Master Services Agreement

Effective Date: January 1, 2025     |     Last Revised: March 1, 2026     |     Version: 2.0

This Master Services Agreement (“Agreement”) is entered into between Onward IT, LLC, a professional technology services organization located at 10777 Civic Center Drive, Rancho Cucamonga, CA 91730 (“MSP”), and the business entity or individual (“Customer”) that engages MSP for services. This Agreement governs the terms and conditions under which MSP provides services to Customer and becomes legally binding upon the earliest of: (a) Customer’s signature on a Service Agreement, Order, or Statement of Work referencing this Agreement; (b) Customer’s payment of any invoice for services; or (c) Customer’s use of or continued access to any services provided by MSP. Customer’s engagement of MSP’s services constitutes Customer’s acceptance of all terms of this Agreement.

  Recitals

WHEREAS, Customer wishes to retain MSP for the purpose of providing certain services related to Network and Computer Support, Consulting, Implementation, Troubleshooting, Administration, and Management, and IT network cabling installation and related services including, but not limited to, any of the services described in the “Additional Agreements” (as defined below) and any Attachments and/or Exhibits thereto (the “Services”);

WHEREAS, the details and scope of the Services to be provided by MSP to Customer and the costs associated with such Services may be further defined in certain additional Services-related agreements which may be entered into by MSP and Customer simultaneously with or subsequent to this Agreement including, but not limited to, the ONEComplete Service Agreement, the ONEManage Service Agreement, the SecurityONE Service Agreement, the AI Services Attachment, and the Project Services Agreement (individually and collectively referred to as “Additional Agreements”); and

WHEREAS, MSP desires to provide the Services to Customer in accordance with the terms and conditions of this Agreement as well as the terms and conditions of any Additional Agreements.

NOW, THEREFORE, the parties mutually agree as follows:

  Section 1: Service Fees

Upon Customer’s request for the Services and MSP’s agreement to provide such services, MSP shall provide the Services to Customer in accordance with the terms and conditions of this Agreement. Except as otherwise provided in any Additional Agreements, any Services provided by MSP to Customer will be billed on a “time and materials” basis, including but not limited to reimbursement of MSP’s out-of-pocket expenses reasonably incurred in providing on-site services. Unless otherwise specifically provided in any Additional Agreements, the Services performed by MSP will be billed on a per-hour basis and shall be payable whether or not MSP is successful in reaching a resolution. Customer must pay all fees for Services immediately upon receipt of invoice. Customer agrees to make available all computer programs, data, documentation, and access to personnel and to Customer’s premises required by MSP to provide the Services. Unless otherwise specifically provided in an Additional Agreement, each request for Services made by Customer shall be deemed to authorize MSP to provide up to eight (8) hours of Services per incident (“Authorized Hours”). After MSP has provided Services for the full amount of the Authorized Hours for a particular incident, MSP will request authorization from Customer before continuing to provide such Services in connection with that incident.

Client Delay. If MSP is unable to commence delivery of the Services on the agreed service start date because of any failure on Customer’s part — including but not limited to failure to provide access to Customer’s resources, personnel, systems, or facilities in a timely manner — Customer nonetheless will begin to incur Service Fees from the agreed service start date, which Customer shall pay in accordance with the applicable Order or Additional Agreement. MSP’s obligations to deliver Services will commence upon Customer’s provision of the required access and resources, and any delay caused by Customer shall not extend the term of the applicable Agreement.

 

  Section 2: Types of Services

Except as otherwise specifically provided in any Additional Agreements, the following terms shall mean:

2.1. “Engineering Services” are those Services performed by a Systems Engineer of MSP.

2.2. “Lead Engineering Services” are those Services performed by a Lead Engineer of MSP.

2.3. “Senior Engineering Services” are those Services performed by a Senior Engineer of MSP.

2.4. “Technology Management Services” are those Services performed by a Technology Manager or Project Manager of MSP including, but not limited to, procuring, coordinating, discussing, troubleshooting, organizing, planning, consulting, answering questions, responding to telephone calls, email, or any other reasonable task performed by MSP for Customer.

2.5. “Project Services” are those Services performed by a member of the Project Team of MSP as authorized in the MSP Project Services Agreement.

2.6. “Applications Engineering Services” are those Services performed by an Applications Engineer of MSP.

2.7. “Help Desk Services” are those Services performed by a Help Desk representative of MSP and are only performed from MSP’s place of business.

2.8. “Security Services” are those services performed by a member of the Security Team of MSP, including but not limited to endpoint detection and response, privileged access management, security awareness training, and security consulting.

2.9. “AI Services” are those services performed by MSP involving artificial intelligence consulting, strategy, implementation support, or application development as further described in any applicable AI Services Attachment.

2.10. “Cabling Services” are those Services performed by a network cabling service provider including, but not limited to, IT network cabling, installation, and related services.

2.11. “Remote Services” are those Services performed by MSP for Customer from a location other than Customer’s place of business.

2.12. “Emergency Services” are those Services performed by MSP in response to Emergency Situations.

2.13. “Emergency Situations” means situations in which the systems administered and managed solely by MSP experience problems that result in fifty percent (50%) or more of the Customer workstations maintained solely by MSP becoming adversely affected. Loss of connection from a workstation to the server(s), or any issue rendering a workstation useless, does not in and of itself constitute an Emergency Situation requiring MSP’s Emergency Services.

2.14. “Normal Business Hours” means Monday through Friday between 8:30 AM and 5:30 PM Pacific Time, excluding publicly observed holidays and other MSP-observed holidays. Normal Business Hours are subject to change upon thirty (30) days written notice to Customer.

2.15. “After Business Hours” means Monday through Friday between 12:00 AM and 8:29 AM and 5:31 PM to 11:59 PM, and 24 hours a day on Saturday and Sunday and during publicly observed and other MSP-observed holidays.

 

  Section 3: Deposit

Customer shall pay MSP a deposit (the “Deposit”) in the amount of Zero Dollars ($0.00) upon execution of this Agreement. This amount will be credited toward the Services rendered to Customer under this Agreement that are not covered by an Additional Agreement. If MSP requires additional deposits under Additional Agreements, those deposits shall be governed solely by the applicable Additional Agreements.

  Section 4: Hourly Rates

Except as otherwise provided in any Additional Agreements, MSP’s hourly rates are as follows:

  • $195.00 per hour for all Standard, During Normal Business Hours, onsite services including:
    • Engineering Services (2-hour onsite minimum)
    • Lead and Senior Engineering Services (2-hour onsite minimum)
    • Technology Management Services (1-hour onsite minimum)
    • Security Consulting Services (1-hour onsite minimum)
    • Security Analyst Services (1-hour onsite minimum)
    • Security Engineering Services (1-hour onsite minimum)
    • Applications Engineering Services (1-hour onsite minimum)
    • Project Services (1-hour onsite minimum)
  • $292.50 per hour for all Standard, Extended Business Hours, onsite services (2-hour onsite minimum)
  • $390.00 per hour for all Standard, After Business Hours, onsite services (2-hour onsite minimum)
  • $125.00 per hour for all Standard, During Normal Business Hours, Remote Help Desk services (30-minute minimum)

 

All Remote Services will have a 30-minute billable minimum and will be billed in 15-minute increments thereafter. If MSP performs Services for Customer during After Business Hours, then Services will be billed at a rate equal to one and one-half (1.5) times the applicable base hourly rate, with a 2-hour minimum charge per incident.

  Section 5: Payment Terms on Equipment

Except as otherwise provided in any Additional Agreements, all equipment purchases will be payable immediately upon receipt of invoice.

  Section 6: Termination

MSP or Customer may terminate this Agreement at any time, with or without cause; provided, however, that Customer may not terminate this Agreement unless Customer has the right to terminate and does terminate any Additional Agreements then in effect. As long as any Additional Agreements remain in effect, then this Agreement shall also continue to remain in effect. Notwithstanding termination of this Agreement, Customer shall pay MSP for any Services rendered up to the date of termination. Upon termination of this Agreement by Customer and payment of all amounts owed to MSP under this Agreement, MSP shall refund to Customer any unused portion of the Deposit.

  Section 7: Disclaimers

7(a). General Disclaimer of Warranties

Customer acknowledges and agrees that there may be instances beyond MSP’s control, including but not limited to, problems with third-party software, hardware, services, products, and equipment, and/or other unforeseen circumstances that may prevent MSP from resolving Customer’s issues and/or problems. MSP makes no representations, warranties, or guarantees regarding either such third-party software, hardware, products, equipment, or services, or that MSP will be successful in resolving Customer’s issues and/or problems. MSP makes no representation, warranty, or guarantee (a) that it will be successful in identifying, alerting, stopping, eliminating, catching, or protecting Customer from computer and/or network-related security threats, such as viruses, worms, hackers, spyware, ransomware, or Trojan horses; (b) that any problem, issue, emergency, or other matter will be resolved within any time period; or (c) that its network monitoring services will identify 100% of all network or computer-related outages or issues.

All Services performed and products provided hereunder are performed, provided, and made available without warranty. All warranties, express or implied, oral or written, are hereby expressly disclaimed including, without limitation, (a) any warranty that any software is error-free, will operate without interruption, or is compatible with all equipment and software configurations; (b) any and all warranties of merchantability; (c) any and all warranties of fitness for a particular purpose; (d) any and all warranties arising from a course of dealing, usage, or trade practice; and (e) any and all warranties regarding non-infringement.

7(b). Cybersecurity Services Disclaimer

Customer acknowledges and agrees that the cybersecurity services, software, and tools provided under this Agreement and any Additional Agreements, including but not limited to endpoint detection and response, privileged access management, web filtering, mobile device management, security awareness training, and any other security-related services or software (collectively, “Security Services”), are designed to reduce the risk of cybersecurity incidents but do not and cannot guarantee complete protection against all threats, breaches, unauthorized access, data loss, ransomware, malware, or other cybersecurity events (“Security Incident”).

Customer further acknowledges that the cybersecurity threat landscape is dynamic and evolving, and that no technology solution, managed service, or combination thereof can provide absolute security. MSP makes no warranty, express or implied, that the Security Services will prevent, detect, or remediate all Security Incidents, and Customer agrees that the occurrence of a Security Incident during the term of this Agreement shall not, in and of itself, constitute a breach of this Agreement by MSP, except where such Security Incident is directly and primarily caused by MSP’s gross negligence or willful misconduct in the delivery of contracted Security Services.

In the event of a Security Incident, MSP’s total cumulative liability to Customer shall not exceed the value of one (1) month’s recurring fees paid by Customer under the applicable Additional Agreement in the calendar month immediately preceding the Security Incident, regardless of the form of action, and regardless of whether MSP has been advised of the possibility of such damages.

Customer is solely responsible for maintaining adequate cybersecurity insurance coverage, including but not limited to cyber liability and data breach insurance, sufficient to cover potential losses arising from a Security Incident. MSP’s provision of Security Services under this Agreement and any Additional Agreements shall not be construed as a substitute for, or render unnecessary, such insurance coverage.

7(c). Vendor and Third-Party Software Disclaimer

Customer acknowledges that certain Security Services, monitoring, backup, and other services delivered under this Agreement rely upon third-party software platforms and vendor services, including but not limited to SentinelOne, N-Central, ONEBackup, ONERecover, and other platforms as identified in any applicable Additional Agreements. MSP makes no warranty regarding the continued availability, pricing, or feature set of any third-party vendor platform. In the event that a vendor imposes a cost increase, discontinues a product, or materially changes the capabilities of a platform, MSP reserves the right to pass such cost increases through to Customer or substitute a comparable platform upon thirty (30) days written notice.

  Section 8: Limited Liability

MSP is in no way liable for any lost profits or lost revenues of Customer, any loss of Customer’s data (including, but not limited to, critical data either on Customer’s workstations and/or servers, backup devices, or other storage devices), business interruption, and planned or unplanned downtime as a result of the Services provided hereunder.

With respect to MSP’s backup and recovery services, including ONEBackup and ONERecover, MSP makes no guarantee or warranty that such services will operate error-free and makes no guarantee or warranty that Customer’s data will be recoverable in the event of Customer data loss, however caused. Customer acknowledges and agrees that Customer shall be responsible for ensuring that backup procedures are completed successfully and that all necessary files, folders, and other data are selected for backup in Customer’s backup jobs.

MSP shall have no liability whatsoever arising out of work performed pursuant to this Agreement, including any loss of data, business interruption, planned or unplanned downtime, losses, claims, damages, costs, or expenses. In no event shall MSP be liable to Customer or any other party for special, incidental, consequential, or exemplary damages arising out of work performed pursuant to this Agreement, however caused, whether based upon warranty, tort, contract, or the infringement or alleged infringement of intellectual property rights.

Except for intentionally wrongful acts or gross negligence, MSP’s liability for services provided under this Agreement directly (i.e., services not covered by an Additional Agreement) is in any event limited to the amount paid to MSP pursuant to this Agreement directly during the twelve (12) calendar month period preceding the month in which the claim is first asserted. MSP’s liability for services provided under any Additional Agreement is in any event limited to the amount paid to MSP pursuant to that Additional Agreement during the twelve (12) calendar month period preceding the month in which the claim is first asserted; provided, however, that with respect to Security Incidents as defined in Section 7(b), MSP’s total cumulative liability shall not exceed the value of one (1) month’s recurring fees paid by Customer under the applicable Additional Agreement in the calendar month immediately preceding the Security Incident. In the event of any conflict between the liability limitations set forth herein and those set forth in any Additional Agreement, the Additional Agreement shall control with respect to services governed by that Additional Agreement.

Customer agrees that MSP is not a party to nor will be liable for any violations of or non-compliance with software licensing contracts between Customer and any third-party software provider. Customer shall indemnify MSP against any claims arising out of such contracts. Customer is solely responsible for maintaining license compliance in accordance with all applicable software vendor end-user license agreements and state and federal laws.

This limitation of liability is an essential part of this Agreement, and MSP would not perform the Services without this limitation.

  Section 9: Non-Solicitation of MSP Employees; Liquidated Damages

Customer acknowledges that MSP has made and is continuing to make substantial investments in recruiting, training, and assigning its personnel, and that MSP would be deprived of the benefits of its investment if Customer were to solicit away from MSP, or hire, any personnel of MSP. Accordingly, Customer agrees that during the term of this Agreement and any Additional Agreements, and for a period of one (1) year after termination of this Agreement and all Additional Agreements, Customer (and any of its affiliates or subsidiaries) shall not directly or indirectly solicit for employment, or employ or attempt to employ as an employee, independent contractor, or otherwise, any employee of MSP who performed Services for Customer within three (3) years of the solicitation or hiring, without the prior written consent of an authorized representative of MSP.

Customer and MSP mutually acknowledge and agree that it would be impractical and extremely difficult to ascertain the amount of monetary damages caused by a breach of this provision. Therefore, in the event of a breach by Customer that results in an employee of MSP leaving MSP and going to work for Customer, either as an employee or as an independent contractor, Customer shall pay to MSP as liquidated damages an amount equal to One Hundred and Fifty Thousand Dollars ($150,000). This amount represents a reasonable estimate of damages MSP would suffer, taking into account the loss of revenue and significant costs of recruiting, training, and replacing such employee. Nothing in this paragraph shall limit MSP’s right to obtain injunctive relief or any other damages, including punitive, consequential, or special damages, as may be appropriate.

  Section 10: Confidentiality

10.1. MSP acknowledges that it may receive confidential information and trade secrets from Customer while carrying out the actions contemplated by this Agreement and any Additional Agreements. During the term of this Agreement and any Additional Agreements, and at all times afterwards, MSP agrees to safeguard Customer’s confidential information with the same degree of care that it uses to protect its own confidential information. For purposes of this Agreement, MSP’s Confidential Information includes, without limitation, all hardware configurations, software configurations, network designs, firewall rulesets, RMM monitoring policies, EDR configurations, access credential structures, and any other technical implementations deployed by MSP on Customer’s behalf or on Customer’s systems. Such configurations and implementations are the proprietary work product of MSP and shall not be disclosed to, reproduced by, or transferred to any third party without MSP’s prior written consent, including upon any transition to a successor service provider.

10.2. Customer acknowledges that it may receive or obtain MSP’s confidential information and trade secrets, including but not limited to proprietary software, algorithms, methods, and techniques, in the course of MSP’s performance of the Services. During the term of this Agreement and any Additional Agreements, and at all times afterwards, Customer shall not use or disclose MSP’s confidential information and trade secrets except with the prior written consent of MSP. Customer shall return all copies, in any medium, of such confidential information and trade secrets to MSP upon demand.

10.3. MSP will only share Customer data with those employees of MSP who need to use such data to perform work requested by Customer. MSP will not share Customer information with third parties without Customer’s explicit consent.

10.4. Marketing and Reference Use. MSP may reference Customer’s name and logo for marketing purposes solely upon Customer’s prior written consent. Customer may grant or withhold such consent at any time by providing written notice to MSP. In no event shall MSP reference specific work performed, infrastructure details, or industry-specific information about Customer’s environment without separate written approval from Customer.

 

  Section 11: Interest on Past-Due Obligations

If Customer fails to pay any or all monies due to MSP within thirty (30) days of the invoice date, the unpaid balance shall bear interest at the rate of one and one-half percent (1.5%) per month (18% per annum) from the invoice date until paid in full. The parties agree that this rate represents a reasonable estimate of MSP’s carrying costs and administrative burden associated with collection of past-due amounts, and is not intended as a penalty. If any applicable law limits the rate of interest that may be charged hereunder, the interest rate shall be reduced to the maximum rate permitted by law, and any excess amounts previously collected shall be credited against amounts due.

Reactivation Fee. Following any suspension of Services under this Agreement or any Additional Agreement due to Customer’s non-payment, and after Customer makes full payment of all amounts owed including accrued interest, MSP may restore Services after validating that all components to be monitored and/or managed under any applicable Order or Additional Agreement comply with MSP’s then-current security standards, patch levels, and best practices. Customer shall pay a “Reactivation Fee” for such restoration equal to one (1) month of the Service Fees applicable under the relevant Additional Agreement. This Reactivation Fee reflects the labor required to audit, remediate, and restore the environment to a managed state following a suspension period. MSP’s right to assess a Reactivation Fee is in addition to, and does not limit, any other remedies available to MSP.

 

  Section 12: General

12.1. Independent Contractor. MSP is, and at all times will be, an independent contractor. Nothing in this Agreement or any Additional Agreements shall be deemed to create an employer/employee, principal/agent, or joint venture relationship. Neither party has the authority to enter into any contracts on behalf of the other party or otherwise act on behalf of the other party.

12.2. Assignment. Neither party may assign or transfer its rights or delegate its obligations under this Agreement or any Additional Agreements without the other party’s prior written consent, which will not be unreasonably withheld. This Agreement and any Additional Agreements shall be binding upon the successors and assigns of the parties.

12.3. Entire Agreement; Order of Precedence. This Agreement together with any Additional Agreements and all schedules, attachments, exhibits, and addenda attached hereto or thereto constitute the final and complete understanding between the parties and supersede all previous oral or written agreements with respect to the subject matter hereof. In the event of any conflict or inconsistency between the terms of this Agreement and any Additional Agreement, the Additional Agreement shall control solely with respect to the services and subject matter governed by that Additional Agreement. In all other respects, this Agreement shall control.

12.4. Modification. MSP shall have the ability to modify, amend, or revise any of the terms and conditions of this Agreement (including, but not limited to, provisions regarding MSP’s fees) and any Additional Agreements upon thirty (30) days’ written notice to Customer. Customer may terminate this Agreement and any Additional Agreements within such thirty (30) day period if Customer does not consent to such modifications; provided, however, that MSP may avoid such termination by agreeing to rescind the proposed modification within fifteen (15) days after receipt of Customer’s notice of non-consent. If Customer does not terminate this Agreement and any Additional Agreements during such period, then all such agreements, as modified, shall be deemed adopted and authorized by Customer. Except as otherwise provided in this section, neither this Agreement nor any Additional Agreements may be modified or amended unless such modification is in writing and signed by each party.

12.5. Force Majeure. MSP shall not be liable to Customer for failure to perform any of its obligations under this Agreement or any Additional Agreements during any period in which such performance is delayed or rendered impracticable or impossible due to circumstances beyond MSP’s reasonable control, including but not limited to acts of God, flood, fire, earthquake, explosion, war, terrorism, government order or law, national or regional emergency, strikes or labor stoppages, epidemic or pandemic, shortage of power or transportation facilities, or other similar events beyond MSP’s reasonable control, provided that MSP promptly notifies Customer.

12.6. Governing Law and Jurisdiction. This Agreement and any Additional Agreements shall be governed by and construed in accordance with the laws of the State of California. Jurisdiction and venue shall exclusively lie in the County of San Bernardino, City of Rancho Cucamonga, California, in both state and federal courts.

12.7. Arbitration. Except for actions seeking injunctive relief, pre-judgment attachment, or other equitable relief that is not within the powers of an arbitrator, in the event of any controversy, claim, or dispute arising out of or relating to this Agreement or any Additional Agreement, or the breach, termination, enforcement, interpretation, or validity thereof (“Dispute”), either party may require that the Dispute be determined by binding arbitration conducted in San Bernardino County, California, before a single neutral arbitrator mutually selected by the parties. If the parties are unable to agree on an arbitrator within fifteen (15) calendar days of a demand for arbitration, the arbitrator shall be selected pursuant to the rules of the American Arbitration Association (AAA) Commercial Arbitration Rules then in effect. The arbitration shall be binding with no right of appeal. The arbitrator’s fees shall initially be borne equally by the parties, subject to the prevailing party fee recovery provisions of Section 12.10.

12.8. Severability. In case any provision of this Agreement or any Additional Agreement is held to be invalid, unenforceable, or illegal, that provision shall be severed, and such invalidity, unenforceability, or illegality will not affect any other provision of this Agreement or any Additional Agreement.

12.9. Waiver. The failure of either party to enforce any provision of this Agreement or any Additional Agreement is not a waiver of that party’s right to subsequently enforce that, or any other, provision of this Agreement or any Additional Agreement.

12.10. Attorney Fees and Costs; Debt Collection. In any judicial or arbitration proceeding involving any dispute or claim arising out of or related to this Agreement or any Additional Agreement, the prevailing party is entitled to recover all reasonable costs incurred pertaining to such proceeding, including reasonable attorneys’ fees and the prevailing party’s share of arbitration costs. If MSP uses a debt collection service or other means for collecting amounts owed by Customer hereunder, Customer shall pay all fees and expenses incurred by MSP in connection therewith, including fees and expenses associated with such debt collection efforts.

12.11. Indemnification. Customer will indemnify, defend, and hold harmless MSP for any losses, liabilities, claims, damages, fees, and expenses, including attorneys’ fees and costs, that arise out of, relate to, or result from, directly or indirectly: (i) any breach of any representation, warranty, or covenant or failure to perform by Customer; (ii) the acts, negligence, or omissions of Customer or any of its affiliates, representatives, agents, employees, or third parties working on behalf of Customer; or (iii) any loss or corruption of Customer’s data or security breaches of Customer’s network, except to the extent that such security breach is directly and primarily caused by MSP’s gross negligence or willful misconduct in the delivery of contracted Security Services under an applicable Additional Agreement.

12.12. Survival of Obligations. The following obligations will survive termination of this Agreement for any reason: Sections 1, 3, 4, and 5 (Payment Obligations); Section 6 (Termination); Section 7 (Disclaimers); Section 8 (Limited Liability); Section 9 (Non-Solicitation; Liquidated Damages); Section 10 (Confidentiality); Section 11 (Interest on Past-Due Obligations); Section 12.13 (Limitation Period for Claims); and Section 12.14 (No Disparagement).

12.13. Limitation Period for Bringing Claims. No claim, demand, or cause of action — whether based in contract, tort, statute, or any other legal theory — arising out of or related to this Agreement or any Additional Agreement, or the Services provided hereunder, may be made or brought by either party more than six (6) months after the date by which the fault, failure, or event giving rise to such claim should reasonably have been discovered by the claiming party. Failure to bring a claim within this six (6) month period shall forever bar such claim, regardless of any otherwise applicable statute of limitations. This limitation applies to all claims including those for breach of contract, negligence, misrepresentation, and breach of warranty, and is an essential and material term of this Agreement.

12.14. No Disparagement. Neither party, nor any of its respective officers, directors, employees, agents, affiliates, or representatives, shall initiate or participate in any action, conduct, statement, or communication — whether oral, written, or electronic — that is intended or reasonably likely to injure, bring into disrepute, ridicule, damage, or destroy the goodwill or reputation of the other party or its affiliates. This obligation applies during the term of this Agreement and any Additional Agreements and for a period of two (2) years following their termination or expiration. The foregoing shall not be construed to prevent or prohibit either party from: (i) exercising its rights under this Agreement; (ii) complying with a legal obligation or professional responsibility; or (iii) reporting or providing information to federal, state, or local governmental authorities as required by law. In the event either party breaches this section, the non-breaching party and its respective officers, directors, employees, affiliates, agents, and representatives shall no longer be bound by the obligations of this section.

 

  Section 13: Client Insurance Requirements

13(a). Customer Insurance Obligations

Throughout the term of this Agreement and any Additional Agreements, Customer shall obtain and maintain, at Customer’s sole expense, insurance coverage through a reputable insurer in the following minimum amounts:

  • Commercial General Liability: $1,000,000 per occurrence and $2,000,000 in the aggregate;
  • Workers’ Compensation: as required by applicable California law;
  • First-Party Cyber Liability and Data Breach: $1,000,000 per occurrence, covering Customer’s own systems, data, and networks. This coverage must specifically include costs arising from ransomware, data breach notification, forensic investigation, business interruption, and regulatory fines.

 

Customer shall provide MSP with certificates of insurance evidencing the above coverages upon request and within ten (10) business days of any written demand. Failure to maintain the required insurance coverage is a material breach of this Agreement.

13(b). Primacy of Customer’s Insurance

Customer’s insurance shall be primary over any insurance maintained by MSP. Customer agrees to waive, and to require its insurers to waive, any rights of subrogation or recovery they may have against MSP, its agents, officers, directors, and employees, arising from any claim covered by Customer’s insurance policies. MSP’s insurance shall be excess and non-contributing with respect to Customer’s insurance.

13(c). MSP Insurance Obligations

MSP agrees to maintain during the term of this Agreement professional liability insurance, including errors and omissions coverage, with aggregate limits of at least One Million Dollars ($1,000,000). Upon Customer’s written request, MSP will provide evidence of such coverage. In the event of an insurance coverage dispute, MSP is not required to dispute any coverage determination and is not required to file a declaratory judgment action.

13(d). Cyber Insurance Advisory

MSP’s provision of Security Services under this Agreement and any Additional Agreements does not reduce or eliminate Customer’s obligation to maintain its own cyber liability insurance. Customer acknowledges that no managed security service can guarantee complete protection against cybersecurity incidents, and that first-party cyber insurance is an independent and necessary component of Customer’s overall risk management strategy. MSP strongly recommends that Customer consult with a licensed insurance professional regarding appropriate cyber liability coverage levels for Customer’s specific industry, data types, and regulatory obligations.

 

  Section 14: Regulated Data and Data Processing

14(a). General Prohibition on Unannounced Regulated Data

Customer shall not provide, transmit, store, or otherwise make available to MSP any data, information, or material that is subject to regulation under any applicable federal, state, local, or international privacy or data protection law (“Regulated Data”) without first: (i) disclosing in writing to MSP the specific categories of Regulated Data and the applicable regulatory framework(s) governing such data; and (ii) executing a Data Processing Agreement (“DPA”) with MSP that specifically addresses MSP’s obligations with respect to that Regulated Data. Regulated Data includes, without limitation, data subject to the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA), the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and any similar laws applicable to Customer’s industry or operations.

14(b). Client Representation Regarding Data Categories

Prior to the commencement of Services under this Agreement or any Additional Agreement, Customer represents and warrants that it has conducted a good-faith review of its systems, operations, and data environment to identify all categories of Regulated Data that may be accessible to, processed by, or stored in systems managed by MSP. Customer shall disclose the results of this review to MSP in writing as a condition of commencing Services. Customer agrees to notify MSP promptly, and in no event later than thirty (30) days, of any material change to the categories of Regulated Data in Customer’s environment.

14(c). Data Processing Agreement Requirement

Where Customer’s engagement of MSP requires the processing of Regulated Data, the parties shall execute a separate DPA prior to the commencement of any Services involving such data. The DPA shall govern MSP’s processing activities with respect to the applicable Regulated Data and shall be incorporated into this Agreement by reference. Each applicable regulatory framework may require its own separate addendum to the DPA, or the parties may enter into a combined addendum addressing multiple frameworks, as determined by the nature of Customer’s regulated activities. MSP shall have no obligation to process Regulated Data until a fully executed DPA is in place.

14(d). HIPAA-Specific Obligations

Where Customer is a Covered Entity or Business Associate as defined under HIPAA, and MSP’s Services involve the creation, receipt, maintenance, or transmission of Protected Health Information (“PHI”), the parties must execute a Business Associate Agreement (“BAA”) in addition to any other applicable DPA. No Services that involve PHI may commence until a fully executed BAA is in place. Customer represents and warrants that it has obtained all necessary authorizations and consents to disclose PHI to MSP as required under HIPAA and applicable state health privacy laws.

14(e). Affordable Housing and Tenant Data

Customer acknowledges that tenant personal information collected in connection with affordable housing programs, income qualification, and related regulatory compliance — including but not limited to Social Security numbers, income documentation, and household composition data — may constitute Regulated Data under applicable California and federal law. Customer is solely responsible for ensuring that the collection, storage, processing, and transmission of such data complies with all applicable laws, including the CCPA/CPRA, HUD regulations, and any requirements imposed by tax credit program administrators or regulatory agencies. MSP’s access to systems containing such data shall be limited to the minimum necessary to perform contracted Services, and Customer shall establish appropriate access controls to enforce this limitation.

14(f). MSP’s Data Minimization Obligation

MSP shall access, process, and retain Regulated Data only to the minimum extent necessary to perform the contracted Services. MSP shall not use Regulated Data for any purpose other than the delivery of Services under this Agreement. Upon termination of the applicable Agreement or DPA, MSP shall, at Customer’s election, either return all Regulated Data in a mutually agreed format or securely destroy such data, and shall certify such return or destruction to Customer in writing within thirty (30) days of the termination date, unless legally required to retain such data.

Acceptance of Terms

By signing a Service Agreement, Order, or Statement of Work referencing this Master Services Agreement; by submitting payment for any services; or by accessing, using, or continuing to use any services provided by Onward IT, LLC, Customer acknowledges that it has read, understood, and agrees to be bound by this Agreement in its entirety. Customer represents that the individual accepting these terms is authorized to do so on behalf of the Customer entity and to bind Customer to these obligations.

If Customer does not agree to the terms of this Agreement, Customer must not use or access MSP’s services and must notify MSP in writing immediately.