Incident Management Retainer Operating Model Reference

Incident Management Retainer Operating Model Reference ⫘

Service Scheduling ⫘

To initiate requests for Emergency Incident Response or Proactive services, customers should use the communication methods noted in the Points of Customer Contact section.

The level of assistance available will vary according to the parameters described in the Types of Incidents and Level of Support section and the defined SLAs for the customer's contract.

After a customer submits a request for Incident Management Retainer services, the Secureworks Incident Response team will initiate contact to collect additional information in the form of a scoping conference call.

If the request requires an engagement to be initiated or scheduled, Secureworks Incident Response will define the scope of the effort in an "Engagement Work Order" at no cost.

The Engagement Work Order includes the following details:

• Engagement objectives
• Description of requested work
• Estimated timeline and duration for the requested effort
• Estimated costs, including retainer balances consumed and additional fees required to complete the effort, as appropriate
• Estimated deliverables.

Secureworks Incident Response will send the Engagement Work Order to the customer's defined point of contact to review and approve.

The Engagement Work Order shall be considered approved when the customer's defined point of contact have provided written approval, to include email approval, of the Engagement Work Order.

Once the approved Engagement Work Order is received from the customer's defined point of contact, Secureworks Incident Response will schedule and start the engagement in accordance with the Engagement Work Order.

Proactive Services require a minimum of four (4) weeks advance notification to schedule the appropriate personnel and other resources to meet specific work effort requirements. This lead time can vary based on current demand and therefore it is advised that you submit requests for Proactive Services as far in advance as possible.

Emergency Incident Response services can be requested at any time during the contract term.

Please contact Secureworks Incident Response at any time and at no charge to inquire about scheduling Proactive and Emergency Incident Response services.

Location of Services ⫘

Secureworks Incident Management Retainer services may be performed on-site at customer location(s) or remotely at one or more Secureworks operating locations. Secureworks Incident Response and the customer's defined points of contact will define the location(s) for performing the services at the point of service delivery.

Secureworks Incident Response may engage in a combination of on-site and remote efforts. Various Secureworks personnel may work at multiple Secureworks locations in coordination with the primary engagement personnel.

Your defined points of contact understand and acknowledge that Secureworks personnel will be assigned based on their experience in carrying out efforts specific to the nature of the engagement, their availability, their time zone proximity to the response efforts, and their geographic proximity to the customer's location(s).

Secureworks can deploy an Incident Response team in accordance with the engagement objectives for on-site support. Remote support can be provided while personnel are in-transit.

Customers should reference their Incident Management Retainer Service contract for tailored service terms and service description details.

See the Secureworks Incident Management Retainer Service Description for more information about services provided through an IMR.

Specific information regarding engagements will be provided in the Engagement Work Orders.

Billing and Utilization of Resources ⫘

Incident Management Retainer service scoping calls and scoping effort communication exchanges are non-billable and will not result in resources being decremented from the customer's retainer.

Secureworks will bill, or decrement resources from the customer's retainer, for any efforts on an engagement approved by the customer's defined points of contact.

This includes, but is not limited to, time in engagement kickoff and status meetings, time performing preparation or analysis during the engagement, and time preparing engagement deliverables.

There are multiple options to add resources to an Incident Management Retainer for ongoing engagements to ensure no lapse in support throughout an engagement.

Specific information regarding pricing and fees can be found in the customer's Secureworks contract.

Most services require a minimum billable effort commitment to complete the full life cycle of the engagement. After any Incident Management Retainer service scoping calls are held, a proposed Engagement Work Order will be provided that the customer's defined point of contact must approve to trigger any billable work effort to start. Travel and expenses are typically billed separately at cost, unless otherwise defined in the customer's contract.

Incident Management Retainer Status Notifications ⫘

The customer's Incident Management Retainer points of contact and their Secureworks account team will receive monthly email notifications that denote the balance remaining on the retainer and the contract term expiration date.

Incident Management Retainer customers may also inquire about the balance remaining on their contract or explore options available for services at any time through any of the defined Incident Management Retainer service escalation channels.