Service Requirements

The information below details the minimum technology requirements for Service Provider to provide the Services in accordance with the Terms of Service and Service Descriptions.

1. Computers

Hardware must be business-class, enterprise-grade, professional-grade, or otherwise intended for use in a business environment.
Hardware must be manufactured by a major original equipment manufacturer (“OEM”), such as HP, Dell, Lenovo, or Apple.
Hardware must be within the manufacturer’s support lifecycle (typically 3-5 years).
Operating system must be Microsoft Windows 10 Pro or newer, Microsoft Windows 10 Enterprise or newer, or macOS Catalina or newer.
All computers used by Customer to view, create, modify, or store Customer information, or have access to other technology systems where Customer information resides, must be actively monitored, managed, secured, and maintained including security patch management, cybersecurity event monitoring, cybersecurity policy enforcement, and preventative maintenance, whether or not Customer owns the computer(s).
If the computers are not managed and maintained by Service Provider, they must be actively monitored, managed, secured, and maintained by Customer or a third-party vendor.

2. Servers

Hardware must be business-class, enterprise-grade, professional-grade, or otherwise intended for use in a business environment.
Hardware must be manufactured by a major original equipment manufacturer (“OEM”), such as HPE, Dell, or Lenovo.
Hardware must be within the manufacturer’s support lifecycle (typically 5-7 years).
Hardware must have an active manufacturer warranty including next business day advanced parts replacement.
Operating system must be Microsoft Windows Server 2016 or newer.
Hardware must include integrated lights out management capabilities, such as HPE’s iLO or Dell’s iDRAC.
All servers used by Customer to view, create, modify, or store Customer information, or have access to other technology systems where Customer information resides, must be actively monitored, managed, secured, and maintained including security patch management, cybersecurity event monitoring, cybersecurity policy enforcement, and preventative maintenance, whether or not Customer owns the server(s).
If the servers are not managed and maintained by Service Provider, they must be actively monitored, managed, secured, and maintained by Customer or a third-party vendor.

3. Firewall/Router

Hardware must be business-class, enterprise-grade, professional-grade, or otherwise intended for use in a business environment.
Hardware must be manufactured by a major original equipment manufacturer (“OEM”), such as Fortinet, Ubiquiti, or Cisco.
Hardware must be within the manufacturer’s support lifecycle.
Hardware must have an active manufacturer warranty including next business day advanced parts replacement.
Software must include an active Intrusion Prevention System (“IPS”) capability with an active manufacturer security subscription for real-time security definition updates.
If the firewall/router is not provided by Service Provider, it must be actively monitored, managed, secured, and maintained by the third-party vendor including firmware updates, security patches, change request fulfillment, and technical support.

4. Network Switches

Hardware must be business-class, enterprise-grade, professional-grade, or otherwise intended for use in a business environment.
Hardware must be manufactured by a major original equipment manufacturer (“OEM”), such as Ubiquiti, Netgear, or Cisco.
Hardware must be within the manufacturer’s support lifecycle.
Hardware must have an active manufacturer warranty including next business day advanced parts replacement.
Software must include Layer-2 management capabilities, including virtual local area network (“VLAN”) support.
If the network switches are not provided by Service Provider, they must be actively monitored, managed, secured, and maintained by the third-party vendor including firmware updates, security patches, change request fulfillment, and technical support.

5. Wi-Fi

Hardware must be business-class, enterprise-grade, professional-grade, or otherwise intended for use in a business environment.
Hardware must be manufactured by a major original equipment manufacturer (“OEM”), such as Ubiquiti, Netgear, or Cisco.
Hardware must be within the manufacturer’s support lifecycle.
Hardware must have an active manufacturer warranty including next business day advanced parts replacement.
Software must include Layer-2 management capabilities, including virtual local area network (“VLAN”) support.
If the Wi-Fi infrastructure is not provided by Service Provider, it must be actively monitored, managed, secured, and maintained by the third-party vendor including firmware updates, security patches, change request fulfillment, and technical support.

6. Identity and Access Management (IAM)

Customer must use Microsoft Active Directory, Microsoft Azure Active Directory, or any other platform that is universally compatible with other technology systems.
IAM platform must support self-service password reset.
IAM platform must support multi-factor authentication (“MFA”).
If the IAM solution is not provided by Service Provider, it must be actively monitored, managed, secured, and maintained by the third-party vendor including user change requests and user technical support.

7. Email

Customer must use an e-mail platform that is business-class, enterprise-grade, professional-grade, or otherwise intended for use in a business environment, such as Microsoft Exchange or Google Workspace.
E-mail platform must include mobile device management (“MDM”) capabilities, such as account lock and remote wipe.
If the e-mail solution is not provided by Service Provider, it must be actively monitored, managed, secured, and maintained by the third-party vendor including mailbox change requests and user technical support.

8. Domain

Customer’s domain must be registered with a widely supported domain registrar, such as Google Domains, GoDaddy, or Network Solutions.
Customer’s domain registration must be set up with automatic renewals enabled and a Customer-managed payment method.
Customer’s domain registration must be in Customer’s name.
Service Provider must be listed as the Technical Contact for the domain registration.
Service Provider must be granted direct administrative access to domain name system (“DNS”) records.

9. Endpoint Security

All computers and servers must have a managed endpoint security/anti-malware/anti-virus software installed.
Software must be business-class, enterprise-grade, professional-grade, or otherwise intended for use in a business environment.
If the endpoint security solution is not provided by Service Provider, it must be actively monitored, managed, secured, and maintained by the third-party vendor including threat response and remediation.

10. Internet Security

All computer, server, and mobile device internet traffic must be routed through an internet security platform, such as a domain name system (“DNS”) security platform or an internet proxy server.
Platform must be business-class, enterprise-grade, professional-grade, or otherwise intended for use in a business environment.
If the internet security solution is not provided by Service Provider, it must be actively monitored, managed, secured, and maintained by the third-party vendor including technical support for policy override requests.

11. Email Threat Protection

All incoming email traffic for all recipient mailboxes must be routed through an email threat protection platform.
Platform must be business-class, enterprise-grade, professional-grade, or otherwise intended for use in a business environment.
If the email threat protection solution is not provided by Service Provider, it must be actively monitored, managed, secured, and maintained by the third-party vendor including technical support for policy override requests.

12. Phishing Simulations

All Customer end-users must be targeted with strategic simulations of “phishing” cyber-attacks.
Phishing simulation platform must be business-class, enterprise-grade, professional-grade, or otherwise intended for use in a business environment.
Phishing simulations must be sent to Customer end-users at least once per month.
Customer end-users who fall victim to the attack simulation must be presented with educational content that helps them avoid falling for similar attacks in the future.
If the phishing simulation solution is not provided by Service Provider, it must be actively monitored, managed, secured, and maintained by the third-party vendor including target changes and campaign administration.

13. Cybersecurity Awareness Training

All Customer end-users must participate in cybersecurity awareness training.
Cybersecurity awareness training platform must be business-class, enterprise-grade, professional-grade, or otherwise intended for use in a business environment.
Cybersecurity awareness training must be comprised of at least sixteen (16) training courses per year.
If the cybersecurity awareness training solution is not provided by Service Provider, it must be actively monitored, managed, secured, and maintained by the third-party vendor including participant changes and campaign administration.

14. External Vulnerability Assessments

All Customer office locations must be assessed for external security vulnerabilities at least once per quarter.
External vulnerability assessment platform must be business-class, enterprise-grade, professional-grade, or otherwise intended for use in a business environment.
Potential detectable external vulnerabilities must include firewall port openings, firewall firmware vulnerabilities, network protocol vulnerabilities, and known exploit vulnerabilities.
If the external vulnerability assessment solution is not provided by Service Provider, it must be actively monitored, managed, secured, and maintained by the third-party vendor including scan target change administration.

15. Backup and Disaster Recovery

All business information, including documents, communications, and databases must be protected by a backup and disaster recovery platform.
Platform must be business-class, enterprise-grade, professional-grade, or otherwise intended for use in a business environment.
If the backup and disaster recovery solution is not provided by Service Provider, it must be actively monitored, managed, secured, tested at least monthly, and maintained by the third-party vendor, and include the following capabilities: bare-metal restore, off-site recovery, air-gapped from source, minimum of 1-year of backup retention, and a minimum of daily backup snapshots.

16. Line of Business Applications

Third-party line of business software applications must have an active support agreement from the software manufacturer or vendor including technical support and software updates/upgrades.
Service Provider must be listed as an approved contact to act on behalf of Customer with regards to technical support.

17. Website

Customer’s website must have an active support agreement from the website developer or vendor including technical support, software updates/upgrades, backups, and security.
Service Provider must be listed as an approved contact to act on behalf of Customer with regards to technical support.

18. Other Technologies

Any other technologies including but not limited to printers, phone systems, security cameras, and access control systems must be business-class, enterprise-grade, professional-grade, or otherwise intended for use in a business environment.
If the technology solution is not provided by Service Provider, it must be actively monitored, managed, secured, and maintained by the third-party vendor.
Service Provider must be listed as an approved contact to act on behalf of Customer with regards to technical support.

Changelog

Date	Previous Language	New Language
06/30/2022	–	[Original Publishing]