This is Schedule C of the SupportMax Master Services Agreement (Section 4.7). SupportMax sends it for signature whenever a client declines, defers or does not act on a written security recommendation.
About this form
This form records that Client has chosen not to adopt a security recommendation from SupportMax, and that Client understands and accepts the resulting risk. It is part of, and governed by, the Master Services Agreement between Client and Support Bay, LLC d/b/a SupportMax (“MSA”).
Form number: DSR-______
Part A: Client and recommendation
| Field | Entry |
|---|---|
| Client legal name | |
| Service Order or account number | |
| Date recommendation first made | |
| How it was made | Email / Ticket # ____ / Quarterly business review / Assessment report |
| Recommendation | |
| Systems and users affected | For example: all 25 Microsoft 365 mailboxes; front-desk PCs |
| SupportMax priority | Critical / High / Medium / Low |
| Estimated one-time cost | $ |
| Estimated monthly cost | $ |
| Frameworks or requirements it supports | For example: cyber insurance application, HIPAA, PCI-DSS, CIS Controls, State Bar duties |
Part B: Risk explained
SupportMax explained the following risks to Client in plain terms.
| Risk | What could happen if the recommendation is not adopted |
|---|---|
| Threat this control reduces | |
| Possible business impact | For example: downtime of ___ days, lost or stolen data, ransom demand, fraudulent wire transfer |
| Data that could be exposed | For example: client files, patient records, card data, employee records |
| Legal or regulatory exposure | For example: breach notification duties, regulator fines, client lawsuits |
| Likelihood (SupportMax view) | High / Medium / Low |
Cyber insurance impact. Many cyber insurers now require controls such as multi-factor authentication (MFA), endpoint detection and response (EDR) and tested, immutable backups before they will quote. If a forensic review after a claim finds that a control stated on the insurance application was not in place, the insurer may deny or reduce the claim. Client should check with its insurance broker whether declining this recommendation affects its coverage or its answers on any application.
☐ This recommendation relates to a control asked about on Client’s cyber insurance application or renewal.
Part C: Client decision
Check one:
- ☐ Declined. Client will not adopt this recommendation.
- ☐ Deferred. Client will reconsider by ____________ (date). Until then, it is treated as declined.
- ☐ Partially adopted. Client will adopt only: ________________________. The rest is declined.
- ☐ Alternative chosen. Client will use a different control or vendor: ________________________. SupportMax has not verified that it gives equal protection unless stated below.
Reason (optional): ☐ Cost ☐ Business disruption ☐ User resistance ☐ Not a priority ☐ Handled by another vendor ☐ Other: __________
Compensating controls Client will keep in place (if any): ________________________________________
SupportMax view of compensating controls: ☐ Reduce the risk ☐ Do not meaningfully reduce the risk ☐ Not reviewed
Part D: Acknowledgments
Client’s authorized signer initials each statement:
| Initials | Client acknowledges that |
|---|---|
| _____ | SupportMax recommended this control in writing and explained the risks in Part B, and Client had the chance to ask questions. |
| _____ | Client is making this decision voluntarily, for its own business reasons, and accepts the risks it was told about. |
| _____ | Under Section 4.7 of the MSA, SupportMax is not liable for any loss, Security Incident, downtime, data loss, fine or claim that this recommendation would reasonably have prevented or reduced. |
| _____ | Response and resolution targets in the Service Level Agreement do not apply to issues caused by this decision, and related recovery or remediation work is billable at SupportMax’s standard or emergency rates. |
| _____ | Client’s cyber insurer may deny or reduce a claim related to this missing control. Client is responsible for the accuracy of its insurance applications. |
| _____ | If this recommendation is rated Critical, SupportMax may end the affected services on 30 days notice under the MSA. |
| _____ | This form stays in effect until Client adopts the recommendation or the form expires, and SupportMax may raise it again at any time. |
Nothing in this form limits SupportMax’s responsibility for its own gross negligence or willful misconduct.
Signatures and review
Client authorized signer
Signature
Name and title
Date
Support Bay, LLC d/b/a SupportMax
Signature
Name and title
Date
Review. Expires ____________ (12 months from signing). Next review at quarterly business review on ____________.
Outcome: ☐ Adopted on ________ ☐ Re-declined (new form) ☐ No longer applicable