAO engagement

• Planet does not perform the formal assessment, but will support University of Nebraska during the process

Proposal | Page 10 of 63

• C3PAO selection and scheduling is initiated by the customer

Proposal | Page 11 of 63

Evolve GCCH End User Training

One of the key advantages of Evolve 365 lies in its ability to streamline compliance efforts. It serves as a powerful tool in your compliance toolkit, enabling organizations to deliver CMMC required yearly CUI and security training at scale. Our platform allows you to easily track completion rates, ensuring that every employee has fulfilled their training obligations. Moreover, Evolve 365 empowers you to create supplemental training programs that can be utilized throughout the year, catering to the specific needs of users who require additional cyber training exercises. This flexibility and scalability make Evolve 365 an invaluable asset for organizations seeking comprehensive compliance and a robust cybersecurity posture.

Evolve Cyber Complete Learning is included into your organization's training framework. This will enable you to implement a robust and efficient system for delivering, tracking, and enhancing cyber training initiatives. By leveraging Evolve 365, you can proactively address the ever-increasing cybersecurity challenges, foster a culture of security awareness, and ensure that your organization remains resilient against emerging threats. In addition to security, Evolve also includes custom sessions to educate your users to your new GCCH environment.

Included in this scope are the following services.

• Modern Workplace and Cyber & Compliance -Video Content & Updates (Monthly)

• Check-in with Learning Strategist (Monthly)

• Customized Campaigns (quarterly)

• Custom Training Playlists (2 a year)

• User Training Compliance & Audit Reports (Monthly)

Week Training Description

Session 1 Understanding the Differences in

Our New Environment

This webinar will provide an in-depth look at the changes and differences in our new environment. We'll explore the key differences and features, and how these will impact your workflow. This session will equip you with the knowledge you need to navigate our new environment confidently.

Session 2 Tips for Working in Multiple

Environments

In today's dynamic work landscape, many of us find ourselves juggling multiple environments.

This webinar will offer practical tips and strategies for managing your tasks efficiently across different platforms. From best practices for organization to tools that can help streamline your workflow, you'll leave this session with actionable insights to enhance your productivity.

Proposal | Page 12 of 63

Session 3 An Overview of CUI Controlled Unclassified Information (CUI) is a critical aspect of data management and security. This webinar will provide a comprehensive overview of CUI, including what it is, why it matters, and how to handle it properly. We'll cover the regulations and guidelines surrounding CUI and offer best practices for ensuring compliance and protecting sensitive information.

Session 4 Labeling Content in Microsoft 365 Properly labeling content is essential for maintaining organization and security within

Microsoft 365. This webinar will guide you through the process of labeling documents, emails, and other content types. We'll discuss the different labeling options available, how to apply them effectively, and the benefits of using labels to manage and protect your data.

See Appendix B for a detailed service description.

Proposal | Page 13 of 63

Advantage Services

Operational Overview

Your Assigned Team – Advantage Services

Throughout the duration of your contract with Planet Technologies, you will have dedicated resources assigned to work directly with your team. The goal is to have consistent people to help facilitate a positive and strong relationship.

Primary and Secondary Technical Consultants

Customer will be assigned a Primary and Secondary technical consultant. These resources will be selected to have expertise and background involving the Microsoft skillsets that Customer requires at the time. The skillsets of your resources will likely vary, for example you could have one Azure and one O365 senior engineer, or perhaps one Endpoint SME and one Exchange

SME.

Technical Account Manager

Customer will be assigned a Technical Account Manager (TAM) from the Managed Services

Team who will help facilitate communications, schedule working sessions, and provide monthly activity reports. The TAM will be the primary initial escalation point, if need be, and can help to coordinate resources needed to support the customer.

Monthly Account Reviews

Throughout the duration of this engagement, the Managed Services Team will compile and deliver Monthly Account Reviews for the Customer. Each month, a list of items or topics that were discussed and reviewed, any milestones or accomplishments met, as well as any remaining outstanding or open activities will be highlighted by our team. Planet will use information captured in our ticketing system, email, and informally by your assigned Technicians.

Ticketing System

The Managed Services team leverages and uses a ticketing system called FreshDesk. It can be accessed directly by going to https://managedservices.go-planet.com . If desired, customer can create Username and Passwords to access the ticketing system directly, but most customers choose to work with our ticketing system through email. You’re assigned technicians will often

CC the support DL of support@o365support.com which will forward that communication directly into the ticketing system. This information will be gathered to track requests against an

SLA, document, and track issues over time, and to gather historical information related to the work that has been completed by the Customer and their assigned Managed Services Team.

https://managedservices.go-planet.com/ mailto:support@o365support.com

Proposal | Page 14 of 63

Service Level Agreement (SLA)

Telephone, email, and/or remote access consulting and engineering assistance will be provided per incidents, based on the schedule of severity outlined below.

Requests for support will be provided to Planet Technologies using the phone support line or the customer ticket portal. All urgent requests should be submitted via the phone support line.

Business Hours includes the hours of 8 am – 5 pm EST. All support requests received outside of normal business hours will be responded to on the following business day.

Critical Business Impact

Customer’s business has significant loss or degradation of services

Needs immediate attention

Submission via Phone Only

Initial phone response within

60 minutes, during business hours, engineer response within 2 business hours

Continuous effort all day, every day during business hours

Allocation of appropriate resources to sustain continuous effort all day, every day during business hours.

Accurate contact information on case owner

Moderate Business Impact

Customer’s business has moderate loss or degradation of services, but work can reasonably continue in an impaired manner

Needs attention within 4 business hours

Initial ticket response within 2 business hours expected. 4 guaranteed.

Continuous effort all day, every day during business hours

Allocation of appropriate resources to sustain continuous effort during business hours, as needed

Minimum Business Impact

Customer’s business is substantially functioning with minor or no impediments of services.

Needs attention within 8 business hours

Initial ticket response within 4 business hours. Expected, 8 guaranteed.

Continuous effort during business hours, as needed

M365 and Azure Advantage

Proposal | Page 15 of 63

M365 and Azure Advantage are Planet’s ongoing Microsoft support offering for our partner organizations. Our Primary and Secondary Technicians will act as an extension of your team and will help you envision a Microsoft Cloud strategy to generate the greatest ROI. M365 and Azure

Advantage is focused on enabling Customer to get the most out of their Microsoft productivity services by augmenting our Partner’s team with world class experts in the various M365 technologies. Planet’s managed services include proactive maintenance, operations, defense, and support activities. The services offered by Planet Managed Services encompass the following key components.

Technical Admin Support

Planet will provide support services to include all activities completed within the Microsoft 365

Admin Center and Azure management portal as well as cloud connected systems such as

Exchange hybrid and Active Directory. Desktop and end user support is not part of Advantage services and will be the responsibility of the customer. Our Managed Services team works out of a centralized ticketing system that we have enabled called Fresh Desk.

Admin Training

As new technologies are introduced to Microsoft 365, or as you are exploring the various components, Planet can assist to develop and lead customized workshops. These workshops will vary in length (typically 1-2 hours) and will provide a foundation on new technologies and guidance for moving forward. Each workshop will be customized for your organization and will focus on the specific features that interest you the most. Example workshops include:

• Identity & Account Management

• Regular “What’s New in Microsoft 365” sessions

• Data Loss Prevention setup and maintenance

• Microsoft 365 Security Alerts, what’s there by default and what should you add

• Microsoft Defender for Cloud Apps (Formerly Cloud App Security)

• SharePoint, OneDrive, Exchange & Teams Overviews

• Azure Information Protection, Configuration Best Practices and Labeling

• M365 Spam, Malware and Ant Phishing Settings overview

• Anti-Phishing Campaigns and how to run them from M365

• PowerShell Basics, and Introduction to using PowerShell in M365

• Conditional Access Policies, common configurations, and best practices

• Understanding Modern Authentication

• How to handle Mobile Devices at a company/agency level

Tenant Monitoring & Reporting

Your assigned Technicians will work with you to ensure that all the included Microsoft 365 and

Azure Monitoring and Reporting tools have been configured within your environment. They will review with you the overall configuration and how each tool is intended to be used. On a regular basis throughout your contract, as determined by you and your Technical support team, Proposal | Page 16 of 63 reports will be reviewed, and the data shared with you to help you best plan and adjust your

Cloud monitoring strategies.

This includes but is not limited to Azure Monitor, Azure Log Analytics, Azure Security Center, Azure AD Premium features, etc. This scope of work does not cover custom developed security alerting such as automated deployments with ARM/Bicep/Terraform, although advice best practices and guidance on those tools can be provided. Should Customer decide they want that type of development work, additional support agreements with our development team will need to be scoped and established.

Strategic Advising

The Planet Managed Services team can provide strategic on-going, proactive consulting, planning and oversight. Some of the areas we typically cover include but are not limited to the following.

Architecture & Operations

Architectural Best Practices

Features Overview & Training

Review Operational Readiness

Security

Identity and Access Management

Azure Security Center

Security Assessments and Best Practices

Advanced Analytics and Threat Intelligence

Performance & Reliability

Scaling Workloads

Storage Management

Site Recovery

Cost Optimization

Proposal | Page 17 of 63

Analyze Usage & Cost

Efficiency Measurements & Forecast

Sentinel Advantage

Sentinel Advantage is Planet’s ongoing Microsoft Sentinel support offering for our partner organizations. Our technicians will act as an extension of your team and will help you enable and support the SIEM and SOAR functionality of Microsoft Sentinel for your organization. Sentinel

Advantage is focused on supporting our Partners to get the most out of their Microsoft Sentinel services through review, remediation, and support.

Planet Sentinel Advantage Activities

Planet’s Sentinel advantage support team will enable, and support a customer provided Sentinel

SIEM. This work is subject to the number of hours available in their advantage agreement for the month. These hours can be increased month to month, or on a one-off basis in order to accomplish one-time additional configuration. The ongoing advantage services includes:

• Platform Health, Security, and Maintenance o Platform Support

▪ User Training

▪ Dashboard and Report Customization

▪ Alert Rule Generation

▪ Event-Handling

▪ Log Parsing

• Continuous Device Monitoring o Agent Log Collection o Syslog Log Collection o File Tailing o EDR Data Collection o Performance Monitoring o 3rd Party / External Integration Support

• Continuous Tuning and optimization of your Microsoft Sentinel environment o Triage, investigation, and threat response leveraging AI & ML implementing auto remediation where possible.

o Expert analysis of your risk and threat landscape.

Support for Sentinel Advantage takes place during business hours M-F 8am-5pm EST. Any escalation or incidents that occur outside of those hours will be investigated first thing the next business day.

Sentinel Advantage Service Components:

Log Source Analysis

Proposal | Page 18 of 63

Planet will provide a set of alarms and report templates for log files from a broad array of supported sources. For non-supported log sources, Customer may require custom development to integrate the source. Planet will work with Customer to understand Customer’s endpoint or intermediary log sources, important event criteria, and any custom reporting or real-time alarming requirements. The scope of this analysis will be set out in a separate signed Statement of Work (“SOW”).

Log Collection

Planet will deploy & configure will software agents on Azure based Customer devices for collecting logs, as initially scoped with customer. Customer is responsible for configuring all premise-based log sources so that logs are appropriately sent to the agents and log collection devices.

Normalization & Correlation

Once the log data reaches the Customer’s Sentinel SIEM, logs from separate devices and applications will be correlated to identify behavior that can be validated across multiple sources.

This allows individual logs that may not be reliable or consistently indicative of malicious behavior to be analyzed in a larger context.

Prioritization

Planet classifies security events based on the risk it presents to the Customer. These events may require Customer notification by Planet.

Alarming

When an alarm is detected, Planet will notify the Customer, in accordance with the SLA around business hours support. If desired, alarm/alerts can be configured to deliver to the Customer directly as well as to our Managed Services team. For notifications that are escalated to

Customer by the Sentinel Advantage team, Planet may also perform additional analysis to determine whether a security event indicates a security compromise. Planet provides the

Customer with a description of the event(s), and any contextual information identified during the initial investigation.

Reporting

Initial Custom report development is completed as part of the implementation phase and is included with the service. Additional custom report development can be purchased by Customer under a separate Statement of Work (“SOW”) at additional cost.

Incident Response

Planets Sentinel Advantage team maintains a Security Incident Response Plan (IRP) that will be developed with University of Nebraska input. This will be reviewed and tested annually with

University of Nebraska staff. Appropriate training will be provided to any staff with responsibilities as part of the Security Incident Response Team (IRT).

Scope of included activities by function:

Proposal | Page 19 of 63

Ongoing Management

Establishing New Connectors and Log ingestion for any new services needed

Enabling New Workbooks and Analytics

Review Operational Readiness

Review Cost Projections and Optimizations

Setup additional administrative access for review on demand

Setup Proactive reporting on set schedule

Security Alerts & Investigation (Incident Response)

We will monitor and investigate all incidents generated in Sentinel.

Planet will take the appropriate remediation action If we have access to the associated systems (like

M365/Azure AD systems). For other resources we will provide the investigation summary and recommended remediation actions i.e. (local firewalls/Unsupported applications)

Will utilize the Hunting and Querying capabilities for active investigation into incidents

Log Review

Will establish a cadence of Log review for the desired logs on a Daily / Weekly / Bi-Weekly / Monthly /

Quarterly Basis to be established with each customer in accordance with their own desires and

Compliance needs. Each log review will have a ticket generated and email to your team for documentation.

For Instance, CMMC has 17 specific cloud-based logging, and two full classes of On-prem/Network based logs to check Weekly

Account Management

Monthly Account Reviews to go over a summary of incidents or events that occurred, as well as any security related escalations

Microsoft Sentinel focused Workshops and training series for your staff as needed

Provide proactive updates about service and Microsoft Cloud offerings as a whole.

Proposal | Page 20 of 63

Support is Business Hours

Service Activation & Configuration

• Planet will access the Customer’s Sentinel instance remotely and perform the configuration and Service activation tasks which may require device downtime.

• Service activation is performed during the hours of 9 am and 5 pm EST, Monday through

Friday, and may be performed at other times for an additional fee and with reasonable advance notice from the Customer.

• Planet will use up to the first 30 days post-activation to identify a baseline of the

Customer environment and tune the service. Tuning is a process of factoring out some of the expected noise of the Customer’s environment and optimizing the service to provide better visibility and anomaly detection.

Support

• Planet Security Operations Center is staffed from 9:00 a.m. to 5:00 p.m. EST, Monday through Friday. Customers can contact the support team via email or telephone to initiate troubleshooting and support.

Authorized Users

• Only authorized users provided by the Customer will have access to support services.

Change request

• Only authorized users can request changes to the Service such as changes in the alarming or event criteria.

Sentinel Service Level Agreement (SLA) Amendment

Alarm Notification

Planet shall notify the Customers via email of an alarm notification within thirty (30) minutes of detection by Planet 24 hours a day, 7 days a week via automated email notifications. In addition, during business hours, Planet’s analyst will investigate the alarm notification and will notify the

Customer if any follow up action is to be taken by the Customer.

Response Times Critical Issues – Defined as functions critical to continuity of Managed

SIEM Service.

• Must be called into Planets Sentinel advantage team.

• Live Security Analyst is available to assist during business hours.

• Non-Critical Issues – Defined as general requests related to Managed SIEM Service should be emailed to Planet and the response will be provided within (1) business day

Proposal | Page 21 of 63

The Service Levels set forth herein do not apply to any performance or availability issues:

• Due to factors outside Planets reasonable control.

• Resulting from Customer’s or third-party hardware or software;

• Resulting from the actions or inactions of Customer or third parties; or

• Attributable to the acts or omissions of Customer, its employees, agents, or third parties acting on behalf of Customer.

Assumptions

Customer Sentinel instance will be managed remotely unless otherwise specified in this SOW.

Customers have the necessary licenses to support the defined activities in this SOW and will provide the Planet team with the necessary administrative rights within their tenant to enable the scope of this agreement to be completed.

Definitions

Alert - An Alert is an observable, measurable anomalous occurrence in a system or network. An example of an alert is an instance of unsuccessful logon, system crash, unplanned reboot, degradation in service performance, or network traffic spike. Alerts are monitored, reviewed, and analyzed by the Sentinel Advantage Team and either confirmed to be benign or escalated to the level of an Incident.

Incident - An Incident is an observable, measurable event taking place in a system or network that deviates from the normal behavior and implies harm or threat to do harm. Additionally, an event involving accidental loss of sensitive information is also classified as an Incident. An example of an Incident would be any unauthorized access and/or disclosure of confidential information, successful or repeated network intrusion attempt, or detection of any unwanted / malicious application or process. Upon confirmation of an Incident, Sentinel Advantage or the organizations Incident Response services are invoked.

Compliance Maintenance

Once compliance assessment readiness is achieved, that posture needs to be maintained.

Compliance Advantage is a service provided to assist customers in maintaining their ongoing compliance readiness. This includes weekly, monthly, and annual maintenance activities as well as things like ongoing change management, incident reporting, and user onboarding and offboarding. These required activities are all part of maintaining compliance readiness and include a combination of both technical and compliance resources.

Compliance maintenance support includes assisting the customer to maintain compliance to the latest 800-171 standard required by the DoD.

Proposal | Page 22 of 63

Maintenance Reviews

The Planet team will take on defined set actions needed for any organization that follows the best practice guidelines for CMMC readiness and compliance. These actions are broken down by requirements of re-occurrence, either taking place on a weekly, monthly, quarterly, or semi-annual basis, determined by the required action and recommended best practice. All actions will be fully documented and reported on through our ticketing system and incorporated into your

SSP and other security documentation to accurately reflect the reoccurring maintenance and support. The table below is representative of the types of activities that are required to be conducted by CMMC.

Control Family 800-171 Control Control Description

Audit and Accountability 3.3.1

Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

Audit and Accountability 3.3.2

Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.

Audit and Accountability 3.3.3 Review and update logged events.

Audit and Accountability 3.3.4 Alert in the event of an audit logging process failure.

Audit and Accountability 3.3.5

Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.

Audit and Accountability 3.3.8

Protect audit information and audit logging tools from unauthorized access, modification, and deletion.

Compliance Process Controls

In addition to the ongoing maintenance work defined above, the Planet team will follow the defined compliance processes that will help ensure the compliance posture is maintained. This includes things like:

• User Creation and Onboarding: maintaining and collecting evidence for compliant user creation. This will include all required prechecks, such as has the user passed the

Proposal | Page 23 of 63 necessary CMMC training, are they cleared and approved for access, and do they understand the system design and feature functionality.

• Change Control Process: Following the change control process. This includes ensuring appropriate approvals are received and documented and all CMMC related documentation is updated.

• Incident Response: Should an incident occur, Planet will assist in documenting and ensuring the incident response plan is followed and documented as required by CMMC.

• Asset Inventory List: Planet will assist in maintaining an Asset Inventory list in collaboration with the customer. This is typically a combination of Intune Devices (if they exist in your deployment) as well as Azure assets representing things like AVD.

The hours allocated for this support are enough for standard maintenance activities and updating procedures and evidence. However, should University of Nebraska require a substantial change of service with new requirements, additional time may be required both for configuration as well as updates to compliance artifacts. In such cases, Planet will work with the customer to determine if this effort can be best accomplished as a separate project, a one-time increase in hours, or possibly even spread across multiple months of service.

Proposal | Page 24 of 63

Secure Research Framework (optional)

Project and Support Overview

Project Deployment

Planet’s Secure Research Framework allows organizations to collect Azure service requests via a common form, provide Terraform service provisioning scripts and a Power BI dashboard to allow end users the ability to see their specific Azure consumption costs. Planet will deploy the following Azure services in the Secure Enclave to enable the framework tools:

• Azure VM (hosting of Terraform)

• Azure App Service

• SQL PaaS…