Master Services Agreement

This Master Services Agreement (Agreement) sets out the terms on which Fenrir Security Limited (Fenrir) provides services to its customers. It applies to each engagement recorded in an Engagement Document that incorporates this Agreement. This Agreement is published at https://fenrir.nz/legal/msa/ and each Engagement Document is bound to the version of this Agreement identified in it.

1. Definitions and interpretation

1.1In this Agreement, unless the context requires otherwise:

AI Services means third-party artificial intelligence processing services engaged by Fenrir to assist in delivering the Services, including automated summarisation, correlation, enrichment, drafting and triage.

Business Day means a day other than a Saturday, Sunday or public holiday in Christchurch, New Zealand.

Client means the entity identified as the client in an Engagement Document.

Client Data means any data, including Personal Information, that the Client discloses to Fenrir, or that Fenrir collects, accesses, generates or derives, in the course of providing the Services.

Confidential Information means any information of a party (the Disclosing Party) disclosed to, obtained by, or generated by the other party (the Recipient Party) in connection with this Agreement:

(a)relating directly or indirectly to the business or affairs of the Disclosing Party, in any form, including business, technical, financial, security, operational, commercial and personal information, and including the terms of this Agreement;

(b)disclosed on the express basis that the information is confidential;

(c)which would reasonably be expected to be retained as confidential; or

(d)that is Client Data.

De-identified Data means data derived from Client Data from which Personal Information and information identifying the Client has been removed or irreversibly transformed so that the Client and any individual can no longer be identified from it.

Disclosing Party has the meaning given in the definition of Confidential Information.

Engagement Document means a Statement of Work or a Service Schedule.

Fees means the fees for the Services set out in an Engagement Document.

GST means New Zealand goods and services tax, payable in accordance with the Goods and Services Tax Act 1985.

Intellectual Property means all industrial and intellectual property rights, including copyright, patents, trade marks, designs, moral rights, and rights in know-how and confidential information, whether registered or not, whether conferred by statute, at common law or in equity.

Personal Information has the meaning given in the Privacy Act.

Personnel means, in relation to a party, its employees, officers, contractors, subcontractors and agents.

Privacy Act means the Privacy Act 2020.

Recipient Party has the meaning given in the definition of Confidential Information.

Related Company has the meaning given in the Companies Act 1993.

Representatives means, in relation to a party, its Related Companies and its and their respective Personnel, professional advisers, insurers and insurance brokers.

Resold Product means third-party products, licences, subscriptions or services that Fenrir procures on the Client’s behalf and supplies to the Client, whether on a one-off or recurring basis.

Service Schedule means a document signed by the parties that records an ongoing service engagement, the Services and Fees for it and any commercial terms, and incorporates this Agreement.

Service Terms means a section of this Agreement setting out additional terms for a particular type of Service, being Service Terms 1 (Managed Detection and Response), Service Terms 2 (Virtual CISO), Service Terms 3 (Incident Response and Digital Forensics) and Service Terms 4 (Security Assessments and Testing).

Services means the services described in an Engagement Document, which may include managed detection and response and other managed security services, security consulting and advisory services (including virtual CISO services), security assessments, incident response and digital forensic services, and security engineering and architecture services.

Statement of Work or SOW means a document signed by the parties that records a one-off engagement, the Services and Fees for it and any commercial terms, and incorporates this Agreement.

Subprocessor means a third party engaged by Fenrir to process Client Data in connection with delivering the Services, including any provider of AI Services.

Subprocessor Register means the register of Subprocessors published by Fenrir at https://fenrir.nz/legal/subprocessors/.

1.2In interpreting this Agreement: headings are for convenience only; the singular includes the plural and vice versa; “including” and “includes” are not words of limitation; a reference to a statute includes amendments to and replacements of it; a reference to a party includes its permitted successors and assigns; and if there is any inconsistency, the order of precedence in clause 2.5 applies.

2. Structure of this Agreement

2.1This Agreement is published at https://fenrir.nz/legal/msa/. Each published version is identified by a version number and date, and prior versions are retained and made available by Fenrir.

2.2Each engagement is recorded in an Engagement Document, being a Statement of Work for a one-off engagement or a Service Schedule for an ongoing service. The Engagement Document incorporates the version of this Agreement identified in it. By signing the Engagement Document, the Client confirms it has read and agrees to that version.

2.3The version of this Agreement identified in an Engagement Document continues to apply to that engagement even if Fenrir later publishes a new version, unless the parties agree otherwise in writing or the engagement renews, in which case the then-current published version applies from the date of renewal. Where an engagement will renew onto a newer version, Fenrir will notify the Client at least thirty (30) days before renewal, identifying the material changes, and if the Client does not accept the new version it may elect not to renew.

2.4Fenrir may publish updated versions of this Agreement from time to time. Nothing in this clause allows Fenrir to change the terms applying to an existing engagement except as provided in clause 2.3.

2.5If there is any conflict, the following order of precedence applies, but only to the extent of the conflict: (a) the Engagement Document; (b) any applicable Service Terms; then (c) the general terms of this Agreement. The Subprocessor Register is incorporated into this Agreement by reference.

2.6Service Terms apply to an engagement only where the Engagement Document for that engagement records that Fenrir will provide the Service to which those Service Terms relate.

3. Provision of the Services

3.1Fenrir will provide the Services described in each Engagement Document with reasonable care and skill, and in accordance with any service levels set out in the applicable Engagement Document or Service Terms.

3.2Fenrir may use Subprocessors and AI Services to deliver the Services, as set out in clause 7.

3.3Fenrir may change the way in which it delivers the Services, provided the change does not reduce the Services in a way that materially disadvantages the Client.

3.4Any change to the scope of the Services must be agreed in a signed change request, or in a new or varied Engagement Document, which must record any adjustment to the Fees.

3.5If the Client requests work outside the agreed scope, Fenrir may agree to perform it, and that work is chargeable at Fenrir’s then-current rates. Performing work under this clause does not vary the agreed scope of the Services, and does not add that work to any ongoing Service.

3.6Unless the applicable Engagement Document expressly provides otherwise (including any service credit regime), service levels and response targets are targets only, and a failure to meet a target is not of itself a material breach of this Agreement.

4. Client responsibilities

4.1The Client will provide Fenrir with the access, information, systems and cooperation reasonably required for Fenrir to provide the Services, in a timely manner.

4.2The Client is responsible for the accuracy and completeness of information it provides, and, except as expressly agreed in an Engagement Document, for the back-up of its own data and for maintaining appropriate security controls in its own environment.

4.3The Client warrants that it has the authority and has obtained all consents necessary to disclose Client Data to Fenrir, and to authorise Fenrir to collect, use and disclose Client Data as contemplated by this Agreement, including any Personal Information and including disclosure to Subprocessors within and outside New Zealand.

4.4The Client indemnifies Fenrir against any loss, claim, cost or expense arising from a breach of the warranty in clause 4.3, including any claim by an individual or a regulator that Fenrir’s collection, use or disclosure of Client Data as authorised under this Agreement breached the Privacy Act because a necessary authorisation or consent had not been obtained, except to the extent the loss was caused or contributed to by Fenrir’s breach of this Agreement or negligence.

4.5Fenrir is not responsible for any loss to the extent it results from the Client’s failure to implement, or unreasonable delay in implementing, security controls, remediation or other recommendations that Fenrir has advised in the course of the Services.

5. Fees and payment

5.1The Client will pay the Fees set out in the applicable Engagement Document. Unless stated otherwise, Fees are exclusive of GST, which the Client will pay in addition.

5.2Fenrir will invoice the Fees as set out in the Engagement Document. Unless stated otherwise, invoices are payable by the 20th of the month following the date of invoice.

5.3Fenrir may charge interest on overdue amounts at the rate of two percent (2%) per month or part month from the due date until payment. The Client must pay undisputed amounts in full without set-off or deduction.

5.4If the Client disputes an invoice in good faith, it will pay the undisputed portion and notify Fenrir of the disputed portion promptly, and the parties will resolve the dispute under clause 14.

5.5Where Fenrir supplies Resold Products to the Client, the Client will pay Fenrir for them as set out in the Engagement Document or invoice. Title to, and the Client’s right to use, a Resold Product passes to the Client only on Fenrir’s receipt of payment in full for it, and its use is subject to the relevant third-party licence or other terms of supply under clause 8.3.

5.6Where Fenrir procures a Resold Product on a fixed-term basis, such as an annual licence, and the Client pays for it over time, the Client’s obligation to pay the full amount for the term is not contingent on the Client’s continued use. The whole of the amount then remaining for the term becomes immediately payable if: (a) the Client fails to pay any instalment within ten (10) Business Days of written notice that it is overdue; (b) the Client terminates the relevant engagement for convenience; or (c) Fenrir terminates the relevant engagement for the Client’s material breach or insolvency. Fenrir may suspend or reclaim a Resold Product that has not been paid for.

5.7If any undisputed amount remains unpaid ten (10) Business Days after Fenrir has notified the Client in writing that it is overdue, Fenrir may suspend the provision of the Services until the amount is paid. Suspension does not relieve the Client of its obligation to pay, and Fenrir is not responsible for any consequence of a suspension under this clause.

5.8The Client will pay Fenrir’s reasonable costs and disbursements of recovering any overdue amount, including debt collection agency fees and legal costs on a solicitor and own client basis.

6. Confidentiality

6.1Each Recipient Party will maintain as confidential and will not at any time, directly or indirectly:

(a)disclose, or permit to be disclosed to any person;

(b)copy, reproduce, reverse-engineer or transmit (by any means);

(c)use for itself or for the benefit of any person other than the Disclosing Party, for any purpose other than in connection with the purposes of this Agreement; or

(d)use to the detriment of the Disclosing Party,

any Confidential Information of the Disclosing Party, except as permitted by clause 7, as otherwise provided by this Agreement, or as authorised in writing by the Disclosing Party.

6.2A Recipient Party may disclose the Disclosing Party’s Confidential Information:

(a)where required by law or by a regulator, and will, where lawful and practicable, notify the Disclosing Party first; and

(b)to its Representatives on a “need to know” basis, as is reasonably necessary, provided that it first advises them of the confidential nature of the Confidential Information and ensures that they have agreed to keep it confidential.

6.3The obligations in this clause 6 do not apply to information that:

(a)is or becomes public other than through a breach of this Agreement;

(b)was lawfully known to the Recipient Party free of any confidentiality obligation before disclosure;

(c)is independently developed by the Recipient Party without reference to the Disclosing Party’s Confidential Information; or

(d)is lawfully received from a third party free of any confidentiality obligation.

6.4Where Fenrir discloses Confidential Information (including Client Data) to a Subprocessor in accordance with clause 7.4, Fenrir remains responsible for that Subprocessor’s compliance with the obligations in this clause 6.

6.5Subject to clause 12, on termination of this Agreement or an Engagement Document the Recipient Party will return or destroy the Disclosing Party’s Confidential Information, except for information retained to meet a legal, regulatory, insurance or professional record-keeping requirement, and routine back-ups that are overwritten in the ordinary course. Confidential Information retained under this clause remains subject to this clause 6.

6.6This clause applies in place of any prior confidentiality or non-disclosure agreement between the parties. For the avoidance of doubt, from the commencement date of the first Engagement Document incorporating this Agreement, the provisions of this clause 6 apply in substitution for any earlier disclosure of Confidential Information under any such prior agreement, and govern that earlier disclosed Confidential Information from that date.

6.7Nothing in this clause 6 limits either party’s obligations, or Fenrir’s rights, under clause 7.

6.8This clause survives termination of this Agreement.

7. Data protection and privacy

7.1In providing the Services, Fenrir processes Client Data on the Client’s behalf. Each party will comply with the Privacy Act in connection with this Agreement.

7.2Fenrir will use Client Data only to provide, manage, secure and support the Services, and as otherwise permitted by this Agreement or required by law. Fenrir will collect and process only Client Data reasonably necessary for those purposes. Fenrir will make available to the Client, on request, a description of the categories of Client Data processed for an engagement. The categories processed by each Subprocessor are recorded in the Subprocessor Register. Fenrir will not sell Client Data.

7.3The Client authorises Fenrir to collect, use and disclose Client Data as necessary to provide the Services. These authorisations, together with the Client’s warranty in clause 4.3, constitute the Client’s authorisation and consent for the purposes of the Privacy Act, including in respect of any Personal Information contained within Client Data and its disclosure to and processing by Subprocessors within and outside New Zealand.

7.4Subprocessors:

(a)The Client authorises Fenrir to engage Subprocessors to process Client Data to deliver the Services. Fenrir maintains a current register of its Subprocessors in the Subprocessor Register, setting out for each the processing activity performed and the location of processing.

(b)Where a Subprocessor provides AI Services, Fenrir will ensure that the processing is performed under terms that prohibit the use of Client Data to train the provider’s models.

(c)Fenrir remains responsible for the acts and omissions of its Subprocessors in the delivery of the Services to the same extent as for its own acts and omissions.

(d)Disclosure of Confidential Information or Client Data to a Subprocessor listed in the Subprocessor Register, for the purpose of delivering the Services, is a permitted disclosure under this Agreement, and each such Subprocessor is treated as a Representative to whom disclosure is authorised under clause 6.

7.5The Client acknowledges that certain Subprocessors process Client Data outside New Zealand. Fenrir will ensure that any Subprocessor processing Client Data outside New Zealand is required to protect it in a manner that provides comparable safeguards to those required under the Privacy Act.

7.6Fenrir may add or replace Subprocessors from time to time. Fenrir will update the Subprocessor Register and give the Client not less than thirty (30) days’ notice, via the Client’s nominated contact, of any new or replacement Subprocessor that will process Client Data. The Client may object on reasonable data protection grounds within fourteen (14) days of that notice, in which case the parties will work together in good faith to resolve the concern, including, where practicable, Fenrir not using the relevant Subprocessor to process that Client’s data (which the Client acknowledges may affect the features, manner or quality of the affected Services). If the concern cannot be resolved, either party may terminate the affected Services on thirty (30) days’ written notice.

7.7Fenrir may create and use De-identified Data derived from Client Data to operate, improve, develop and research its services, including using threat indicators observed in the course of the Services, in de-identified form, to detect and respond to threats across its client base, and to produce and publish aggregated threat intelligence, statistics and industry reporting. Fenrir will not attempt to re-identify De-identified Data, and will not disclose De-identified Data in any form that identifies the Client or any individual. Fenrir may also disclose threat indicators or other Client Data to a third party where the Client has separately authorised that disclosure in writing, including under any threat intelligence sharing programme in which the Client participates.

7.8Fenrir maintains internal controls governing its Personnel’s use of AI Services, including a requirement that Client Data is processed only through channels sanctioned by Fenrir that operate under commercial terms consistent with this Agreement.

7.9Fenrir will maintain technical and organisational security measures appropriate to the nature of the Services and the Client Data it processes, to protect Client Data against unauthorised access, loss or disclosure.

7.10Fenrir will notify the Client without undue delay after becoming aware of a security breach affecting Client Data, and will comply with its obligations under the Privacy Act in respect of any notifiable privacy breach.

8. Intellectual property

8.1Each party retains ownership of all Intellectual Property it owned before this Agreement or develops independently of it.

8.2Fenrir retains ownership of its methodologies, tools, templates, know-how and any Intellectual Property developed in the course of providing the Services. Subject to clause 8.3, Fenrir grants the Client a perpetual, non-exclusive, royalty free licence to use the deliverables provided under an engagement for the Client’s internal business purposes, including use by the Client’s professional advisers and service providers acting on its behalf.

8.3Any third-party materials, including open source components, provided or deployed as part of the Services are provided on an “as is” basis and are subject to the relevant third-party licence or other terms of supply, which the Client agrees to comply with.

8.4Detection rules, analytics, queries, playbooks, workbooks, automations, functions, infrastructure-as-code, deployment templates and similar content that Fenrir develops or deploys in the Client’s environment to deliver the Services (the Fenrir Toolkit) are Fenrir’s Intellectual Property and Confidential Information, are not deliverables, and are licensed to the Client only for the delivery of the Services by Fenrir. Deliverables produced for the Client under an engagement are not part of the Fenrir Toolkit. On expiry or termination of the relevant engagement, Fenrir may remove the Fenrir Toolkit from the Client’s environment.

9. Warranties

9.1Each party warrants that it has the authority to enter into and perform its obligations under this Agreement.

9.2Fenrir warrants that it will perform the Services with reasonable care and skill.

9.3To the maximum extent permitted by law, and except as expressly set out in this Agreement, all warranties, guarantees and terms implied by statute or otherwise are excluded. Where the Client acquires the Services for the purposes of a business, the parties agree that the Consumer Guarantees Act 1993 does not apply, and, to the extent they are each in trade, that sections 9, 12A and 13 of the Fair Trading Act 1986 do not apply, in each case to the extent it is fair and reasonable to contract out.

9.4Fenrir warrants that it will maintain, throughout the term of each engagement, professional indemnity insurance, information technology liability insurance and cyber liability insurance appropriate to the Services, with limits of not less than $2,000,000 for professional indemnity and $1,000,000 for cyber liability. Fenrir will provide evidence of cover on the Client’s reasonable request.

10. Liability

10.1Neither party is liable to the other for any indirect or consequential loss, or for loss of profit, revenue, data, or business, arising in connection with this Agreement.

10.2Subject to clauses 10.3 and 10.4 below, each party’s total liability for any event, or series of related events, in connection with this Agreement is limited to the total Fees paid by the Client under this Agreement, across all Engagement Documents, in the twelve (12) months before the event (or the first of the related events) giving rise to the liability.

10.3Fenrir’s total aggregate liability for loss arising from a breach of clause 6 (Confidentiality) or clause 7 (Data protection and privacy), including any privacy breach or any unauthorised access to, loss of, or disclosure of Client Data, is limited to $1,000,000.

10.4Nothing in this Agreement limits or excludes either party’s liability for: (a) death or personal injury caused by its negligence; (b) fraud or wilful misconduct; (c) any liability that cannot be limited or excluded by law; (d) the Client’s obligation to pay Fees and amounts owing for Resold Products; or (e) a party’s obligations under an indemnity in this Agreement.

10.5No claim in connection with this Agreement may be brought more than twelve (12) months after the party bringing it became aware, or ought reasonably to have become aware, of the circumstances giving rise to the claim. This clause does not apply to a claim by Fenrir for unpaid Fees or amounts owing for Resold Products, or to any liability that cannot be limited by law.

11. Term and termination

11.1This Agreement applies from the commencement of the first Engagement Document incorporating it and continues while any Engagement Document remains in force. Each engagement has the term set out in its Engagement Document.

11.2Either party may terminate an Engagement Document, or this Agreement, by written notice if the other party: (a) commits a material breach that is not remedied within thirty (30) days of written notice; or (b) becomes insolvent or unable to pay its debts as they fall due.

11.3Unless the applicable Engagement Document states otherwise, either party may terminate an engagement for convenience on ninety (90) days’ written notice. Where the Engagement Document states a different convenience termination right or notice period, that provision applies.

11.4On termination of an Engagement Document, or this Agreement, the Client will pay for Services provided up to the date of termination, and each party will deal with Confidential Information and Client Data in accordance with clauses 6 and 12.

11.5Termination or expiry does not affect rights or obligations accrued before it. Clauses 5 (in respect of amounts owing), 6 (Confidentiality), 7 (Data protection, while Fenrir holds Client Data), 8 (Intellectual property), 10 (Liability), 12 (Return and deletion of Client Data), 14 (Dispute resolution) and 15.7 (Non-solicitation), each indemnity, and any provision that by its nature survives, survive termination or expiry of an Engagement Document or this Agreement.

11.6On expiry or termination of an Engagement Document, or this Agreement, Fenrir will, at the Client’s written request made no later than ten (10) Business Days after the date of expiry or termination, provide reasonable transition assistance to the Client or an incoming provider for up to twenty (20) Business Days, at Fenrir’s then-current rates, including handover of Client Data and deliverables. The parties may agree in writing to extend that period. Transition assistance does not include providing or licensing the Fenrir Toolkit.

12. Return and deletion of Client Data

12.1On termination of an Engagement Document, or this Agreement, Fenrir will, on the Client’s written request made within thirty (30) days, return or delete Client Data in Fenrir’s possession or control, subject to any legal retention requirement and to routine back-ups that are overwritten in the ordinary course. If the Client makes no request within that period, Fenrir will delete Client Data within ninety (90) days after the end of that period, subject to the same exceptions.

13. Force majeure

13.1Neither party is liable for any delay or failure to perform its obligations (other than payment obligations) caused by an event beyond its reasonable control, provided it takes reasonable steps to mitigate the effect and resumes performance as soon as reasonably practicable. If a force majeure event prevents performance of an engagement for more than thirty (30) consecutive days, either party may terminate the affected engagement by written notice.

14. Dispute resolution

14.1If a dispute arises between the parties in relation to this Agreement or an Engagement Document, the parties will first seek to resolve it informally between their authorised representatives. If they are unable to do so within ten (10) Business Days, each party will escalate the dispute to a senior representative of its organisation. If the dispute is not resolved within a further ten (10) Business Days, either party may refer it to mediation in accordance with clause 14.2.

14.2The parties agree to mediate any dispute in accordance with the Resolution Institute standard Mediation Agreement (NZ version), before commencing court proceedings. The mediation will be conducted by a mediator and at a fee agreed by the parties. Failing agreement between the parties, the mediator will be selected by the Chair for the time being of Resolution Institute.

14.3Despite the existence of a dispute, each party will continue to perform its obligations under this Agreement and each Engagement Document. This clause does not limit Fenrir’s rights under clause 5.7.

14.4Nothing in this clause prevents either party from commencing court proceedings relating to any dispute arising from this Agreement or any engagement at any time where that party seeks urgent interlocutory relief.

15. General

15.1This Agreement (as the version identified in an Engagement Document) together with that Engagement Document is the entire agreement between the parties in respect of its subject matter, and supersedes all prior agreements, representations and understandings in respect of that subject matter, including any prior terms of trade and, as provided in clause 6.6, any confidentiality or non-disclosure agreement between the parties. Any engagement governed by prior terms of trade continues to be governed by those terms until it expires, terminates or is migrated by written agreement, and this Agreement supersedes prior agreements only in respect of engagements recorded in an Engagement Document incorporating it.

15.2An Engagement Document may only be varied by a document in writing signed by both parties. This Agreement may be updated only as provided in clause 2.

15.3Fenrir may assign or novate this Agreement to a Related Company or in connection with a sale of its business. Otherwise, neither party may assign without the other’s prior written consent, not to be unreasonably withheld.

15.4Notices under this Agreement must be in writing and sent to the nominated contact set out in the Engagement Document, and may be given by email.

15.5No failure or delay in exercising a right is a waiver of it. If any provision is held unenforceable, the remaining provisions continue in force. Nothing in this Agreement creates a partnership, joint venture or agency between the parties, and neither party has authority to bind the other. This Agreement may be signed in counterparts and by electronic signature.

15.6This Agreement is governed by the laws of New Zealand, and the parties submit to the non-exclusive jurisdiction of the New Zealand courts.

15.7During the term of each engagement and for twelve (12) months afterwards, the Client will not, without Fenrir’s prior written consent, directly or indirectly solicit for employment or engagement any of Fenrir’s Personnel who were involved in providing the Services. A general advertisement not specifically directed at Fenrir’s Personnel is not a breach of this clause.

15.8With the Client’s prior written approval, Fenrir may identify the Client as a customer, including by name and logo, in its marketing materials and client lists. The Client may withdraw that approval at any time on written notice.

Service Terms 1 — Managed Detection and Response

These Service Terms apply where an Engagement Document records that Fenrir will provide managed detection and response services. In accordance with clause 2.5 they prevail over the general terms of this Agreement to the extent of any conflict for these Services.

1. The Services

1.1Managed detection and response services (the MDR Services) may include: monitoring of the Client’s security telemetry; detection, triage and investigation of threats; alerting and escalation; response actions within the agreed scope; and regular reporting. The in-scope telemetry sources, environments, coverage hours and reporting are set out in the Engagement Document.

2. Access and platforms

2.1The MDR Services are delivered using the Client’s security platforms and telemetry sources, accessed as set out in the Engagement Document, which may include delegated or federated access to the Client’s environment. The Client will grant and maintain the access, licensing, configuration and connectivity necessary for Fenrir to deliver the MDR Services. The specific platforms and access model for an engagement are set out in the Engagement Document.

2.2The MDR Services depend on third-party platforms, networks and services that Fenrir does not control, including cloud, connectivity and identity services. Fenrir is not responsible for the availability, performance, changes to, or defects in those platforms, networks or services, or for any resulting gap in monitoring or response.

3. Client dependencies and shared responsibility

3.1The Client is responsible for: (a) maintaining the ingestion of telemetry from in-scope sources; (b) maintaining the platform and product licences required for the MDR Services; (c) maintaining the health, connectivity and configuration of the underlying systems; and (d) promptly notifying Fenrir of material changes to its environment that affect the MDR Services.

3.2Fenrir can detect and respond only on the basis of the telemetry actually available to it. Fenrir is not responsible for any event that it did not detect or respond to because the relevant telemetry was unavailable, incomplete, delayed, disabled, or outside the scope set out in the Engagement Document.

3.3Fenrir will monitor the health of in-scope telemetry feeds as part of the MDR Services and will notify the Client promptly if it becomes aware that an in-scope telemetry source has stopped reporting or is materially degraded.

4. Authorisation to take response actions

4.1The Client authorises Fenrir to take the response actions recorded as pre-authorised in the Engagement Document, such as isolating or containing an affected device, disabling or restricting a user account, or blocking an indicator, without prior approval.

4.2For response actions that are not pre-authorised, Fenrir will seek the Client’s approval before acting, except where Fenrir reasonably considers that immediate action is necessary to limit imminent harm, in which case Fenrir may take reasonable action and notify the Client promptly.

4.3The Client acknowledges that response actions may interrupt, restrict or take offline affected systems or accounts, and accepts that consequence where the action taken was reasonable in the circumstances.

5. Limitations of the service

5.1The Client acknowledges that the MDR Services reduce but do not eliminate security risk. Fenrir does not warrant or guarantee that it will detect, prevent or respond to all threats, incidents or compromises.

5.2Detection depends on the telemetry available, the detection logic in place, and current threat intelligence. New, novel or evolving threats, and activity that does not generate telemetry available to Fenrir, may not be detected.

6. Escalation and Client responsiveness

6.1The Client will maintain a nominated contact able to receive and act on escalations at the coverage level set out in the Engagement Document, and will act on Fenrir’s escalations and recommendations in a timely manner.

6.2Fenrir is not responsible for loss arising from the Client’s failure or delay in acting on an escalation or recommendation.

7. Onboarding and tuning

7.1The Client acknowledges that the MDR Services include an initial onboarding and tuning period during which detections are calibrated, and that detection coverage and alert quality develop over that period.

8. Relationship to incident response

8.1The MDR Services include triage and response within the agreed scope. Where an incident requires incident response or digital forensic work beyond that scope, Service Terms 3 (Incident Response and Digital Forensics) and a separate Engagement Document may apply.

Service Terms 2 — Virtual CISO

These Service Terms apply where an Engagement Document records that Fenrir will provide virtual CISO (vCISO) services. In accordance with clause 2.5 they prevail over the general terms of this Agreement to the extent of any conflict for these Services.

1. The Services

1.1vCISO services (the vCISO Services) are advisory services in which Fenrir provides one or more of its personnel to advise the Client on security strategy, governance, risk management, policy, security programme direction, and executive or board reporting. The specific services for an engagement are set out in the Engagement Document.

2. Advisory role and officer status

2.1The vCISO Services are advisory only. Fenrir’s personnel provide advice and support to the Client’s management and do not act as, and must not be held out as, a director, officer or employee of the Client.

2.2The Client will not: (a) appoint or record any Fenrir personnel as a director or officer of the Client in any register, document or filing; (b) hold any Fenrir personnel out to any person as an officer of the Client; (c) require any Fenrir personnel to exercise, or purport to exercise, the functions, powers or duties of an “officer” as that term is used in the Companies Act 1993 or the Health and Safety at Work Act 2015; or (d) require any Fenrir personnel to make, or participate as a decision-maker in, board-level governance or management decisions of the Client.

2.3The Client’s own directors and officers retain all governance authority, decision-making and accountability for the Client. The role of the vCISO is to advise; decisions and their acceptance remain the Client’s.

3. Indemnity for deemed officer status

3.1If, despite clause 2 of these Service Terms, any Fenrir personnel providing the vCISO Services is deemed or alleged to be an officer or director of the Client, the Client indemnifies Fenrir and that individual against any liability, loss, claim, cost or expense arising from that status or alleged status, except to the extent caused by Fenrir’s fraud or wilful misconduct.

4. Conflicts of interest

4.1The Client acknowledges that Fenrir provides advisory, engineering, managed security and assessment services, and that the vCISO Services do not preclude Fenrir from providing, proposing or being engaged for other services to the Client. Fenrir will disclose any material conflict of interest arising from the vCISO role, and the parties will manage it in good faith.

5. Limitations of advice

5.1Advice provided under the vCISO Services is given at a point in time, based on the information available to and provided by the Client. The Client is responsible for its own compliance with applicable laws and standards, and for deciding whether to accept and act on any recommendation and any associated risk.

5.2Fenrir does not warrant or guarantee that following its advice will prevent a security incident or ensure compliance with any law or standard.

6. Named individual and continuity

6.1The vCISO Services are provided through a named individual identified in the Engagement Document. Fenrir may substitute that individual with a person of comparable competence and experience, on reasonable notice to the Client.

Service Terms 3 — Incident Response and Digital Forensics

These Service Terms apply where an Engagement Document records that Fenrir will provide incident response or digital forensic services. In accordance with clause 2.5 they prevail over the general terms of this Agreement to the extent of any conflict for these Services.

1. The Services

1.1Incident response and digital forensic services (the IR Services) may include: incident triage and scoping; containment, eradication and recovery support; forensic collection, preservation and analysis of data and systems; threat hunting related to an incident; and incident reporting. The specific services for an engagement are set out in the Engagement Document.

2. Retainer and priority response

2.1Where the Engagement Document records a monthly retainer, the retainer secures priority access to Fenrir’s incident response capability and Fenrir’s readiness to respond.

2.2Fenrir will use commercially reasonable efforts to respond to a declared incident as a priority. Priority response means Fenrir will prioritise a retained Client’s incident ahead of non-retained work. It is not a committed response time, service level, or availability guarantee. No specific or guaranteed response times apply unless expressly stated in the Engagement Document.

2.3The retainer covers readiness and priority access only. Unless the Engagement Document states that a number of incident response hours are included, IR Services are charged in addition to the retainer at the rates set out in the Engagement Document, including any after-hours rates. Where included hours are stated, they do not carry over between months unless the Engagement Document states otherwise.

3. Authorisation to act

3.1The Client authorises Fenrir, for the purpose of responding to an incident, to access, acquire, image, collect, preserve, examine and analyse the Client’s systems, networks, accounts and data, and to take reasonable containment and remediation actions.

3.2Where an affected system, account or environment is not owned by the Client, including a cloud tenant or a system managed by a third party, the Client warrants that it has the authority, or has obtained the consent, necessary to authorise Fenrir to perform the IR Services in respect of it.

4. Interception of communications

4.1The Client acknowledges that containment, monitoring and analysis during an incident may involve intercepting or accessing communications on the Client’s systems. The Client authorises Fenrir to do so, and agrees that in carrying out the IR Services Fenrir acts as agent of the Client, who is a party to those communications.

5. Costs and continuation of an incident

5.1Before commencing work on an incident, Fenrir will obtain the Client’s approval to proceed, including an initial estimate of the hours or costs to begin the investigation, except where immediate action is necessary to limit imminent harm, in which case Fenrir may take reasonable initial steps and seek the Client’s approval promptly.

5.2Fenrir will keep the Client informed as approved hours are consumed, and will seek the Client’s further approval before materially exceeding the approved estimate. The Client remains liable for approved costs incurred until the incident is concluded or the Client instructs Fenrir in writing to suspend or stop the response.

5.3The Client acknowledges that the scale and duration of an incident cannot be known in advance, that estimates are estimates only, that the fees for an incident are not capped by the retainer, and that after-hours work is charged at the applicable rates in the Engagement Document.

6. Client responsibilities

6.1The Client will make timely decisions, provide access and accurate information, and make available the personnel required for Fenrir to perform the IR Services.

6.2The Client remains responsible for its own legal and regulatory obligations arising from an incident, including any notification to the Office of the Privacy Commissioner, affected individuals, or other regulators. Fenrir may assist but does not assume those obligations.

7. No guarantees and service limitations

7.1The Client acknowledges that Fenrir does not warrant or guarantee that it will contain an incident, prevent or recover any loss or data, eradicate a threat, restore any system, or identify the cause or source of an incident.

7.2The IR Services are performed on the basis of the information and access available at the time and in reliance on information provided by the Client as accurate and complete.

7.3The Client acknowledges that containment, eradication and recovery actions may interrupt, degrade or take offline the Client’s systems, and accepts those risks and consequences.

8. Serious criminal conduct and objectionable material

8.1The Client acknowledges that, in the course of the IR Services, Fenrir may form a reasonable belief of, or identify evidence of, serious criminal conduct, or may encounter objectionable material. In such cases Fenrir may be required or entitled to notify law enforcement or another authority, and any such notification is not a breach of Fenrir’s confidentiality obligations under clause 6 or clause 7 of this Agreement.

9. Evidence handling and retention

9.1Fenrir will take reasonable care in the handling of data and material collected during an engagement.

9.2Fenrir will retain forensic images and collected evidence for the period stated in the Engagement Document, or if none is stated, for six (6) months after the conclusion of the engagement, after which it may be securely destroyed. The Client may request return or extended retention in writing before that period ends, or at any later time while the material remains in Fenrir’s possession. Fenrir will not destroy material that the Client has notified Fenrir in writing is subject to a legal hold, for as long as that hold remains in place. This clause applies in place of clause 12.1 in respect of forensic images and collected evidence.

10. Scope of forensic services

10.1Unless the Engagement Document expressly states otherwise, the digital forensic services are provided for the Client’s internal investigation and remediation purposes only.

10.2The IR Services do not include expert witness services, the giving of evidence or testimony, litigation support, or the preparation of material to an evidential standard for use in legal or court proceedings. Fenrir does not warrant that any collection, analysis or report will meet the requirements for admissibility in any proceeding. Any such services, if required, must be separately scoped and agreed in writing, and Fenrir may decline to provide them.

11. Legal privilege

11.1Where the Client wishes an engagement to be conducted under legal privilege, Fenrir may be engaged through the Client’s legal counsel for that purpose. Any privilege is the Client’s to claim, maintain or waive, and the Client is responsible for managing it.

12. Insurer-funded incidents

12.1Where an incident is funded in whole or part by the Client’s cyber insurer, the Client acknowledges that the insurer may impose panel, approval or process requirements that apply alongside these Service Terms, and that the Client remains liable for any fees not met by the insurer.

12.2Where the Client’s insurer, breach counsel or their representatives are involved in an incident, the Client authorises Fenrir to communicate with them and to provide them with information about the incident and the IR Services as reasonably required.

Service Terms 4 — Security Assessments and Testing

These Service Terms apply where an Engagement Document records that Fenrir will provide security assessment or security testing services, including any assessment involving active scanning, exploitation or other intrusive techniques. In accordance with clause 2.5 they prevail over the general terms of this Agreement to the extent of any conflict for these Services.

1. The Services

1.1Security assessment and testing services (the Assessment Services) may include configuration and architecture reviews, vulnerability assessments, security testing, penetration testing and scanning. The specific scope, targets, methods, exclusions and testing window for an engagement are set out in the Engagement Document.

2. Authorisation to test

2.1The Client authorises Fenrir to access, scan and test the systems, networks, applications and environments identified in the Engagement Document, using the methods described in it, during the agreed testing window. Fenrir will not test systems or use methods outside that agreed scope without the Client’s prior written approval.

2.2Where a target system is not owned by the Client, including systems hosted or managed by a third party, the Client warrants that it has obtained all authorisations and consents necessary for Fenrir to perform the Assessment Services on it, and will provide evidence of them on request.

2.3The Client indemnifies Fenrir against any claim by a third party arising from testing performed within the agreed scope in reliance on the Client’s warranty in clause 2.2 of these Service Terms.

3. Acknowledged risks

3.1The Client acknowledges that security testing carries inherent risk, and that testing may degrade performance, interrupt services or, in rare cases, cause systems to fail or data to be lost or corrupted, despite reasonable care. The Client is responsible for ensuring appropriate back-ups exist before the testing window.

4. No guarantee of findings

4.1The Assessment Services identify vulnerabilities and weaknesses observable within the agreed scope, methods and window. Fenrir does not warrant or guarantee that it will identify every vulnerability or weakness, and a report that identifies no or few findings is not an assurance that the tested systems are secure.

4.2Findings reflect the state of the tested systems at the time of testing, and may cease to be accurate as systems, configurations and threats change.

5. Handling of findings

5.1Assessment reports and findings are the Client’s Confidential Information. Vulnerabilities identified during testing will be disclosed to the Client and not to any third party, except as required by law or as the Client directs in writing.