STATEMENT OF WORK (SOW)

This Statement of Work ("SOW") is issued pursuant to and subject to the terms and conditions of the Master Service Agreement ("MSA") between QSai LLC ("Service Provider") and [Client Name] ("Client"). In the event of any conflict between this SOW and the MSA, the MSA shall govern unless expressly stated otherwise herein.

1. PROJECT OVERVIEW

1.1 Background

Provide a brief description of the engagement context. Example:

"Client has engaged Service Provider to conduct [service type] services to evaluate and enhance the security posture of its systems, networks, or organizational processes."

1.2 Objectives

• To identify vulnerabilities, gaps, or risks within the designated scope
• To provide actionable recommendations for remediation or improvement
• To support compliance with applicable cybersecurity standards or frameworks
• To deliver findings and guidance appropriate to Client's industry and risk profile

2. SCOPE OF SERVICES

2.1 Service Type (select applicable)

Offensive Security Assessment: Penetration testing, vulnerability assessments, red team exercises, and simulated attack scenarios on systems designated by Client. Conducted under written authorization.

vCISO / Fractional CISO: Ongoing strategic cybersecurity leadership including policy development, program management, board reporting, vendor risk oversight, and security roadmap advisory. Delivered on a retainer or defined hour basis.

AI-Augmented Security Engagement: Security analysis, policy generation, SOW review, threat modeling, or compliance advisory delivered with the assistance of AI models (Anthropic Claude, OpenAI GPT-5.3-Codex) under Service Provider's verified partner access. All AI-assisted outputs are reviewed by a qualified practitioner before delivery.

GRC / Compliance Advisory: Gap assessments, control mapping, policy development, and audit preparation for frameworks including SOC 2, ISO 27001, NIST CSF, HIPAA, PCI-DSS, CMMC, and others as specified.

Incident Response (IR) Support: On-demand or retainer-based IR assistance including containment, forensic triage, eradication, recovery support, and post-incident reporting.

Training & Tabletop Exercises: Executive and technical security training, phishing simulation design, and facilitated tabletop exercises based on realistic threat scenarios.

Custom / Other: [Describe]

2.2 In-Scope Systems / Personnel / Processes

• [List specific systems, networks, applications, departments, or data types in scope]
• [Include IP ranges, URLs, cloud environments, or organizational units as applicable]

2.3 Out-of-Scope

• [List any systems, environments, or activities explicitly excluded from this engagement]

2.4 Deliverables

• Initial Engagement Plan / Scoping Document
• Detailed Technical Findings Report (where applicable)
• Executive Summary Report
• Remediation Recommendations with prioritized risk ratings
• Post-Engagement Consultation Session
• [Additional deliverables specific to service type]

3. PROJECT TIMELINE

3.1 Schedule

• Project Start Date: [Date]
• Engagement Duration: [X] weeks / [X] months
• Draft Report / Interim Deliverable: [Date]
• Final Report / Deliverable: [Date]
• Post-Engagement Review Session: [Date]

All dates are estimates and subject to Client cooperation and access. Service Provider will communicate any delays promptly.

4. PRICING AND PAYMENT

4.1 Project Fees

• Engagement Services: $[Amount]
• Reporting and Analysis: $[Amount] (if separately billed)
• Retainer / Ongoing Advisory (if applicable): $[Amount]/month
• Total Project Cost: $[Amount]

4.2 Payment Terms

Payment schedule and terms as per the Master Service Agreement. Unless otherwise agreed: 50% due upon SOW execution, 50% due upon delivery of final Deliverables. Retainer engagements billed monthly in advance.

4.3 Expenses

Travel, tools, or third-party service costs, if any, shall be pre-approved in writing and reimbursed at cost.

5. PROJECT REQUIREMENTS

5.1 Client Responsibilities

• Provide necessary access, credentials, and environment documentation
• Designate a primary point of contact with authority to approve scope and deliverables
• Review and approve test plans or engagement charters prior to commencement
• Participate in scheduled status meetings and review sessions
• Obtain all necessary internal and third-party authorizations before engagement begins
• Implement backups and contingency measures prior to any active testing

5.2 AI-Assisted Engagement Notice (if applicable)

Where this engagement includes AI-Augmented Services, Client acknowledges that outputs generated with AI model assistance are reviewed by a qualified practitioner before delivery and do not constitute legal, regulatory, or compliance certification. Client retains responsibility for validating and implementing recommendations.

6. CONFIDENTIALITY & DATA HANDLING

All Client Data, findings, and engagement details are governed by the confidentiality provisions of the MSA. Service Provider will not disclose engagement details, Client systems information, or vulnerability findings to any third party without Client's prior written consent, except as required by law.

7. ACCEPTANCE

By signing below or accepting electronically, the Parties agree to the terms and conditions of this Statement of Work, which is incorporated into and governed by the Master Service Agreement.

Service Provider: QSai LLC
Authorized Representative: Andrew Ostashen, Managing Member
Date: [Date]

Client: [Client Name]
Authorized Representative: [Name], [Title]
Date: [Date]