Convergeone, Inc. CSA 20230627 - Laserfiche WebLink

Home

Consulting Services Agreement between City of San Leandro and Last revised 06/09/2023 ConvergeOne for Infrastructure Managed Services Exhibit A – Page 11 of 26 o Engineers will determine whether the manufacturer issued product updates apply to the Supported Products. > Recommendation for action to be taken based on applicability o If the product updates are applicable to Customer’s Supported Products, engineers will make an appropriate recommendation as to whether the updates should be implemented based on the way in which the products are deployed, and the specific features utilized within Customer’s environment. o If a product update is recommended, Seller will submit a formal request for change (RFC) including documentation of the risks and benefits of the update and any Customer requirements for the implementation. > Remote implementation of product update as approved by Customer o All product updates are subject to Customer’s approval prior to installation. o Once approved, Seller will schedule the implementation as appropriate. o All product updates will be completed remotely where possible. o For certain updates an on-site resource may be required to insert a disk into the disk drive for remote implementation of the update. On-site support can be provided by Seller at the rates outlined in section 3.1 of this SOW. On-site support from Seller is available in the US only. > Post implementation testing > Quarterly reporting of updates/minor upgrades that were recommended and installed, as well as an inventory of covered equipment to include software, hardware and firmware release versions (including firmware release for gateways, media modules, circuit packs) Out of Cycle Updates As requested by Customer, Seller will implement critical updates outside of the scheduled Release Management Cycle for the affected Supported Products. Such critical updates could be identified from a Customer executed vulnerability scan or through Customer’s threat detection services. > Critical Updates are defined as any of the following: o Vulnerabilities identified via Common Vulnerabilities and Exposures (CVE) that are scored as critical or high by the Common Vulnerability Scoring System (CVSS). o Updates or patches identified as critical or high on the threat index. > Remote implementation of Critical Updates as approved by Customer o If the implementation of Critical Updates can be accomplished by scheduling the updates within the regular scheduled release management cycle for the Supported Product; as approved by Customer, the Critical Updates will be implemented during such regularly scheduled release update. o Otherwise, Seller will utilize the monthly allotment of hours as defined in Section 3 of this SOW, to apply patches, service packs and firmware releases designated as Critical Updates. DocuSign Envelope ID: EA0A1203-02DA-42E0-9D8C-A7B9368C06F7