Rehydrate Ready Service Addendum
REHYDRATE READY SERVICE ADDENDUM
The terms set forth in this Rehydrate Ready Service Addendum (this “Addendum”) govern Absolute’s standard offering for the Rehydrate Ready service for the Secure Endpoint Products, as revised from time to time (“Rehydrate Ready Service”). This Addendum is applicable if the Rehydrate Ready Service: (i) is included in the edition of the Secure Endpoint Products ordered by Customer under an Order Form, or (ii) is otherwise ordered by Customer under an Order Form. Capitalized terms used but not defined in this Addendum have the meanings given to them in the Secure Endpoint Products Addendum available at https://www.absolute.com/company/legal/secure-endpoint-products-addendum, or if not defined in the Secure Endpoint Products Addendum, then the Master Subscription Agreement or other agreement between Customer and Absolute governing Absolute’s provision of the Secure Endpoint Products to Customer (the “Agreement”), the terms and conditions of which are hereby incorporated into this Addendum by reference. The Rehydrate Ready Service constitutes Services for the purposes of the Agreement.
1. Definitions. In this Addendum:
“Extraordinary Software Failure” means an operating system (“OS”), driver, or application software failure that renders a Provisioned Device inaccessible or inoperable.
“Impacted Device” means a Provisioned Device that is impacted by Ransomware, other Malware, or an Extraordinary Software Failure and for which Customer wishes to request Service Delivery after a Qualifying Incident occurs, in accordance with Section 3 below.
“Incident Manager” means a named individual from Customer’s security team who will act as Absolute’s primary contact for the Rehydrate Ready Service.
“Incident Manager Contact Information” means, with respect to the Incident Manager, the first and last name, title, email address, phone number and mobile phone number.
“Incident Response Fees” means the applicable fees to be paid by Customer to Absolute for Service Delivery when a Qualifying Incident occurs.
“Malware” means malicious third-party software that infects a Provisioned Device and maliciously impacts its operation through means that may include but not be limited to a denial of service; performing key logging; data extraction, or other intelligence gathering and reconnaissance; or facilitating the lateral movement, command and control, or other operations of Ransomware.
“Provisioned Device” means a Device that is actively enrolled with the Hosted Service and has been provisioned to use the Rehydrate and Reach functionality of the Secure Endpoint Products at the time a Qualifying Incident occurs.
“Qualifying Incident” means the occurrence of a unique Ransomware, Malware, or Extraordinary Software Failure instance on one (1) or more Provisioned Devices.
“Quarantine” means executing a script on an Impacted Device for the purposes of enabling Windows Firewall and blocking inbound and outbound network communications except to the Hosted Service or such other 3rd party services as may be explicitly “whitelisted” (e.g., to enable Absolute or third-party Endpoint Protection (“EPP”) or Endpoint Management (“EMM”) application(s) to communicate with its associated services).
“Ransomware” means malicious third-party software that infects a Provisioned Device and renders it inoperable through means that may include but not be limited to encryption of data stored on the Provisioned Device for the purpose of extracting a payment (i.e. ransom) in exchange for restoration of such Provisioned Device’s operability.
“Restoration” means the restoration of an Impacted Device to an operable state through: (i) removal of the Ransomware or Malware, restoration of a trusted OS image, and removal of the device from Quarantine; or (ii) repair or remediation of the Extraordinary Software Failure, as applicable to the type of impact. For avoidance of doubt: (a) successful Restoration may be based on re-imaging the Impacted Device as means of Ransomware or Malware removal; (b) successful Restoration does not require that all of the Impacted Device’s data be restored as a condition of Restoration; and (c) Absolute shall not be responsible for any loss of data or for providing or performing any data backup or restoration services or operations.
“Service Actions” means one or more operations performed on a Provisioned Device through the Hosted Service for the purposes of: (i) identifying whether it is an Impacted Device; (ii) executing one or more playbooks or scripts; (iii) performing a Device Freeze Operation; (iv) performing end user messaging via the Hosted Service; and/or (v) performing repair or reinstall operations for one or more applications.
“Service Delivery” means the performance of one or more Service Actions to identify, Quarantine, and assist in the Restoration of Impacted Device(s).
“Service Delivery Period” means the thirty (30) day period commencing on the date of Customer’s written notice to Absolute of the occurrence of a Qualifying Incident for which Customer wishes Absolute to perform an instance of Service Delivery.
“Service Delivery Readiness Assessment” means the initial assessment of Customer’s readiness for remediation of a Qualifying Incident as performed following Customer’s initial order of the Rehydrate Ready Service and enrollment and provisioning of the Rehydrate Ready Service. Such assessment may identify actions that Customer must perform prior to and as a condition of Absolute’s subsequent performance of an instance of Service Delivery (including, without limitation, enrollment and provisioning of the Rehydrate Ready Service; the generation and hosting of a trusted OS image that is known and warranted by Customer to be free of Ransomware or Malware; and related service configurations). Customer agrees and acknowledges that failure to perform such actions in a timely fashion shall entitle Absolute, in its sole and absolute discretion, to reject provision of Service Delivery.
2. Service Delivery Requirements. In order to be eligible to request provision of Service Delivery: (i) Customer must have completed the enrollment and provisioning of Rehydrate Ready Service, the Service Delivery Readiness Assessment, and any related actions identified by Absolute in applicable documentation as part of the Service Delivery Readiness Assessment. Notwithstanding the foregoing, Customer will not be eligible to request Service Delivery within a particular 12-month period if Customer has already had two (2) Qualifying Incidents in the preceding 12-month period.
3. Service Delivery. Not more than twice per 12-month period during the Subscription Term (unless separately agreed to by Absolute in writing under a statement of work, which will involve additional Professional Services fees), Customer may request Service Delivery by submitting a request in writing to Absolute’s Support Services team, which shall include the quantity and Impacted Device identifiers for the devices for which the Service Delivery is to be activated. Upon Absolute’s receipt of Customer’s request and Absolute’s written confirmation of Customer’s eligibility (each such confirmed request a “Service Delivery Request”), and subject to the terms set forth herein (including Sections 4 and 5 below), Absolute will use commercially reasonable efforts over the Service Delivery Period, and up to the number of hours specified in its then-current published pricing and terms for the Rehydrate Ready Service, to provide Service Delivery in connection with Impacted Device(s), and Customer agrees to fully cooperate with such efforts.
4. Customer Obligations. Within twenty-four (24) hours of any Service Delivery Request, Customer agrees to provide Absolute with: (i) a designated Incident Manager and Incident Manager Contact Information; (ii) all available information on the Qualifying Incident (including, without limitation, for Ransomware or Malware, any known information on the name, location, and hashes of associated files, processes, etc.; for Extraordinary Software Failure, any known information on the name, location, and hashes of failing software, associated processes, crash logs); (iii) all available information on Impacted Devices (to the extent then-currently known), including, without limitation, Impacted Device serial numbers, or other Impacted Device identifying information; and (iv) such reasonable administrative access as may be required by the Hosted Service for the purpose of assisting Customer in performing Service Actions necessary to effect Restoration.
5. Invoicing and Payment of Incident Response Fees. Upon receipt of a Service Delivery Request, Absolute will invoice Customer for the applicable Incident Response Fees. The Incident Response Fees will be deemed to be Fees as defined in the Agreement, and Customer shall pay the invoiced Incident Response Fees in accordance with the terms of the Agreement, unless otherwise agreed by Customer and Absolute in writing. Unless otherwise agreed by Customer and Absolute in writing, the Incident Response Fees shall be based on the quantity of Impacted Devices for which Service Delivery and Service Actions are performed, in accordance with Absolute’s then-current published fees for the Rehydrate Ready Service.
6. Rehydrate Ready Service Limitations. Customer acknowledges and agrees that:
(a) the Rehydrate Ready Service may be limited or unavailable, and Absolute will have no obligations under this Addendum or the Agreement with respect to an Impacted Device in the following circumstances: (i) the Impacted Device does not contact the Hosted Service pre-incident or post-incident; (ii) the Rehydrate and Reach functionalities of the Secure Endpoint Products have not been provisioned on the Impacted Device; (iii) a service or feature has been previously launched on the Impacted Device (for example, a Data Delete Operation or a Device Freeze Operation) that restricts or disables the ability of the Impacted Device to contact the Hosted Service; or (iv) the Impacted Device does not have a valid Subscription with the Rehydrate Ready Service.
(b) RESTORATION OF ALL OR ANY PARTICULAR IMPACTED DEVICES CANNOT BE GUARANTEED. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, NO GUARANTEE OR WARRANTY IS PROVIDED WITH RESPECT TO THE ABILITY TO RESTORE AN IMPACTED DEVICE. ABSOLUTE WILL NOT BE RESPONSIBLE FOR ANY DAMAGE TO AN IMPACTED DEVICE OR LOSS OF DATA THAT OCCURS DURING ITS PERFORMANCE OF THE REHYDRATE READY SERVICE, INCLUDING WITHOUT LIMITATION, DAMAGE CAUSED BY THIRD-PARTY RANSOMWARE OR MALWARE TO CUSTOMER’S SYSTEMS OR DATA. OTHER THAN AS EXPRESSLY SET FORTH IN THIS ADDENDUM, ABSOLUTE DOES NOT GUARANTEE, AND MAKES NO REPRESENTATIONS OR WARRANTIES CONCERNING, ITS PERFORMANCE OR THE PERFORMANCE OF SERVICE DELIVERY OR SERVICE ACTIONS WITH RESPECT TO ANY DEVICE, IMPACTED DEVICE OR OTHERWISE. FOR THE AVOIDANCE OF DOUBT, ALL SERVICES PROVIDED PURSUANT TO THIS ADDENDUM ARE SUBJECT TO LIMITATIONS SET FORTH IN THE AGREEMENT, INCLUDING, WITHOUT LIMITATION, SECTION 12.3 THEREOF.
* * * * *