EXHIBIT A — STATEMENT OF WORK AND SERVICE DESCRIPTIONS
Exhibit A to the Master Services Agreement dated June 9, 2023 (the "Agreement")
between
Northgate Americas, Inc. a Delaware corporation ("Customer")
and
Cedarpoint Systems Integration, Inc. a Delaware corporation ("Service Provider")
Effective Date: June 9, 2023
Capitalized terms used but not otherwise defined in this Exhibit A shall have the meanings ascribed to them in the Master Services Agreement dated June 9, 2023, by and between Customer and Service Provider (the "Agreement"). This Exhibit A is incorporated into and forms an integral part of the Agreement. All terms and conditions of the Agreement apply to the Services described herein.
Right-click to update Table of Contents
Section 1 — Purpose and Scope Overview
1.1 This Exhibit A sets forth the detailed description of the Services to be provided by Service Provider to Customer under the Agreement. The purpose of this Statement of Work is to define the full scope, nature, and delivery requirements of such Services, to establish the respective responsibilities of the parties, and to provide the operational framework within which the Services shall be performed throughout the term of the Agreement.
1.2 The Services encompassed by this Exhibit A include the following core service categories:
(a) Managed Wide-Area Network ("WAN") Services — End-to-end provisioning, configuration, monitoring, management, maintenance, and optimization of Customer's wide-area network infrastructure across North America;
(b) SD-WAN Deployment and Optimization — Design, deployment, and ongoing optimization of software-defined wide-area network technology utilizing Service Provider's proprietary ArcMesh network orchestration platform;
(c) Network Operations Center ("NOC") Monitoring — Round-the-clock network monitoring and management from Service Provider's dedicated Network Operations Center facilities;
(d) Cybersecurity Monitoring and Incident Response — Continuous cybersecurity monitoring of the managed network perimeter, threat detection, analysis, and incident response services;
(e) Professional Services — Implementation, migration, and optimization services including network design, architecture planning, custom reporting, and on-site support;
(f) Migration from Legacy MPLS Infrastructure — Phased migration of Customer's existing MPLS-based wide-area network to the SD-WAN/ArcMesh platform, including parallel-run operations, acceptance testing, and decommissioning of legacy circuits; and
(g) Quarterly Network Performance Reviews — Comprehensive periodic reviews of network performance, service level attainment, cybersecurity posture, and migration progress.
1.3 The Services described in this Exhibit A are delivered across Customer's North American operations, which comprise a total of three hundred forty (340) managed node locations situated in twenty-eight (28) states within the United States of America and three (3) provinces within Canada. The complete list of managed node locations, including site addresses, node types (hub or spoke), circuit identifiers, and migration phase assignments, is set forth in Schedule 1 (Node Locations) to the Agreement. Schedule 1 is incorporated herein by reference.
1.4 The total annual fees for all Services described in this Exhibit A are Fifteen Million Dollars ($15,000,000) per year (the "Annual Contract Value" or "ACV"), as further detailed and broken down by service category in Exhibit C (Pricing Schedule and Fee Structure) to the Agreement. The allocation of the Annual Contract Value among the major service categories is summarized in Section 2.1, Section 5.1, and Section 11.1 of this Exhibit A.
1.5 Service Provider shall perform all Services in accordance with the standards, specifications, and requirements set forth in this Exhibit A, the Agreement, and all other exhibits and schedules thereto, including without limitation Exhibit B (Service Level Agreement), Exhibit C (Pricing Schedule and Fee Structure), Exhibit D (Acceptable Use Policy), and Exhibit E (Data Security and Privacy Requirements).
Section 2 — Managed WAN Services
2.1 — Description of Managed WAN Services
2.1.1 Service Provider shall provide end-to-end managed wide-area network services connecting Customer's three hundred forty (340) enterprise node locations across North America. The managed WAN services shall encompass the full lifecycle of network service delivery, including provisioning, configuration, monitoring, management, maintenance, troubleshooting, and optimization of Customer's WAN infrastructure, as further described in this Section 2 and the related sections of this Exhibit A.
2.1.2 Managed WAN services are the principal service component under this Statement of Work and constitute approximately seventy percent (70%) of the Annual Contract Value, representing Ten Million Five Hundred Thousand Dollars ($10,500,000) per year, as set forth in Exhibit C. This amount includes the costs of circuit management, equipment maintenance, network management platform operations, and the staffing required to deliver the managed WAN services described herein, but excludes the ArcMesh platform license and maintenance fees addressed separately in Section 5 and the professional services fees addressed in Section 11.
2.1.3 Managed WAN services shall include, without limitation, the following activities:
(a) Provisioning of WAN circuits, including coordination with underlying transport providers for procurement of MPLS, broadband, dedicated internet access ("DIA"), and wireless backup circuits as required by the network architecture;
(b) Configuration and deployment of customer premises equipment ("CPE") at each managed node, including routers, switches, firewalls, and SD-WAN edge devices;
(c) Centralized management and orchestration of the WAN fabric through the ArcMesh platform;
(d) Proactive and reactive monitoring of all network links, devices, and services for availability, performance, capacity, and fault conditions;
(e) Incident management, including fault detection, isolation, troubleshooting, and resolution in accordance with the severity classifications and response times established in Exhibit B;
(f) Configuration management, including maintaining current and accurate records of all network configurations, firmware versions, and hardware inventories;
(g) Capacity management, including monitoring bandwidth utilization trends and recommending capacity adjustments to Customer;
(h) Change management, including coordinating and implementing approved network changes in accordance with the change order procedures set forth in Section 10 of this Exhibit A; and
(i) Vendor management, including serving as the primary interface with underlying transport carriers and circuit providers for service activation, fault resolution, and circuit modifications.
2.2 — Network Architecture
2.2.1 Service Provider shall deploy and manage a software-defined wide-area network ("SD-WAN") architecture utilizing Service Provider's proprietary ArcMesh network orchestration platform, version 4.2 ("ArcMesh" or the "Platform"). The ArcMesh platform shall serve as the centralized network orchestration and management layer for Customer's entire North American WAN infrastructure.
2.2.2 The ArcMesh platform v4.2 provides the following core capabilities:
(a) Centralized Network Orchestration — A single-pane-of-glass management console enabling centralized visibility, configuration, and control of all managed nodes, circuits, and network policies across Customer's WAN;
(b) Policy-Based Routing — Dynamic, policy-driven traffic routing that enables Customer's network traffic to be directed across optimal paths based on application requirements, link conditions, and business priorities;
(c) Application-Aware Traffic Management — Deep packet inspection and application classification capabilities enabling granular traffic prioritization, quality-of-service enforcement, and application-specific performance optimization;
(d) Automated Failover Capabilities — Sub-second detection of link failures and automated rerouting of traffic to backup paths, ensuring continuity of service and minimizing the impact of circuit outages on application availability; and
(e) Analytics and Reporting — Integrated analytics engine providing real-time and historical visibility into network performance, application behavior, and capacity utilization.
2.2.3 The ArcMesh platform is licensed to Customer under the terms set forth in Section 5 of this Exhibit A and the intellectual property licensing provisions of Article 9 of the Agreement. All intellectual property rights in and to the ArcMesh platform remain the exclusive property of Service Provider, subject to the license granted herein.
2.2.4 The network architecture shall be designed to meet or exceed the performance, availability, and security requirements specified in this Exhibit A, Exhibit B, and Exhibit E. Service Provider shall provide Customer with detailed network architecture documentation, including logical and physical topology diagrams, within sixty (60) days of the Effective Date and shall maintain such documentation in current condition throughout the term of the Agreement.
2.3 — Geographic Coverage
2.3.1 The managed WAN services shall be delivered to all node locations specified in Schedule 1 (Node Locations) to the Agreement. As of the Effective Date, the geographic coverage of the managed WAN encompasses three hundred forty (340) nodes located across twenty-eight (28) states within the United States and three (3) provinces within Canada.
2.3.2 Node locations are classified into the following categories as designated in Schedule 1:
(a) Hub Sites — Major data centers, regional headquarters, and primary aggregation points that serve as backbone nodes in the WAN architecture. Hub sites typically maintain higher-bandwidth circuits, redundant connectivity, and advanced CPE configurations; and
(b) Spoke Sites — Branch offices, satellite locations, and smaller operational facilities that connect to the WAN through hub site aggregation. Spoke sites may utilize a combination of broadband, DIA, and wireless backup circuits.
2.3.3 Service Provider shall support the addition of new node locations during the term of the Agreement, subject to the mutually agreed change order procedures set forth in Section 10 of this Exhibit A. The addition of new nodes may result in adjustments to the Annual Contract Value as determined in accordance with the per-node pricing tiers set forth in Exhibit C. Service Provider shall use commercially reasonable efforts to provision and activate new nodes within forty-five (45) business days of the execution of an applicable change order, subject to circuit availability from underlying transport providers.
2.3.4 In the event Customer closes, consolidates, or relocates any node location, Customer shall provide Service Provider with a minimum of sixty (60) days' advance written notice. Service Provider shall coordinate the orderly decommissioning or relocation of managed services at the affected node, and fee adjustments, if any, shall be determined in accordance with Exhibit C.
2.4 — Service Levels
2.4.1 All managed WAN services provided under this Section 2 are subject to the service level commitments set forth in Exhibit B (Service Level Agreement) to the Agreement. Key service level targets include, without limitation:
(a) Monthly Uptime Target: Ninety-nine and ninety-five hundredths percent (99.95%) network availability measured on a per-node basis per calendar month, excluding scheduled maintenance windows;
(b) Latency Targets: Round-trip latency not to exceed the thresholds specified in Exhibit B for each node category and geographic region;
(c) Packet Loss Targets: Packet loss not to exceed the thresholds specified in Exhibit B; and
(d) Incident Response Times: Response and resolution time commitments tiered by incident severity (Critical, Major, Minor, Informational) as defined in Exhibit B.
2.4.2 In the event that Service Provider fails to meet any service level commitment during a given measurement period, Customer shall be entitled to the applicable service credits as calculated in accordance with the tiered service credit structure set forth in Exhibit B. Service credits shall be applied as a credit against future invoices and shall constitute Customer's sole and exclusive remedy for service level failures, except as otherwise expressly provided in the Agreement.
2.4.3 Service level measurements and reporting shall be conducted using the monitoring tools and methodologies described in Section 4 of this Exhibit A, and results shall be included in the quarterly performance reviews described in Section 8.
Section 3 — SD-WAN Deployment and Optimization
3.1 — Initial SD-WAN Deployment
3.1.1 Service Provider shall design, deploy, and configure SD-WAN technology utilizing the ArcMesh platform v4.2 across all three hundred forty (340) node locations identified in Schedule 1. The SD-WAN deployment is a foundational element of the managed WAN services and is integral to the migration from Customer's legacy MPLS infrastructure as described in Section 7 of this Exhibit A.
3.1.2 The SD-WAN deployment shall include the following activities:
(a) CPE Procurement and Installation — Service Provider shall procure and install customer premises equipment at each managed node, including SD-WAN edge appliances, routers, and any ancillary hardware required to support the SD-WAN architecture. CPE specifications for each node type (hub and spoke) shall be documented in the network architecture documentation provided pursuant to Section 2.2.4;
(b) SD-WAN Policy Configuration — Service Provider shall configure SD-WAN policies on the ArcMesh platform for each managed node, including application classification rules, traffic steering policies, quality-of-service parameters, and failover configurations tailored to the specific requirements of each node's applications and connectivity;
(c) Integration with Existing Infrastructure — Service Provider shall integrate the SD-WAN deployment with Customer's existing network infrastructure, including Customer's data center environments, cloud connectivity, and any retained MPLS circuits during the migration period. Integration shall include BGP peering, VLAN configurations, firewall rule coordination, and DNS/DHCP integration as applicable;
(d) End-to-End Testing — Service Provider shall conduct comprehensive end-to-end testing of the SD-WAN deployment at each node, including connectivity verification, failover testing, application performance validation, and throughput benchmarking. Test results shall be documented and provided to Customer as part of the acceptance testing process described in Section 7.6.
3.1.3 The SD-WAN deployment shall be completed in coordination with the phased migration from Customer's legacy MPLS infrastructure as described in Section 7 of this Exhibit A. The deployment timeline for each node shall correspond to the migration phase to which such node is assigned in Schedule 1.
3.2 — Ongoing Optimization
3.2.1 Following the initial deployment of SD-WAN technology at each node, Service Provider shall provide continuous, proactive optimization of SD-WAN performance throughout the term of the Agreement. Ongoing optimization activities shall include, without limitation:
(a) Application-Level Traffic Steering — Continuous refinement of application classification rules and traffic steering policies to ensure optimal path selection based on real-time link conditions, application requirements, and business priorities;
(b) Bandwidth Allocation — Monitoring of bandwidth utilization across all circuits and nodes and adjustment of bandwidth allocation policies to maximize utilization efficiency and prevent congestion;
(c) Quality-of-Service Policy Tuning — Periodic review and adjustment of QoS policies to reflect changes in Customer's application portfolio, traffic patterns, and business requirements;
(d) Firmware and Software Updates — Timely deployment of CPE firmware updates and ArcMesh platform patches to maintain security, stability, and feature currency, subject to the maintenance procedures described in Section 5.2; and
(e) Performance Baselining — Establishment and maintenance of performance baselines for each node and circuit, enabling trend analysis and early identification of performance degradation.
3.2.2 All optimization activities and their outcomes shall be documented and reported to Customer as part of the quarterly network performance reviews described in Section 8 of this Exhibit A. Service Provider shall include specific optimization recommendations in each quarterly review report, including proposed changes to traffic policies, capacity adjustments, and architectural improvements.
Section 4 — Network Operations Center (NOC) Monitoring
4.1 — 24×7 NOC Coverage
4.1.1 Service Provider shall provide round-the-clock network monitoring and management services twenty-four (24) hours per day, seven (7) days per week, three hundred sixty-five (365) days per year (including holidays) through its dedicated Network Operations Center ("NOC") facilities. NOC monitoring is a critical component of the managed WAN services and provides the operational foundation for meeting the service level commitments set forth in Exhibit B.
4.1.2 Service Provider shall operate the following NOC facilities for the purpose of delivering Services under this Exhibit A:
(a) Primary NOC Facility: 11400 Commerce Park Drive, Suite 600 Reston, Virginia 20191 United States of America
The primary NOC facility in Reston, Virginia shall serve as the principal monitoring and management center for all Services delivered under this Exhibit A.
(b) Secondary/Redundant NOC Facility: 200 Portage Avenue, Suite 1500 Winnipeg, Manitoba R3C 3X2 Canada
The secondary NOC facility in Winnipeg, Manitoba shall serve as a fully redundant backup facility capable of assuming complete monitoring and management operations in the event of a disruption, outage, or force majeure event affecting the primary Reston facility. The Winnipeg facility shall maintain real-time data replication from the primary facility and shall be staffed with qualified personnel at all times to enable seamless failover.
4.1.3 Service Provider shall maintain and periodically test its NOC failover procedures to ensure that the secondary facility can assume full operational responsibility within a target switchover time of no more than fifteen (15) minutes. Failover testing shall be conducted at least semi-annually, and test results shall be made available to Customer upon request.
4.2 — NOC Services Scope
4.2.1 The scope of NOC monitoring and management services shall include, without limitation, the following activities:
(a) Real-Time Monitoring — Continuous, automated monitoring of all three hundred forty (340) managed nodes for availability, performance, latency, packet loss, jitter, bandwidth utilization, and device health metrics. Monitoring shall encompass all managed CPE devices, WAN circuits, SD-WAN overlay tunnels, and the ArcMesh platform infrastructure;
(b) Automated Alerting and Escalation — Implementation and management of automated alerting thresholds and escalation workflows aligned with defined severity levels. Incident severity levels shall be classified as follows:
(i) Critical — Complete loss of service at one or more hub sites or simultaneous loss of service at multiple spoke sites affecting business-critical operations;
(ii) Major — Significant degradation of service affecting multiple users or critical applications, or complete loss of service at a single spoke site;
(iii) Minor — Partial degradation of service with limited user impact, or loss of redundancy at a node without service interruption; and
(iv) Informational — Events requiring logging and tracking but not requiring immediate action, including threshold warnings, planned maintenance notifications, and non-service-affecting anomalies;
(c) Fault Detection, Isolation, and Resolution — Proactive and reactive identification of network faults, systematic isolation of root causes, and timely resolution of issues in accordance with the incident response times specified in Exhibit B;
(d) Incident Ticketing, Tracking, and Reporting — Maintenance of a comprehensive incident management system for the creation, tracking, updating, and closure of all incident tickets. Customer shall have read-only access to the incident management system for visibility into open and historical tickets affecting Customer's network;
(e) Proactive Threshold Monitoring and Trend Analysis — Monitoring of key performance indicators against established baselines and thresholds, with proactive identification of trends that may indicate developing issues, capacity constraints, or optimization opportunities; and
(f) Escalation Coordination — Coordination with Customer's VP of Network Operations (currently Katrina Bosch) and other designated Customer personnel for incident escalation, major incident management, and resolution activities. Service Provider shall maintain a current escalation contact list provided by Customer and shall adhere to the escalation procedures mutually agreed upon by the parties.
4.3 — NOC Staffing
4.3.1 Service Provider shall maintain sufficient qualified personnel at both the primary (Reston, Virginia) and secondary (Winnipeg, Manitoba) NOC facilities to meet all service level commitments set forth in Exhibit B and to deliver the NOC services described in this Section 4 without interruption.
4.3.2 NOC staff assigned to support the Services shall include, at a minimum, the following roles during each operational shift:
(a) Network Engineers — Personnel with demonstrated expertise in WAN technologies, SD-WAN architecture, routing and switching protocols, and the ArcMesh platform, holding relevant industry certifications (e.g., CCNP, CCNA, or equivalent);
(b) Security Analysts — Personnel with demonstrated expertise in network security monitoring, threat detection, and incident response, holding relevant industry certifications (e.g., CISSP, GIAC, CompTIA Security+, or equivalent); and
(c) Shift Supervisors — Senior personnel responsible for overseeing NOC operations during each shift, managing escalations, and ensuring adherence to standard operating procedures and service level commitments.
4.3.3 Service Provider shall ensure that all NOC personnel supporting the Services have successfully completed background checks and security screening in accordance with Exhibit E (Data Security and Privacy Requirements). Service Provider shall provide Customer with aggregate staffing information regarding NOC personnel upon reasonable request but shall not be required to disclose individual personnel identities except as required for security vetting purposes.
Section 5 — ArcMesh Platform License and Maintenance
5.1 — License Grant
5.1.1 Subject to the terms and conditions of the Agreement and this Exhibit A, Service Provider hereby grants to Customer a non-exclusive, non-transferable license to use the ArcMesh network orchestration platform, version 4.2, solely in connection with the managed network services described in this Exhibit A and solely for Customer's internal business purposes. The license granted herein is non-transferable except as expressly permitted under the assignment provisions of the Agreement.
5.1.2 The scope of the license is limited to Customer's three hundred forty (340) managed node locations in North America as listed in Schedule 1 (Node Locations) to the Agreement. Use of the ArcMesh platform beyond the licensed scope, including deployment at node locations not listed in Schedule 1 (except as added through properly executed change orders), is prohibited without Service Provider's prior written consent.
5.1.3 The annual license and maintenance fees for the ArcMesh platform are Three Million Dollars ($3,000,000) per year, representing approximately twenty percent (20%) of the Annual Contract Value, as set forth in Exhibit C (Pricing Schedule and Fee Structure). License and maintenance fees shall be invoiced and payable in accordance with the payment terms of the Agreement.
5.1.4 Customer acknowledges that the ArcMesh platform, including all source code, object code, documentation, algorithms, and related materials, constitutes the confidential information and proprietary intellectual property of Service Provider. Customer shall not reverse engineer, decompile, disassemble, or attempt to derive the source code of the ArcMesh platform, except to the extent expressly permitted by applicable law notwithstanding this restriction.
5.2 — Platform Maintenance and Updates
5.2.1 Service Provider shall provide ongoing maintenance of the ArcMesh platform throughout the term of the Agreement, including:
(a) Bug Fixes — Identification and correction of software defects, errors, and malfunctions that affect the functionality or performance of the ArcMesh platform;
(b) Security Patches — Timely development and deployment of patches addressing identified security vulnerabilities in the ArcMesh platform. Critical security patches shall be deployed on an expedited basis in accordance with Service Provider's vulnerability management procedures; and
(c) Minor Version Updates — Periodic updates within the v4.x release family (e.g., from v4.2 to v4.3 or v4.2.1) that include feature enhancements, performance improvements, and stability fixes.
All such maintenance activities described in clauses (a) through (c) above shall be provided at no additional charge to Customer and are included within the annual license and maintenance fees set forth in Section 5.1.3.
5.2.2 Major version upgrades of the ArcMesh platform (i.e., upgrades from the v4.x release family to a new major version such as v5.x) shall not be included in the standard license and maintenance fees. Service Provider shall offer major version upgrades to Customer as they become generally available, and if Customer elects to accept a major version upgrade, the upgrade shall be implemented pursuant to a mutually agreed change order setting forth the scope, timeline, resource requirements, and any additional fees associated with the upgrade.
5.2.3 Service Provider shall provide Customer with a minimum of thirty (30) days' advance written notice prior to any scheduled maintenance activities on the ArcMesh platform or related infrastructure that may affect service availability. Scheduled maintenance shall be performed during pre-agreed maintenance windows to the extent practicable. Emergency maintenance required to address critical security vulnerabilities or service-affecting defects may be performed outside of scheduled maintenance windows, provided that Service Provider shall notify Customer's designated contact as promptly as reasonably possible in advance of such emergency maintenance.
5.3 — Platform Support
5.3.1 Technical support for the ArcMesh platform shall be provided on a twenty-four hours per day, seven days per week (24×7) basis through Service Provider's NOC facilities and a dedicated platform support channel. Customer shall have access to platform support via telephone, email, and the Service Provider's secure online support portal.
5.3.2 Platform support services include assistance with platform functionality, configuration guidance, troubleshooting of platform-related issues, and coordination of bug fixes and patch deployments.
5.3.3 Platform support is included within the annual license and maintenance fee specified in Section 5.1.3 and is not separately charged. Customer shall not be required to pay any additional fees for standard platform support activities.
Section 6 — Cybersecurity Monitoring and Incident Response
6.1 — Cybersecurity Monitoring Services
6.1.1 Service Provider shall provide continuous cybersecurity monitoring for the managed network perimeter and infrastructure as part of the Services delivered under this Exhibit A. Cybersecurity monitoring is a critical component of the overall managed WAN services and is designed to protect Customer's network traffic, data, and connected systems from cyber threats.
6.1.2 Cybersecurity monitoring services shall include, without limitation:
(a) Intrusion Detection and Prevention — Deployment and management of intrusion detection and prevention systems ("IDS/IPS") at strategic points within the managed network to identify and block known and suspected malicious activity;
(b) Malware Detection — Monitoring for indicators of malware infection, including network-based detection of command-and-control communications, anomalous data exfiltration patterns, and known malware signatures;
(c) Distributed Denial-of-Service ("DDoS") Mitigation — Detection and mitigation of volumetric, protocol-based, and application-layer DDoS attacks targeting Customer's network infrastructure; and
(d) Anomaly Detection — Behavioral analysis and baseline deviation monitoring to identify unusual network activity that may indicate a security threat, including unauthorized access attempts, lateral movement, and data exfiltration.
6.1.3 All cybersecurity monitoring activities shall be conducted from both the primary NOC facility in Reston, Virginia and the secondary NOC facility in Winnipeg, Manitoba, ensuring continuity of security monitoring in the event of a disruption at either facility.
6.2 — Threat Detection and Analysis
6.2.1 Service Provider shall employ a multi-layered approach to threat detection and analysis, incorporating the following methodologies:
(a) Threat intelligence Feeds — Integration of curated threat intelligence feeds from industry-leading sources, providing real-time indicators of compromise, known threat actor tactics, techniques, and procedures, and emerging vulnerability information;
(b) Behavioral Analytics — Machine learning and statistical analysis of network traffic patterns, user behavior, and system activity to identify deviations from established baselines that may indicate a security compromise; and
(c) Signature-Based Detection — Traditional signature-based detection utilizing regularly updated rulesets to identify known attack patterns, malware variants, and exploit attempts.
6.2.2 Detected threats shall be categorized according to severity (Critical, Major, Minor, Informational), logged in the incident management system, and escalated to the appropriate response personnel in accordance with the escalation procedures established for the Customer account. Service Provider shall maintain records of all detected threats and analysis findings for a minimum retention period consistent with Exhibit E.
6.3 — Incident Response
6.3.1 Service Provider shall develop and maintain a documented incident response plan specific to the Customer account, detailing the procedures, roles, responsibilities, communications protocols, and escalation paths to be followed in the event of a security incident affecting the managed network. A copy of the incident response plan shall be provided to Customer within thirty (30) days of the Effective Date and shall be reviewed and updated at least annually or upon material changes to the threat landscape or the managed environment.
6.3.2 Upon detection of a security incident, Service Provider shall take the following actions:
(a) Containment — Implement immediate containment measures to limit the scope and impact of the incident, including isolation of affected network segments, blocking of malicious traffic, and preservation of forensic evidence;
(b) Customer Notification — Notify Customer's designated security contact within the timeframes specified in Exhibit E (Data Security and Privacy Requirements). For Critical-severity security incidents, notification shall be provided within the timeframes mandated by applicable law and regulation, and in no event later than the deadlines specified in Exhibit E;
(c) Investigation and Remediation — Conduct a thorough investigation of the incident, including identification of the attack vector, scope of compromise, and affected systems and data. Service Provider shall implement remediation measures to eliminate the threat, restore affected services, and prevent recurrence; and
(d) Root Cause Analysis — Prepare and deliver to Customer a written root cause analysis report within ten (10) business days following the closure of the incident. The root cause analysis report shall include a description of the incident, timeline of events, root cause determination, impact assessment, remediation actions taken, and recommendations for preventive measures.
6.3.3 Service Provider's indemnification obligations for data breaches resulting from Service Provider's negligence, gross negligence, or willful misconduct are set forth in Article 11 of the Agreement and are not limited or modified by this Section 6.
6.4 — Security Reporting
6.4.1 Service Provider shall provide Customer with monthly cybersecurity status reports summarizing security monitoring activity, detected threats, incidents, and remediation actions. Monthly cybersecurity reports shall be delivered within ten (10) business days following the end of each calendar month.
6.4.2 Cybersecurity metrics shall be included in the quarterly network performance reviews described in Section 8 of this Exhibit A, including aggregate threat counts, incident statistics, mean time to detection, mean time to containment, and trend analysis.
Section 7 — Migration from Legacy MPLS Infrastructure
7.1 — Background
7.1.1 As of the Effective Date, Customer's North American wide-area network operates on legacy multi-protocol label switching ("MPLS") infrastructure provided by Greystone Halcyon Software ("Prior Vendor"), a Virginia limited liability company headquartered at 8300 Greensboro Drive, Suite 400, McLean, Virginia 22102. Customer's existing MPLS network has been managed by Prior Vendor for a period of approximately seven (7) years, and the migration from Prior Vendor's infrastructure to Service Provider's SD-WAN/ArcMesh platform represents a critical and foundational transformation of Customer's network operations.
7.1.2 The orderly and non-disruptive migration of Customer's WAN from the Prior Vendor's legacy MPLS infrastructure to Service Provider's SD-WAN/ArcMesh platform is a core deliverable under this Statement of Work. Service Provider acknowledges that the migration involves the replacement of long-standing network infrastructure that supports Customer's business-critical applications and operations, and Service Provider shall plan and execute the migration with the objective of minimizing service disruptions, maintaining application performance, and achieving a seamless transition for Customer's end users.
7.1.3 Detailed transition coordination terms, including the respective responsibilities of Customer, Service Provider, and Prior Vendor during the migration period, are further set forth in the Transition Services Side Letter dated June 9, 2023, by and between Customer and Service Provider (the "Transition Side Letter"). The Transition Side Letter is incorporated herein by reference.
7.2 — Migration Phases
7.2.1 The migration from legacy MPLS infrastructure to the SD-WAN/ArcMesh platform shall be completed in three (3) distinct phases over a total period of eighteen (18) months commencing on the Effective Date. The phased approach is designed to manage risk, enable validation of the new infrastructure at each stage, and ensure continuity of service throughout the transition. The three migration phases are as follows:
Phase 1: Core Infrastructure Migration (Months 1–6)
Phase 1 shall encompass the migration of designated hub sites and critical infrastructure nodes, as identified in Schedule 1. Phase 1 activities shall include:
(a) Transition of the core network backbone from legacy MPLS to the SD-WAN/ArcMesh architecture;
(b) Establishment of the SD-WAN overlay network connecting hub sites;
(c) Configuration of core routing policies, inter-site connectivity, and data center integration;
(d) Parallel-run validation with legacy MPLS circuits to verify equivalent or superior network performance; and
(e) Coordination with Prior Vendor for circuit hand-off and cross-connect provisioning at hub site locations.
Phase 2: Regional Expansion (Months 7–12)
Phase 2 shall encompass the migration of secondary hub sites and major spoke sites, as identified in Schedule 1. Phase 2 activities shall include:
(a) Extension of the SD-WAN overlay to secondary hub and major spoke site locations;
(b) Integration of regional traffic flows into the SD-WAN fabric;
(c) Optimization of ArcMesh routing policies based on lessons learned from Phase 1;
(d) Parallel-run validation at migrated sites; and
(e) Continued coordination with Prior Vendor for orderly transition of regional circuits.
Phase 3: Full Migration and Legacy Decommissioning (Months 13–18)
Phase 3 shall encompass the migration of all remaining spoke sites and the complete decommissioning of legacy MPLS circuits. Phase 3 activities shall include:
(a) Deployment of SD-WAN technology at all remaining spoke site locations;
(b) Final cutover of all remaining traffic from legacy MPLS to the SD-WAN/ArcMesh platform;
(c) Comprehensive acceptance testing across the entire network;
(d) Decommissioning and return of all Prior Vendor-owned equipment and circuits; and
(e) Closeout of Prior Vendor services, including final settlement and termination of Customer's agreement with Prior Vendor as applicable.
7.2.2 Each node's migration phase assignment is specified in Schedule 1 (Node Locations) to the Agreement. Service Provider shall develop a detailed migration project plan for each phase, including node-by-node timelines, resource assignments, risk assessments, and contingency plans, and shall provide such project plans to Customer for review and approval prior to the commencement of each phase.
7.3 — Parallel-Run Requirements
7.3.1 During each migration phase, Service Provider shall maintain parallel operation of both the legacy MPLS circuits and the new SD-WAN infrastructure at each migrating node for a minimum validation period. The duration of the parallel-run period shall be determined on a per-site basis, taking into account the criticality of the node, the complexity of the migration, and the specific requirements of applications served by the node. In no event shall the parallel-run period at any node be less than fifteen (15) business days.
7.3.2 The purpose of the parallel-run period is to allow Customer to verify that the SD-WAN/ArcMesh platform provides equivalent or superior network performance compared to the legacy MPLS infrastructure before the legacy circuits are decommissioned. During the parallel-run period, Service Provider shall monitor both the legacy and new infrastructure and shall provide Customer with comparative performance data, including availability, latency, packet loss, jitter, and application performance metrics.
7.3.3 Customer shall have the right to extend the parallel-run period at any node for up to an additional fifteen (15) business days if performance validation criteria have not been satisfactorily met, upon written notice to Service Provider. Extension of parallel-run periods beyond the additional fifteen (15) business day period shall be subject to mutual agreement and may result in fee adjustments as set forth in the Transition Side Letter.
7.4 — Coordination with Prior Vendor
7.4.1 Service Provider shall coordinate directly with Greystone Halcyon Software, as necessary for the orderly execution of the migration, including the exchange of circuit information, cross-connect details, equipment inventories, and configuration data required for planning and execution of the transition.
7.4.2 Service Provider shall work collaboratively with Prior Vendor to schedule and execute cutover activities, ensuring minimal disruption to Customer's network services. Service Provider acknowledges that Prior Vendor's cooperation may be subject to Prior Vendor's own contractual obligations, scheduling constraints, and operational procedures.
7.4.3 Customer shall facilitate introductions between Service Provider and Prior Vendor and shall provide reasonable cooperation in coordinating the transition, including facilitating joint planning sessions, providing access to relevant documentation, and assisting in the resolution of any coordination issues that may arise between Service Provider and Prior Vendor.
7.5 — Rollback Procedures
7.5.1 Service Provider shall develop, document, and maintain detailed rollback procedures for each migration phase, enabling the reversion of migrated nodes to the legacy MPLS infrastructure in the event of migration failure, unacceptable performance degradation, or other circumstances that, in Customer's reasonable judgment, necessitate a return to the prior configuration.
7.5.2 Rollback procedures shall include, at a minimum:
(a) Step-by-step instructions for reverting each migrated node to its prior MPLS configuration;
(b) Identification of rollback decision criteria and escalation authorities;
(c) Estimated rollback execution timelines for each node type;
(d) Communication procedures for notifying affected stakeholders; and
(e) Post-rollback validation procedures to confirm restoration of service.
7.5.3 Rollback procedures shall be tested prior to the commencement of each migration phase. Testing shall be conducted in a manner that does not disrupt production network services. Test results shall be documented and provided to Customer for review prior to the commencement of the applicable migration phase.
7.6 — Acceptance Testing
7.6.1 Upon completion of each migration phase, Service Provider shall conduct comprehensive acceptance testing to verify that the migrated nodes meet the service level commitments set forth in Exhibit B and the performance requirements established in this Exhibit A.
7.6.2 Acceptance testing criteria shall include, without limitation:
(a) Network availability measured against the 99.95% monthly uptime target;