This Service Level Agreement is Schedules A and B of the SupportMax Master Services Agreement. It applies only to the services listed in each client’s Service Order.
Schedule A: Support hours and requests
A1. Support hours. Business hours are Monday–Friday, 8:00 a.m.–6:00 p.m. Pacific, excluding SupportMax holidays. P1 issues are covered 24×7 for plans that include after-hours support; otherwise after-hours work is billed at the emergency rate.
A2. How to request support. Through the client portal, email to the support address, or the support phone line. P1 issues must be phoned in. Time is measured from when SupportMax receives the request through these channels.
Priority levels and targets
A3. Priority levels and targets.
| Priority | Definition | Example | Response target | Resolution or workaround target |
|---|---|---|---|---|
| P1 Critical | Whole business or a core system down; suspected Security Incident | Server or internet down for everyone; ransomware | 30 minutes | 4 hours |
| P2 High | Major function degraded or a key user blocked; business partly working | Email down for one department; owner cannot work | 1 business hour | 8 business hours |
| P3 Medium | One user affected, workaround exists | Printer issue; application error for one user | 4 business hours | 2 business days |
| P4 Low | Request or scheduled change | New user setup; software install | 1 business day | 5 business days |
“Response” means a technician has acknowledged the ticket and started work, not an automated reply. “Resolution” means service is restored, by a fix or a workaround. Resolution targets are goals, not guarantees; issues needing a vendor, parts or Client action pause the clock.
A4. Priority rules. Client sets the initial priority; SupportMax may adjust it to match the definitions and will say why. Any suspected Security Incident is P1 until ruled out.
A5. Escalation. If a P1 or P2 target is missed, Client may escalate to the service manager, then to the owner, at the contacts in the Service Order.
Backup, patching and monitoring
A6. Backup and monitoring targets.
- Backup job review: every business day; failed jobs ticketed the same day.
- Test restores: quarterly, with a written result.
- Patching: critical security patches within 14 days of vendor release, other patches monthly, subject to vendor issues and Client approval windows.
- Monitoring alerts on servers and network devices: 24×7 automated, triaged within 1 business hour.
Service credits and exclusions
A7. Service credits. If SupportMax misses a P1 or P2 response target, Client may request a credit within 30 days after month end:
| Missed targets in a month | Credit (% of that month’s Managed Services fee) |
|---|---|
| 1 P1 response target | 5% |
| Each further P1 or P2 response target | 5% more |
| Maximum per month | 20% |
Credits apply to future invoices only and are Client’s sole monetary remedy for missed service levels. Repeated misses can still lead to termination for cause under Section 9.4 of the MSA.
A8. Exclusions. Targets do not apply to: issues caused by Declined Recommendations, Client changes or unsupported systems; Third-Party Product outages; force majeure; scheduled maintenance; Client accounts more than 30 days past due; or periods when Client has not given needed access or approvals.
A9. Reporting. SupportMax will provide a monthly report of tickets, service level performance, backup status and patch compliance, and a quarterly business review covering open recommendations.
Schedule B: Managed security services
B1. Services covered. Only the security services selected in the Service Order, such as managed detection and response (MDR), 24×7 SOC monitoring, backup and endpoint protection, email security, DNS filtering, vulnerability scanning, dark-web monitoring and security awareness training. 24×7 MDR and SOC monitoring are delivered with SupportMax’s selected MDR/SOC provider, and backup with its selected backup provider. Current providers are named in the Service Order. Each acts as SupportMax’s subcontractor under Section 10.4 of the MSA, and its own product terms apply under Section 5.5. SupportMax may replace a provider with one of similar capability on written notice.
B2. Alert severity and targets. Times run from when the security platform generates the alert, 24×7 for plans that include SOC monitoring.
| Severity | Definition | Triage target | Client notified | Containment action starts |
|---|---|---|---|---|
| Critical | Active compromise: ransomware, data exfiltration, admin account takeover | 15 minutes | 30 minutes (phone and email) | 1 hour (isolate device, disable account) |
| High | Likely compromise: malware executed, suspicious admin logins | 30 minutes | 2 hours | 4 hours |
| Medium | Suspicious activity, contained by tools | 4 hours | Next business day | As needed |
| Low | Informational, policy or hygiene finding | 1 business day | Monthly report | Not applicable |
B3. Autonomous response. Client authorizes SupportMax and its SOC provider to isolate endpoints, disable or reset accounts, revoke sessions and block traffic without prior approval for Critical and High alerts. SupportMax will tell Client what it did and how to reverse it.
Incident response
B4. Incident response steps.
- Detect and triage the alert.
- Contain affected devices and accounts.
- Notify Client’s primary contact and the backup contact in the Service Order.
- Preserve logs and evidence SupportMax’s tools hold, for at least 90 days.
- Advise Client to open a claim with its cyber insurer; coordinate with the insurer’s breach coach and forensic firm.
- Restore from backup and harden systems once the forensic firm or Client clears it.
- Deliver a written incident summary within 5 business days of closure.
Steps 1–4 and the first 4 hours of step 6 are included. Further work is Out-of-Scope Work unless an incident-response retainer applies (Section 5.4 of the MSA).
B5. Vulnerability management. External vulnerability scans monthly; internal scans quarterly. Critical findings are reported within 5 business days with a remediation plan. Remediation SupportMax can perform under the plan is scheduled; other findings become written recommendations under Section 4.7 of the MSA.
B6. Security awareness training. Training and phishing simulations at the frequency in the Service Order, with completion reports. Client is responsible for making sure staff complete training. Records are kept under Section 8.5 of the MSA, because insurers ask for them after a claim.
B7. What this schedule does not promise. These are response targets. SupportMax does not guarantee that every threat will be detected or stopped. The credits in Schedule A, Section A7, apply to missed Critical and High notification targets on the same scale.