CIS Managed Extended Detection & Response™ (MxDR™) Terms of Service

These CIS Managed Extended Detection and Response™ Terms of Service (these "MxDR Terms"), acting as an addendum to the MS-ISAC Membership Agreement, govern the provision of CIS MxDR services (the "Service") by Center for Internet Security, Inc. ("CIS") to the recipient designated on the applicable invoice ("Member"). By paying the invoice referencing these MxDR Terms, or by accessing, activating, or utilizing the Service, Member agrees to be legally bound by these MxDR Terms.

I. Definitions

Coverage Unit means the pricing metric for a selected Data Source, such as endpoints.

Data Source means a technology, platform, service, application, endpoint security tool, identity provider, cloud service, email platform, firewall, network device, log source, or other telemetry-producing system, as designated in an Order.

Entity Data means data, content, communications, logs, alerts, reports, Telemetry, and other information provided to or made accessible through CIS MxDR.

Order means an ordering document executed by Member that identifies purchased services, selected Data Sources, applicable Coverage Units, pricing, and service dates.

Service Description means a document provided by CIS specifying, as to a specific Data Source, what outputs will be produced, how the Service will be delivered, Member responsibilities, technical limitations/dependencies, and other relevant information.

Telemetry means logs, alerts, events, findings, metadata, indicators, configuration information, and other security-related information transmitted through a Data Source.

Underlying Technology Provider means a third-party provider of software, cloud services, security products, identity services, networking products, or other technologies integrated with or monitored through CIS MxDR.

II. Scope of CIS MxDR Services

A. Description of CIS MxDR

CIS MxDR is a managed cybersecurity monitoring, detection, investigation, threat-correlation, alerting, and remediation-guidance service delivered through the CIS Security Operations Center (SOC). The Service collects and analyzes Telemetry from the Data Sources identified in the applicable Order and uses analyst-driven processes to identify cybersecurity threats, suspicious activities, indicators of compromise, vulnerabilities, policy violations, and other security events.

Through a Member-facing online interface or dashboard, authorized users can obtain visibility into cybersecurity alerts, incidents, threats, security events, and related reporting affecting Member’s selected Data Sources. The Data Sources selected by Member shall be identified in the applicable Order and any associated Service Description(s). At launch, the Data Source supported by CIS MxDR is the Microsoft Defender for Endpoint functionality and edition currently referred to by the Underlying Technology Provider as Microsoft Defender for Endpoint, Plan 2. CIS may add, modify, or discontinue Data Sources from time to time.

B. No Response Activities

In providing the Services, CIS may investigate identified security events and provide recommendations to Member regarding containment, mitigation, remediation, and recovery; however, Member retains sole authority and responsibility for approving and implementing any response actions.

Unless otherwise agreed in a separate, signed agreement, CIS shall not perform any response actions, including but not limited to:

• Executing containment or remediation activities within Member environments
• Disabling user accounts
• Isolating devices
• Making configuration changes to any Member systems or endpoints

C. Security Event Notifications

If applicable, CIS shall notify Member of security events in accordance with the escalation procedures supplied by Member during onboarding, which may include telephone, email, ticketing systems, or other methods offered from time to time by CIS.

D. Additional Coverage & Services

CIS may offer add-on services from time to time, such as mobile security monitoring, multi-tenancy support, or email threat monitoring. Member may request add-on services and/or any additional Coverage Units, Data Sources, devices, or other service components, and any such additional coverage shall be documented in an updated Order governed by these MxDR Terms.

III. Term and Payment

A. Term

CIS shall provide the Service to Member for the period specified in the applicable Order, which may be extended if the parties enter into one or more additional Orders listing a further service term (the “Term”).

B. Payment

Member shall pay CIS all fees for CIS MxDR within thirty (30) days of invoice unless otherwise specified. Unless otherwise provided in the MS-ISAC Membership Agreement or prohibited by applicable law, late payments shall bear interest at the lesser of 2% per month, or the highest rate permitted by law. CIS may suspend services for nonpayment following written notice.

C. Pricing

Pricing for the Service is based on the Coverage Units identified in the applicable Order. Coverage Units may vary by Data Source. Examples include:

• Endpoint-based pricing
• User-based pricing
• Device-based pricing
• Subscription-based pricing
• Other metrics designated by CIS

IV. MS-ISAC Membership

A. MS-ISAC Membership Requirement

The Service is available exclusively to organizations maintaining an active membership in good standing with MS-ISAC.

B. Relationship to Membership Agreement

These MxDR Terms supplement the Membership Agreement between MS-ISAC and the Member. The Membership Agreement provides the foundational legal, business, and administrative terms governing the parties' relationship, including, but not limited to, provisions regarding indemnification, limitation of liability, confidentiality and warranties, and dispute resolution, all of which are fully incorporated into these MxDR Terms by reference.

Except as otherwise specified, the terms of the Membership Agreement remain unchanged and apply in full force to the Service.

V. Member Responsibilities

At all times during the Term, Member agrees to:

• Timely complete all onboarding requirements specified by CIS
• Maintain Data Sources in accordance with CIS onboarding instructions
• Maintain connectivity necessary for Telemetry transmission
• Maintain supported versions of operating systems, applications, platforms, and Data Sources
• Maintain all required licenses and subscriptions for selected Data Sources, including maintenance and support contracts
• Provide CIS with current escalation contacts
• Notify CIS of material changes affecting selected Data Sources
• Protect account credentials and authentication mechanisms and promptly notify CIS of suspected misuse or security issues affecting CIS MxDR
• Cooperate with CIS investigations and ticket resolution activities
• Obtain authorizations necessary for CIS to access and process Telemetry

VI. Miscellaneous

A. Amendments

The Term may be extended, and/or Data Sources may be added by an Order signed by the Member. Otherwise, these MxDR Terms may only be amended in a writing signed by both Parties.

B. Data Use & Ownership

Member retains all right, title, and interest in its Entity Data. Member grants CIS a non-exclusive, royalty-free license to access, process, analyze, transmit, store, and use Entity Data as necessary to:

• Provide Member with the Service and otherwise perform its obligations under this Agreement
• Maintain and improve the MxDR service offering
• Conduct cybersecurity analysis
• Develop threat intelligence
• Support operational security

In addition, CIS may use de-identified and aggregated information derived from Entity Data for service improvement, benchmarking, analytics, cybersecurity research, threat intelligence, and product development.

C. Underlying Technology Providers

Some Data Sources monitored through CIS MxDR may be provided by Underlying Technology Providers. Member acknowledges that its use of those technologies may be subject to agreements between Member and the Underlying Technology Provider and/or other third-party terms and conditions.

Provider-specific terms may be incorporated by reference into future Orders or Service Descriptions.

---

CIS Contract Version Date: 9/17/26