Virtus Group Work Order — Time & Materials (MASTER)

Contractual basis: This Statement of Work (SOW) is issued under and governed by the Virtus Group Ltd Master Services Agreement (MSA) between the Client and Virtus Group Ltd. In the event of inconsistency, the MSA order of precedence applies. Any changes to this SOW must be documented and signed via a Change Variation Order (CVO) before work proceeds.

1. Document Metadata

2. Compliance Note

NZISM/PSR mapping is maintained centrally: see Security Overview. This document inherits the organisation’s Baselines document.

3. Background

[Client] have engaged Virtus Group (hereby referred to as VGL) to assist with the implementation of [title /context of the project]. The resultant deliverable will be [intended outcome of the engagement].

4. Service Description

The following is in scope of this Work Order:

• investigations/prerequisites
Planning
• Documentation/Preparation of Implementation plan
• Implementation
• Testing
• Post-implementation support (if agreed)
• Etc.

Deliverables include the following items:

• [details of deliverables]

Notes

• The total duration of the engagement will depend on the available dates for implementations.
• The commencement of work will be agreed once the work order is approved.
• Any changes to the scope of this engagement will be managed via a variation.

5. Out Of Scope

The following items are out of scope for this Work Order:

• Project Management
• Back-end changes to [Client] services
• Hardware procurement, installation and cabling
• Licenses and/or related user costs and configurations
• Changes to end devices - PCs, Servers, network devices not included in this WO ([Client] task).
• User Acceptance testing ([Client] tasks)
• Post-implementation closeout report ([Client] task).
• Any remedial works of goods or services provided by others
• Any item not explicitly listed as In Scope

6. Assumptions

The following assumptions have been made in the context of this Work Order:

• The project will be delivered without interruption or suspension.
• [Client] will have non-exclusive access to VGL’s resources during the project.
• VGL’s project team members will perform all their duties remotely through off-site activities.
• VGL will not be delayed due to the procurement and installation of any required infrastructure (hardware and/or software).
• Change controls will be submitted and managed by [Client] with VGL providing technical input only.
• Any representatives of [Client] that are involved at the various steps in the project are available as planned, adequately skilled and competent to execute the tasks required of them.
• Any decision-making representative nominated by [Client] is duly empowered to do so.
• Any request from VGL to [Client] for functional or technical clarification will be responded to in a timely manner.
• There are no other projects in progress that will hinder the implementation of this project.
• Leave only the one that applies
• The work will be performed remotely through offsite activities
• The work will be performed onsite at {Client} premises
• Unless specified otherwise, the work will be performed during normal business hours. If any tasks need to be carried out after hours there will be provisions and a specific rate for that in the appropriate section
• [Client] will provide remote access to enable after-hours support (if required).
• If needed, [Client] will provide a suitable working environment at their site (desktop, desk, chair, etc.) to complete the engagement.
• [Client] will document and perform all User Acceptance Testing (UAT).
• Information provided to VGL for this project will be accurate and complete.

7. Dependencies

The Supplier will be excused from any failure or delay in performing the Project to the extent reasonably prevented by any of the following conditions:

• Access to [Client] environment and designs i.e., Network diagrams.
• Business and change approvals.
• Change Management: [Client] to submit RFCs, present in CAB and secure approvals.
• [Client] to grant VGL access to all necessary lab environments and ensure all components needed for VGL to complete the activities are available and functional as needed.
• Hardware: [Client] to procure and install the required hardware, firmware and licenses and deal with EOL/OES situations
• Licenses: [Client] to procure the required licenses for lab and production

8. Deliverables & Acceptance

9. Responsibilities

Virtus

• Provide suitably skilled technical resource/s to deliver the in-scope activities on a time and materials basis
• Work in good faith with all parties to achieve the deliverables

Client

• Sign off on this Work Order and provision of a Purchase Order
• Onboarding: Access for VGL personnel to [Client] systems in the context of this Work Order.
• Availability of the appropriate environments to test configurations and validate procedures.
• Assign the appropriate resources for the testing activities as defined.
• Define schedule/provide options on dates for the implementation stages as needed.

10. Completion Criteria

This Work Order will be deemed complete when any one of the following criteria is me, whichever happens first:

• The deliverables specified are complete.
• The PO value is exhausted.
• [Client] provides VGL with 10 business days’ notice, in writing, that the engagement is no longer required.
• [Anything else required before the project can be marked as finalised].

11. Commercials

This Work Order will be charged on a time and materials basis. The estimated investments for this engagement will be NZD $x.x (excl. GST) utilising an estimated [QTY] hours of effort.

All work will be based on a minimum draw down of one hour and all hours are to be consumed within [timeframe] from signing. Only hours worked will be charged for.

Notes:

• VGL’s Business Hours are Monday – Friday 8:00am to 5pm, excluding public holidays and any closedown period.
• After Hours rate at x1.5 Business Hours rate.
• Public Holidays - 2x the specified hourly rate

VGL will advise [Client] when this engagement reaches 70% (or the agreed threshold if different) of the value of the Purchase Order. If VGL is required to continue to work over the value of the PO provided an approved variation will be required

Invoicing

This Work Order will be invoiced on a time and materials basis. VGL’s billing cycle runs from the 26th to the 25th of the month. Invoices will be presented following the end of the billing cycle. Invoices will be payable on the 15th of the month following the date of invoice. VGL will charge [Client] for the actual time worked. Expenses will be invoiced monthly as incurred plus a 5% margin for administration.

12. Delays & Cancellations

In the event of any unscheduled delays due to [Client] failing to fulfil any of their obligations or suspending the project, VGL may invoice [Client], at VGL’s current hourly rate and associated costs, for any resources which are consequently made idle and, after reasonable efforts at reallocation, cannot be redeployed. VGL must be allowed additional time to re-allocate resources to the project after a period of delay if those resources have been assigned to alternative work.

13. Contract Changes (if MSA in place)

14. Conditions

This Work Order is valid for 30 days from issue and is subject to VGL’s standard terms and conditions, available on request or from our website at TaCoS

15. Legal

Confidentiality

This document contains confidential and proprietary information of Virtus Group Ltd (“VGL”). {Client Full Name} (“{Client Short Name}”) may not disclose the confidential information contained herein to any third party without the written consent of VGL, save that {Client Short Name} may disclose the contents of this document to those of its agents, principals, representatives, consultants or employees who need to know its contents for the purpose of {Client Short Name}’s evaluation of the document. {Client Short Name} agrees to inform such persons of the confidential nature of this document and to obtain their agreement to preserve its confidentiality to the same extent as {Client Short Name}. As a condition of receiving this document, {Client Short Name} agrees to treat the confidential information contained herein with at least the same level of care as it takes with respect to its own confidential information, but in no event with less than reasonable care. This confidentiality statement shall be binding on the parties for a period of five (5) years from the issue date stated on the front cover unless superseded by confidentiality provisions detailed in a subsequent agreement.

15.1 Standard Conditions

The Client will have non-exclusive access to VGL’s resources during the project.

15.2 Non-solicitation

15.2.1 No solicitation of employees

Neither party may actively solicit for employment or contracting any employees or other personnel of the other party or placed by the other party during the life of this Agreement. If one party (the “engaging party”) engages (employs or contracts) an individual who is either:

(a) currently engaged with the other party; or

(b) was engaged during the three (3) month period prior to the date of engagement with the other party, where such new engagement results from a direct approach to that individual by the engaging party (whether in conjunction with an advertisement or not),

then the engaging party will pay a finder's fee of 25% of the individual’s new annualised remuneration plus GST to the other party.

Within 30 days, of the Effective Date of this Agreement, and any subsequent change in personnel described in this item, {Client} will ensure that each of its IT managers are notified of {Client} obligations in this clause.

15.2.2 Genuine advertisment not solicitation

Clause 15.2.1 does not prevent either party from employing any person who responds to a genuine advertisement placed by the other party as long as there is no concurrent approach in person by that party’s staff.

Terms & Conditions: See TaCoS.

16. SLAs & Baselines

• Tier: {{TIER}} • RTO/RPO: {{RTO}}/{{RPO}}
• Vulnerability SLAs: Critical ≤7d (≤72h internet-facing), High ≤14d, Medium ≤30d, Low ≤90d
• Restore testing: ≥1 verified restore/month/client; quarterly workload; annual full DR + semiannual tabletop
• Backups: 3‑2‑1‑1‑0; retention 30d/12m/7y
• Identity/Device: MFA for all, PAM JIT, FDE, EDR 100%, OS ≤14d, critical apps ≤7d

17. Handover & Support

Knowledge transfer, artefacts and administrative handover will be completed at close-out.

18. Approvals

On-going Support (Please tick)

I require a separate agreement for On-going Support

I require a separate agreement for On-going Support

Please sign, scan, and email document to admin@virtusgroup.biz

19. Evidence Links

• BCDR Summary
• Incident Response Plan
• Breach Response Procedure
• MDM Baseline
• Cloud Governance Baseline
• Vulnerability Management
• Runbooks (Ops)