Virtus Group - Change / Variation Order (MASTER)

v1.2 MASTER

Owner: Virtus Group Ltd • Audience: Clients, Reviewers & Operations • Classification: Public • Next Review: 2026-09-05

How to use this master: Replace tokens like {{CLIENT_NAME}} and {{PROJECT_NAME}}. Do not alter structure, headings, or styling. Keep Baselines v1.2 note and Evidence Links.

1. Document Metadata

Client: {CLIENT_NAME}

Project: {PROJECT_NAME}

Effective date: {EFFECTIVE_DATE}

Version: {VERSION}

Status: {STATUS}

Owner: {DOC_OWNER}

Assurance Index: here • T&Cs: here

2. Compliance Note

NZISM/PSR mapping is maintained centrally: see Security Overview. This document inherits the Organisation’s Baselines document.

3. Reference

Parent SoW: {{PARENT_SOW_URL}} • Work Order (if applicable): {{PARENT_WO_URL}}

Related clauses changed: {{CLAUSE_REFS}}

4. Change Summary

Area	Previous	New	Impact
Scope Δ	{{SCOPE_PREV}}	{{SCOPE_NEW}}	{{SCOPE_IMPACT}}
Schedule Δ	{{SCHED_PREV}}	{{SCHED_NEW}}	{{SCHED_IMPACT}}
Cost Δ	{{COST_PREV}}	{{COST_NEW}}	{{COST_IMPACT}}
Risks Δ	{{RISK_PREV}}	{{RISK_NEW}}	{{RISK_IMPACT}}

5. Financials

Item	Qty/Hours	Rate/Unit (excl. GST)	Amount

6. Approvals

Role	Name	Signature	Date
Client Authorised Signatory	{{CLIENT_SIGN_NAME}}		{{EFFECTIVE_DATE}}
Virtus Authorised Signatory	{{VIRTUS_SIGN_NAME}}		{{EFFECTIVE_DATE}}

7. SLAs & Baselines

Tier: {{TIER}} • RTO/RPO: {{RTO}}/{{RPO}}
Vulnerability SLAs: Critical ≤7d (≤72h internet-facing), High ≤14d, Medium ≤30d, Low ≤90d
Restore testing: ≥1 verified restore/month/client; quarterly workload; annual full DR + semiannual tabletop
Backups: 3‑2‑1‑1‑0; retention 30d/12m/7y
Identity/Device: MFA for all, PAM JIT, FDE, EDR 100%, OS ≤14d, critical apps ≤7d