FULLY_SIGNED_MCSA004-02_Service_Attachment_3_Final.pdf

Service Provider, Inc. MCSA004-02 Service Attachment 3 Page 1

Version date 03.01.24

SERVICE ATTACHMENT 3

UNDER

MASTER CLOUD SERVICES AGREEMENT #MCSA004-02

This Service Attachment 3 under Master Cloud Services Agreement #MCSA004-02 (the “Service Attachment”) is between Sectigo, Inc. (“Service Provider”), having an office at 8800 E. Raintree Drive, Suite 110, Scottsdale, AZ , and the State of Ohio (“State”), through the Department of Administrative Services (“DAS”), having its principal place of business at 30 East Broad Street, 40th Floor, Columbus, Ohio 43215.

The State and the Service Provider are sometimes referred to jointly as the "Parties" or individually as a “Party.” This Service Attachment is effective as of the date signed by the State and amends that certain Master Cloud Services Agreement #MCSA004-02 between the Parties dated October 16, 2012 (the “Agreement”).

1. Definitions

The defined terms in the Agreement will have the same meanings in this Service Attachment as they do in the Agreement. There may be additional definitions contained herein.

2. Services

2.1 Overview. Network Agent/Acme Automation are two tools that can be used to help automatically generate new Keys, send the public one to Service Provider console, have a certificate issued and then collect the certificate and have it automatically installed on the application. The Subscribing Entities can then schedule the renewal of the certificate to also be automatically completed.

Data security information:

a. The Services host or process Subscriber Data outside the United States.

b. The Services do not comply with the requirements to process Protected Health Information.

c. The Services do not comply with the requirements to process Federal Tax Information.

d. The Services do not comply with the requirements to process Criminal Justice Information Systems data.

2.2 Standard Service Features. ACME SSL, Sectigo Installation Agent, and ACME is a protocol that is used to perform certificate automation. Network Agent is an application that is also used to perform certificate automation.

2.3 Optional Service Features. None

2.4 Provision of Services. The Service Provider will make the Services available to the Subscribing Entities for purchase pursuant to the Agreement, including this Service Attachment. The Services will be Available to the Subscribing Entities pursuant to the Agreement and this Service Attachment during each Order Term. The State agrees that purchases hereunder are neither contingent on the delivery of any future functionality or features nor dependent on any oral or written public comments made by the Service Provider regarding future functionality or features.

2.5 Support. The Service Provider must provide the Service Provider’s basic support for the Services to the Subscribing Entities at no additional charge and upgraded support if available and if purchased by a Subscribing Entity. Service Provider’s basic support is described in Exhibit II, Enterprise Support and Validation Service. Service Provider’s upgraded support option is described in Exhibit III, Premier Support Services.

3. Fees and Payment

3.1 Pricing. The specific pricing for this Service Attachment is set forth in the Pricing Addenda attached hereto and incorporated herein.

Service Provider, Inc. MCSA004-02 Service Attachment 3 Page 2

3.2 Fee Structure and Payment. The Subscribing Entities will pay all fees specified in all Orders hereunder, subject to the terms of the Agreement. Except as otherwise specified, fees are based on Services purchased and not actual usage, and the number of Object subscriptions (e.g., the number of users) purchased cannot be decreased during the relevant Order Term. They may, however, be increased during an Order Term pursuant to Section 5.2, Orders and Modification, of the Agreement. Object subscription fees are based on twelve (12) month periods that begin on the subscription start date and each anniversary thereof. No Order may specify a Service or provision not identified and/or priced in this Service Attachment, nor may it cover any billable services not listed in this Service Attachment as a Service.

If a Subscribing Entity has not paid the fees specified in an Order by 90 days from the payment due date, the Service Provider may suspend a delinquent Subscribing Entity’s access to the unpaid Service(s) until all delinquent amounts are paid, upon written notice to the Subscribing Entity, notwithstanding any prohibition against self-help provided for elsewhere in the Agreement. However, Service Provider may not suspend Services if the Subscribing Entity is disputing the applicable charges reasonably and in good faith and is otherwise cooperating diligently to resolve the dispute.

3.3 Invoicing. Fees will be invoiced annually in advance and otherwise in accordance with the Agreement. Fees are due in accordance with the terms of the Agreement and this Service Attachment, which no Order may alter. Each Subscribing Entity is responsible for providing complete and accurate billing and contact information to the Service Provider and notifying the Service Provider of any changes to such information.

4. Proprietary Rights

4.1 Reservation of Rights in Services. Subject to the limited rights expressly granted hereunder, the Service Provider reserves all rights, title, and interest in and to the Services, including all related intellectual property rights. No rights are granted to the State or Subscribing Entities hereunder other than as expressly set forth herein or elsewhere in the Agreement.

4.2 Restrictions. Subscribing Entities will comply with the requirements set forth in Section 2.7, State and Subscriber Responsibilities, of the Agreement. Nothing herein prohibits a Subscribing Entity from porting and hosting Generated Files, as defined in this Agreement, to other sites to support its own business purposes during and after any term of an Order.

4.3 Subscriber Applications and Code. If a Subscribing Entity, a third party acting on a Subscribing Entity’s behalf, or a user creates applications data or code using the Services, such will be part of the Subscriber Data. The Subscribing Entity authorizes the Service Provider to host, copy, transmit, display, and adapt such Subscriber Data solely as necessary for the Service Provider to provide the Services in accordance with this Agreement. Further, the Subscribing Entity will be entitled to port, use, modify, disclose, license, sell, and host such anywhere.

5. Service Levels and Response Times

5.1 General. Service Provider agrees to provide Service Levels as set forth in Exhibit E to Amendment 5 of the Agreement.

6. Term and Modification

6.1 Term of Service Attachment. This Service Attachment is effective on the date of State signature below and remains in effect for the term of the Agreement unless earlier terminated pursuant to the Agreement.

6.2 Term of Services. Services purchased under this Service Attachment commence on the start date specified in the applicable Order and continue for the term specified therein, subject to relevant provisions

Service Provider, Inc. MCSA004-02 Service Attachment 3 Page 3 in the Agreement, such as the Agreement’s termination and non-appropriation provisions. Should a Subscribing Entity elect to renew a Services subscription, provided this Agreement and Service Attachment remain in effect, the renewal will be at the Subscribing Entity’s option and will be for the same or greater discount from list as the Services subscription being renewed and under the same terms and conditions.

6.3 Modification. If a change in law, rules, or regulations requires a modification of the renewal price or any terms and conditions in this Service Attachment, the Parties will in good faith negotiate the modifications necessitated by such a change, and any modifications will only be effective upon a written agreement signed by the Parties.

7. Miscellaneous

7.1 Affirmation and Disclosure Form. Service Provider must complete an Affirmation and Disclosure Form for this Service Attachment (the form of which is attached as Exhibit I) affirming the Service Provider understands and will meet the requirements of Section 9.13 of the Agreement. During the performance of the Services under this Service Attachment, if the Service Provider changes the location(s) disclosed on an Affirmation and Disclosure Form, Service Provider must complete and submit a revised Affirmation and Disclosure Form reflecting such changes.

IN WITNESS WHEREOF, the Parties have executed this Service Attachment as of the dates written below.

SECTIGO, INC. STATE OF OHIO, DEPARTMENT OF

ADMINISTRATIVE SERVICES

Signature Signature

Brian Holland

Kathleen C. Madden Printed Name Printed Name

Head of General Counsel

Director

Title Title

Date Effective Date

Service Provider, Inc. MCSA004-02 Service Attachment 3 Page 4

PRICING ADDENDUM 1

Service Attachment 3 Pricing

Service Net Unit Price / Year Fee Type Sectigo Certificate

Manager $10,000.00 Annual Subscription

ACME

SSL/Sectigo

Installation Agent $50.00 Annual Per

Certificate

Premier Support Services $10,000.00 Annual

Service Provider, Inc. MCSA004-02 Service Attachment 3 Page 5

EXHIBIT I

Affirmation and Disclosure Form

Contractor affirms that Contractor has read and understands the applicable Executive Orders regarding the prohibitions of performance of offshore services, locating State data offshore in any way, or purchasing from Russian institutions or companies.

The Contractor shall provide all the name(s) and location(s) where services under this Contract will be performed and where data is located in the spaces provided below or by attachment. Failure to provide this information may result in no award. If the Contractor will not be using subcontractors, indicate “Not Applicable” in the appropriate spaces.

1. Principal location of business of Contractor:

(Address) (City, State, Zip)

Name/Principal location of business of subcontractor(s):

(Name) (Address, City, State, Zip)

2. Location where services will be performed by Contractor:

Name/Location where services will be performed by subcontractor(s):

3. Location where state data will be located, by Contractor:

Name/Location(s) where state data will be located by subcontractor(s):

Service Provider, Inc. MCSA004-02 Service Attachment 3 Page 6

Contractor also affirms, understands and agrees that Contractor and its subcontractors are under a duty to disclose to the State any change or shift in location of services performed by Contractor or its subcontractors before, during and after execution of any contract with the State. Contractor agrees it shall so notify the State immediately of any such change or shift in location of its services. The State has the right to immediately terminate the contract, unless a duly signed waiver from the State has been attained to perform the services outside the United States.

On behalf of the Contractor, I acknowledge that I am duly authorized to execute this Affirmation and Disclosure Form and have read and understand that this form is a part of any Contract that Contractor may enter into with the State and is incorporated therein.

By: __________________________________ Contractor

Print Name: ___________________________

Title: __________________________________

Date: __________________________________

Service Provider, Inc. MCSA004-02 Service Attachment 3 Page 7

EXHIBIT II

Enterprise Support and Validation Service

In this Exhibit, “Our” and “We” refer to the Service Provider and “You”, “Your” or “Customer” refers to the State or Subscribing Entity.

Standard warranty support & standard Service Provider certificate manager support

Our Standard Support offering is designed to ensure you receive Telephone, Ticket, and Chat support during your business hours. We have Technical Support and Validation agents working around the clock to support you and your purchase.

You can expect assistance when it pertains to SSL, S/MIME, Code-signing, and Device certificate enrollment and installation.

We also provide Support on all our platforms: Reseller, Web Host Reseller, EPKI, S3, SCM, Hackerguardian/Hackerproof, and IoT.

Standard Level1 Warranty Support offering provides best-effort support 24x7/365.

Service Provider Certificate Manager L2 Support is available Monday – Friday, 4am- 8pm EST.

Common Servers and Device Types we assist with: Linux, Windows, Apple, Netscaler, Cisco.

Common Server Software we assist with: Apache, NGINX, Windows IIS, Mac OS, Tomcat, Java, F5.

Note: Service Provider Support agents do not provide server configuration services, such as (Remote Services, config files, etc.) and cannot provide any “remote-access” server configuration services. We will, however, provide documentation, step by step information and additional best-effort support to help troubleshoot your server configuration issue via phone and email.

Premier support

Our Premier Support offering equips you with a dedicated Service Account Manager (SAM). Your SAM acts as a liaison between Enterprise Customers and Service Provider.

The SAM acquires personal knowledge of your organization and ensures that the organization's service needs are met. Your SAM acts as a dedicated resource to assist with all aspects of deployment, ticket tracking, reporting and service recommendations.

You are also entitled to receive Telephone, Ticket, and Chat assistance (24x7/365) from our Technical Support & Validation agents for SSL, S/MIME, Code-signing, and Device certificate enrollment and installation.

We also provide Support on all our platforms: Reseller, Web Host Reseller, EPKI, S3, SCM, Hackerguardian/Hackerproof, and IoT.

Common Servers and Device Types we assist with: Linux, Windows, Apple, Netscaler, Cisco.

Common Server Software we assist with: Apache, NGINX, Windows IIS, Mac OS, Tomcat, Java, F5.

Service Provider, Inc. MCSA004-02 Service Attachment 3 Page 8

Note: Service Provider Support agents do not provide server configuration services, such as (Remote Services, config files, etc.) and cannot provide any “remote-in” server configuration assistance. We will, however, provide documentation, step by step information and additional best-effort support to help troubleshoot your server configuration issue via phone and email.

Service account manager

Your Service Account Manager (SAM) acts as a liaison between Enterprise Customers and Service Provider. The SAM acquires personal knowledge of the customer's organization and ensures that the organization's service needs are met. Your SAM acts as a dedicated resource to assist with all aspects of deployment, ticket tracking, reporting and service recommendations.

Business hours for SAMs are 8:30 a.m. to 8:00 p.m. EST.

Their responsibilities include the following:

1. All reports include performance-to-objectives and customer satisfaction reviews:

a. Quarterly Service Reviews, Free; and

b. Monthly Activity Reports, Fees Apply;

2. Ensure customers understand the Enterprise Service program and its benefits;

3. Proactive communication with the customer by telephone or email;

4. Customers receive monthly incident stats and history reports;

5. Assistance to help customers become as self-reliant as possible;

6. Familiarity with customer's system configuration and environment; and

7. Understanding of customer's service needs to ensure satisfaction.

Status reports

Enterprise Service customers receive quarterly service reviews and monthly reports of the incidents they report to Service Provider's support database. The reports contain support incident information, such as problem description, open and close dates, current status, assigned technician and resolution reports.

Premier Support : service levels

Service Provider's Enterprise Services will perform all activities as part of an SLA-based service delivery model. However, lacking direct physical access to the end-client environment, operational remediation requiring remote access including but not limited to availability, capacity, and outages are the responsibility of the customer.

The following table outlines the response times for each priority level associated with incidents, as reported by the customer via telephone or our ticketing system:

Issue Priority Description

L1 Critical This is an EMERGENCY condition that prevents critical business operations.

L2 High This is a condition that significantly impairs the use of our applications or systems to perform any critical business operations.

L3 Medium One or more applications or systems is affected, but the impact on business operations is not severe

Low The reported issue does not substantially impact business operations.

Incident resolution*

Incident Resolution is defined as incidents assigned to Enterprise Services and successfully restored to normal service operation within timeframes specified.

Service Provider, Inc. MCSA004-02 Service Attachment 3 Page 9

ACTION L1 CRITICAL L2 HIGH L3 MEDIUM LOW

Service Availability 24/7 24/7 24/7 24/7

Acknowledgement 5 minutes 5 minutes 5 minutes 5 minutes

Status Updates 1 hour 4 hours 8 hours 48 hours

Target Resolution < 4hours < 8 hours < 12 hours < 24 hours

* Published resolution times exclude code fixes, customized configuration, and product enhancements, and may include workaround solutions based on customer acceptance.

Service Provider, Inc. MCSA004-02 Service Attachment 3 Page 10

EXHIBIT III

Premier Support Services

This Exhibit between Subscribing Entity and Service Provider is part of the Enterprise Certificate Agreement, which, together with this Exhibit, governs the products and services described herein. Capitalized terms used in this Exhibit and not defined herein shall have the meanings attributed to them in the Terms and Conditions.

1. Additional Definitions.

1.1. “Available” and “Availability” mean, as it relates to SCM, the number of minutes per month that SCM is not experiencing Downtime.

1.2. “Designated Contact” means one or more Subscribing Entity personnel who are the primary points of contact and who interact with Service Provider.

1.3. “Downtime” means a period in which Service Provider’s servers are not successfully hosting SCM, excluding Scheduled Maintenance, Emergency Maintenance, and other factors beyond Service Provider’s control.

1.4. “Emergency Maintenance” means any time outside of Schedule Maintenance window that Service Provider is required to apply urgent patches or fixes or undertake other urgent maintenance activities to SCM.

1.5. “Performance Standards” shall mean those standards described in Section 3 of this Exhibit.

1.6. “Premier Support Period” means the period for which Subscribing Entity has paid for the Premier

Support Services.

1.7. “Premier Support Services” means the support services identified and selected in the Order Form and paid for by Subscribing Entity, as further described in Section 5 of this Exhibit and Service Provider’s latest published documentation on such services.

1.8. “Scheduled Maintenance” means technical maintenance, upgrades, or patches of SCM performed by Service Provider upon providing at least 24 hours’ notice to Subscribing Entity.

1.9. “Service Account Manager” or “SAM” means Service Provider person who is a dedicated service account manager that assists Subscribing Entity with various aspects of deployment, ticket tracking and reporting, service, and deployment recommendations.

1.10. “Support Incident” means either a question about the use or operation of a Service Provider product or service or any errors, malfunctions, or design flaws of a Service Provider product or service, as described in Section 5.6 of this Exhibit.

2. Defined Scope. Service Provider will provide the Availability Standards and Premier Support Services as described in this Exhibit. The Availability standards and Premier Support Services described in this Exhibit can only relate to those services and deliverables provided by or under the direct control of Service Provider or its subcontractors. This Exhibit and the services described herein do not cover, and Service Provider cannot guarantee or provide, services for software or hardware hosted by Subscribing Entity.

3. Performance Standards. Service Provider will provide the Availability of SCM and the Premier Support Services for the Premier Support Period in accordance with the terms and conditions of this Exhibit in a manner that: (i) meets or exceeds the available quantitative and qualitative service levels and commitments, as more specifically described below, and (ii) is consistent with standards satisfied by well-managed operations performing services similar to the services provided herein. Service Provider shall monitor and measure its performance hereunder. In the event of a failure to meet a Performance Standard, Service Provider shall use commercially reasonable efforts to resume meeting or exceeding the Performance Standard as quickly as possible and take appropriate preventative measures so that the failure does not re-occur.

4. SCM Performance.

4.1. Availability. Subject to the terms herein, Service Provider will make SCM Available 99.5% of the time within each calendar month and will use commercially reasonable efforts to exceed such standards.

The calculation of Availability shall be cumulative for the measurement period, which shall begin at the start of each calendar month and end at the start of the following calendar month.

Service Provider, Inc. MCSA004-02 Service Attachment 3 Page 11

4.2. Downtime. The calculation of Downtime shall exclude Scheduled Maintenance and Emergency Maintenance. Downtime is cumulative for the measurement period, which shall begin at the start of each calendar month and end at the start of the following calendar month and which shall not be double counted in multiple measurement periods.

4.3. Scheduled Maintenance. Service Provider shall be entitled to perform Scheduled Maintenance on SCM at the sole discretion of Service Provider, provided (a) Subscribing Entity will receive at least 24 hours prior email notice sent to the email listed in Subscribing Entity’s account, of the date, time and expected duration thereof and (b) such maintenance will where possible, be conducted at times likely to cause insignificant disruption to the operation of SCM. Typical Scheduled Maintenance (for example purposes only) is 15 minutes on Tuesday and Thursday maintenance windows of 5:30 a.m. EST, as necessary.

4.4. Emergency Maintenance. If Emergency Maintenance is required, Service Provider will use commercially reasonable efforts to contact and notify Subscribing Entity in advance and provide the expected start time and the planned duration of the Emergency Maintenance and whether Service Provider expects all or any part of SCM to be unavailable during the Emergency Maintenance.

4.5. Subscribing Entity Error. In the event an error or outage is the direct result of Subscribing Entity or third party acts or omissions, any Downtime and/or availability issues that result will not be counted against Service Provider’s availability standards above.

4.6. Service Level Credits. Once the cumulative minutes of Downtime in any one calendar month exceeds four Shours, Service Provider shall provide Subscribing Entity with one service level credit for each two hour period of Downtime that is over four hours. One service level credit shall equal one percent 1% of the fee paid by Subscribing Entity for this Exhibit. All service level credits shall be in the form of credits against monies due to Service Provider. Service level credits from any accrued credits during a month will be paid to Subscribing Entity by crediting the invoice provided by Service Provider for the year immediately following that year during which such credits accrue. Regardless of Downtime or Service Provider’s failure to meet the standards set forth herein, the maximum credits, and thus the maximum discount that shall be provided to Subscribing Entity during any given year is 20. In the event that 20 credits have accumulated during a single year, no further credits will be given to Subscribing Entity. Credits may not be “rolled over” or accumulate for future use and shall only be applicable as a discount on subscription price for the year immediately following the year in which such credits accrue.

5. Premier Support Services.

5.1. Assumptions. The Performance Standards described herein are subject to the following assumptions, constraints, and dependencies: (i) information provided by Subscribing Entity to Service Provider as required for the Premier Support Services and in support of this Exhibit will be accurate and timely; (ii) Service Provider’s procedures and delivery of the Premier Support Services may be affected by changes in relevant applicable laws or regulations; (iii) failure of Subscribing Entity to provide reasonable assistance that may be necessary for the target resolution of a Support Incident may impact Response Times; (iv) failure of Subscribing Entity to abide by the terms of this Exhibit or the Agreement may materially impact Service Provider’s performance of the services described in this Exhibit; and (v) Service Provider’s performance of the Premier Support Services and provision of the service levels described in this Exhibit are contingent upon the non-occurrence of a force majeure event.

5.2. Designated Contact. Subscribing Entity may appoint and authorize specialized individuals, up the number of stated in the Order Form, to act as Designated Contacts. A Designated Contact shall be a highly skilled individual who can understand the advice of Service Provider personnel. To change a Designated Contact, Subscribing Entity must submit the desired change to Service Provider via email.

The email must include the name of the former contact, and the name, address, telephone number, and email address of the new Designated Contact.

5.3. Service Account Manager. Service Provider shall appoint one individual of Service Provider to act as a Service Account Manager. Subscribing Entity may contact its Service Account Manager between 8:30 a.m. (EST) to 8:00 p.m. (EST) for purposes of understanding the Premier Support Services provided herein and obtaining account management services.

5.4. 24x7 Support. Service Provider shall provide Subscribing Entity with access to technicians 24 hours per day, seven days per week either by telephone, email, or Service Provider’s ticketing system. If a

Service Provider, Inc. MCSA004-02 Service Attachment 3 Page 12 call is not answered, Subscribing Entity shall leave a brief description of the Support Incident and a return telephone number. A technician will respond to the call within one hour of receipt.

5.5. Service Reports. Service Provider shall provide Subscribing Entity with a service report within ten business days at the end of every three-month period (“Quarter”) containing Support Incident information for the previous three months, such as problem descriptions, open and close dates, current status, assigned technician, and resolution reports. A quarter shall begin on the first day of a calendar month and each quarter shall run consecutively, commence at the conclusion of the previous quarter.

Service Provider and Subscribing Entity shall agree separately on the month for which the first quarter commences. Provided that monthly service reports are included in the Premier Support Services and Subscribing Entity has paid all applicable fees, Service Provider shall provide Subscribing Entity with a service report within ten business days at the end of every calendar month containing the above information for the previous calendar month, in addition to the service report provided quarterly as stated above.

5.6. Support Incidents. During the Term, Subscribing Entity shall report problems to Service Provider by telephone at Service Provider’s designated support telephone number, email address, or website form, and shall furnish a full description of the problem. Subscribing Entity shall, upon Service Provider’s request, also provide written problem descriptions and supporting technical information as required by Service Provider. Support Incidents submitted via email will be answered via email. Upon receipt of all necessary information, the Support Incident shall be classified by Service Provider into one of the four categories described in Table A. Service Provider shall respond to Support Incidents in accordance with the Priority Level assigned by Service Provider. Table B sets forth the targeted time for Service Provider to provide actions for each Support Incident based upon the Priority Level assigned to the Support Incident, as measured from receipt of the Support Incident from Subscribing Entity to the target resolution, respectively. For a Support Incident classified as Low Priority, the Support Incident will be resolved by providing an answer to the question regarding the use or operation of SCM. For Support Incident classified as L1 Critical Priority, L2 High Priority, or L3 Medium Priority, Service Provider shall attempt to provide a bug fix or workaround as per the Performance Standards.

A Support Incident may require the involvement of several Designated Contacts or a direct one to one interaction with a single technician. Response Times and target resolutions exclude code fixes, customized configuration, and product enhancements, and may include workaround solutions based on the type of Support Incident and Priority Level. Subscribing Entity acknowledges that the target resolution of a Support Incident may vary depending on the nature and seriousness of the Support Incident, and that no guarantee is made by Service Provider as to the time within which such resolution will be completed. Service Provider may choose to defer resolution of Support Incidents until release of the next major or minor update of the Service Provider product or service.

5.7. Subscribing Entity Obligations. Subscribing Entity’s responsibilities and obligations in support of this Exhibit and the Premier Support Services include the following: (i) providing information and reasonable assistance as may be required by Service Provider for performing the Premier Support Services; (ii) adhering to policies and processes established by Service Provider for reporting service failures and incidents and prioritizing service requests; (iii) making a Designated Contact representative available to consult with Service Provider for resolving service-related incidents or requests; and (iv) paying fees and costs stated in the Order Form and as required by the Agreement.

5.8. Exclusions. Subscribing Entity shall not have any remedies under this Exhibit to the extent any claim is due to: (i) use of SCM or Certificates outside the scope described in the Agreement; or (ii) Subscribing Entity equipment or third-party software, hardware or network infrastructure not under the direct control of Service Provider.

5.9. Remedies. If Service Provider fails to provide the Premier Support Services herein, Subscribing Entity may terminate this Exhibit upon 30 calendar days written notice to Service Provider and, provided that Subscribing Entity has prepaid Service Provider for the Premium Support Services, Service Provider shall refund pro-rata, from the termination date of this Exhibit, any Premier Support Service fees that Subscribing Entity has prepaid. Subscribing Entity acknowledges and agrees that this section describes Subscribing Entity’s sole and exclusive remedy for Service Provider’s material failure to provide the Premier Support Services.

Service Provider, Inc. MCSA004-02 Service Attachment 3 Page 13

Table A Support Incident Priority Levels and Descriptions

SUPPORT INCIDENT PRIORITY LEVEL DESCRIPTION

L1 Critical This is an emergency condition that prevents material business operations.

L2 High This is a condition that significantly impairs the use of Service

Provider’s applications or systems to perform any material business operation.

L3 Medium One or more applications or systems are affected, but the impact on Subscribing Entity’s material business operations is not significant.

Low The reported issue does not impact Subscribing Entity’s material business operations.

Table B

Response Times

ACTION L1 CRITICAL L2 HIGH L3 MEDIUM LOW

Support Availability 24 x 7 x 365 24 x 7 x 365 24 x 7 x 365 24 x 7 x 365 Acknowledgement 5 minutes 5 minutes 5 minutes 5 minutes Status Updates 1 hour 4 hours 8 hours 48 hours Target Resolution < 4 hours < 8 hours < 12 hours < 24 hours