## SECURITY CONSULTATION SOW This Statement of Work ('SOW') is entered into by and between the parties noted on the ordering documents referencing this SOW (the 'Order Form') and describes the services to be performed by Snowflake under this SOW ('Technical Services'). This SOW shall come into effect as of the effective date of the Order Form (the 'SOW Effective Date') and shall be incorporated by reference thereto. For the purposes of this SOW, 'Customer' means the party that is purchasing Technical Services. Notwithstanding any provision to the contrary hereunder or in the Order Form, where Technical Services are purchased through a Snowflake authorized distributor or reseller ('Reseller'): (a) the performance of the Snowflake obligations hereunder shall be performed through such Reseller; (b) no privity of contract is established between Snowflake or any of its Affiliates and Customer, and this SOW is not deemed an agreement (separate or otherwise) between Snowflake or any of its Affiliates and Customer; and (c) such Reseller is responsible for any claims or damages relating to, or arising out of, this SOW. 1. Description of Technical Services. During the Term, Snowflake shall provide the following Technical Services: ## Technical Service Overview The Snowflake Security Consultation Technical Services package is designed to assist Customer in the overall Snowflake security implementation design with initial configuration approaches of the Snowflake Service through a series of interactive workshops. At the conclusion of the Security engagement, Snowflake will provide documentation on the content delivered during each workshop and will deliver a final presentation of the engagement results and recommended next steps. Unless otherwise agreed to in writing, all Technical Services will be delivered remotely. Security documentation may be customized during the course of the Technical Services, which are planned for one to two continuous weeks (M-F). Customer should plan for approximately thirty to forty hours of direct interaction with the Snowflake Solutions Architect through workshops, follow-up meetings, and the final presentation readout. Workshops will follow a set structure with time-boxed activities for each of the following: - Key Concept Review - Example Implementations - Requirement Review - Solution Design/Configuration Approach The workshops conducted during this Technical Services engagement are described below: | Workshop Subject | Snowflake Topic Areas | |--------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Privacy Compliance | - Privacy regulations and associated requirements - Snowflake architectural implications - Backups - Time travel - Right to be forgotten - Time boxing sensitive object grants - Row/column level masking, redaction, filtering | | Network Security | - Snowflake network architecture - Black/white list for IP's for network policy implementation - Private Link approach - Multi-factor authentication | |---------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Authentication | - Authentication methods (Snowflake, SAML, OATH) - Initial authentication integration configuration approach | | User Lifecycle Management | - User lifecycle requirements - Initial user lifecycle process flow approach | | Authorization (RBAC) | - Use case evaluations from a security perspective - Naming convention establishment for roles - Data access needs identification of user groups - Role hierarchy design by user groups - Role hierarchy scripting approach | | Secure Data Sharing | - Data sharing/exchange overview - Security options - Secure views with user-defined functions - Secure views with access controls | | Security Monitoring | - Security monitoring requirements and control indicators - SEIM integration - Security control indicator monitoring approach | ## Snowflake Provided Resources Snowflake will provide the following: | Snowflake Resource | Responsibilities | |-------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------| | Snowflake Solutions Architect | - Deliver the specified workshops as described above - Deliver final presentation of engagement results and recommended next steps | | Snowflake Services Delivery Manager | - Schedule and lead pre-kickoff planning meeting - Schedule workshop delivery - Coordinate with Customer and attendees on workshop participation | The Technical Services will be delivered remotely, unless otherwise agreed to in advance in writing by the parties. ## Customer Provided Resources Customer will provide the following resources to coordinate activities with Snowflake as noted below; multiple Customer Resources may be filled by the same individual: | Customer Resource | Responsibilities | |---------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Project Manager | Coordinate with Snowflake on project activity planning, scheduling, milestone management, risk management/mitigation, Customer resource participation/scheduling, and will participate in project kickoff. | | Program Lead | Responsible for Customers' Snowflake strategy and direction; has decision- making authority for Snowflake implementation. Will participate in all workshops. | | Security Admin | Responsible for implementing and maintaining Role Based Access Control on securable objects within the Snowflake Service. Overall security SME with input on overall security access requirements and will participate in all working sessions. | |------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Information Security Analyst | Responsible for day-to- day activities of Customers' overall data and systems security approach and processes. SME input on Customers' overall data privacy and access requirements. | | Database Administrator | Responsible for the day-to-day activities associated with Snowflake. Will participate in most workshops. | | Network Administrator | Responsible for Customer's day -to-day network administration activities and will participate in network related working sessions. | | System Administrator | Responsible for Customer's day -to-day Snowflake Service configuration and will participate in working sessions on an as-needed basis. | ## 2. Pricing and Payment Terms. The Technical Services described in this SOW will be provided on a fixed price basis pursuant to the fees and payment terms set forth on the Order Form or other order documentation referencing this SOW. Unless otherwise set forth in the Agreement, Customer shall not be due any credit or refund for any Technical Services. Late Payments: Unless otherwise set forth in: (a) the Agreement or (b) the applicable Order Form or other order documentation referencing this SOW, if any fees payable directly to Snowflake remain unpaid past the due date, then: (i) the overdue balance will be subject to interest at the rate of one and one-half percent (1.5%) per month (or the maximum allowed by applicable law), and (ii) Snowflake may, upon seven (7) days advance written notice to Customer, suspend Snowflake's performance of any Technical Services until Customer's payment obligations are made current. In addition, Customer will be responsible for any costs resulting from collection by Snowflake of any overdue balance, inclu ding, without limitation, reasonable attorneys' fees and court costs. Change Orders: Any requirement(s) or deviations from the Technical Services described herein will be considered outside of the scope and must be procured on a separate SOW or through a signed amendment or change order to this SOW ( ' Change Order') that may result in additional cost and/or modified terms. 3. Expenses . Fees exclude any travel or related expenses. If applicable, Snowflake will work directly with Customer to plan reasonable travel, hotel and other expenses required in connection with the provision of the Technical Services described in this SOW. Any costs attributable to such travel, hotel and other expenses shall be invoiced by Snowflake and payable by Customer and are in addition to the fees set forth herein. 4. Scheduling and Term. All Technical Services must be scheduled in advance and must be completed within one year from the Effective Date of this SOW ('Term'). Rescheduling Policy . There will be no rescheduling fee for Technical Services that are rescheduled more than thirty (30) days in advance. For Technical Services rescheduled more than fourteen (14) days, but fewer than thirty (30) days in advance, Customer will be charged for any non-refundable travel expenses and/or change fees incurred by Snowflake. For Technical Services rescheduled fourteen (14) or fewer days in advance, Customer will be charged: (a) a rescheduling fee of ten-thousand dollars ($10,000 USD) (or its equivalent amount if charged in a different currency) and (b) for any non-refundable travel expenses and/or change fees incurred by Snowflake. The fees set forth in this section are in addition to any fees set forth above in Section 2 and will be billed separately. ## 5. General Provisions. - a. This SOW shall be governed by the Agreement as defined herein. The 'Agreement' means the agreement designated in the Order Form. If no Agreement is designated on the Order Form, the terms and conditions of the Snowflake Technical Services Addendum located at https://www.snowflake.com/legal-gov/ ('Addendum') shall apply. If the Agreement does not expressly include terms applicable to Snowflake's provision of Technical Services, then for purposes of this SOW, the Agreement shall also incorporate by this reference, the Addendum. Notwithstanding the foregoing, where Technical Services are purchased through a Reseller, all Snowflake obligations in the 'Addendum' are deemed obligations of such Reseller, an d the Addendum is not an agreement (separate or otherwise) between Customer and Snowflake. - b. In the event of any inconsistency or conflict between the terms and conditions of this SOW and the Agreement, the terms and conditions of this SOW shall govern with respect to the subject matter of this SOW only. Unless otherwise defined herein, capitalized terms used in this SOW shall have the meaning defined in the Order Form, Agreement or Addendum (as applicable). This SOW may not be modified or amended except in a written agreement signed by a duly authorized representative of each party. - c. For clarity, Customer's use of the Service is governed by the agreement it entered into with Snowflake or a Reseller for the purchase and use of such Service and not this SOW. ## 6. Assumptions and Dependencies. The parties agree on the following: - a. Notwithstanding anything in the Agreement to the contrary, Snowflake shall own all rights, title and interest in and to the Service and any Technical Services, deliverables, tools or related pre-existing or developed intellectual property provided or made available by Snowflake under this SOW. - b. Unless otherwise agreed to by the parties, all electronic and hard copy versions of any deliverables are provided for Customer's internal purposes only. Customer is prohibited from reselling or sublicensing any deliverables. Customer may not utilize the deliverables to replicate or attempt to perform the Technical Services or to develop or attempt to develop any of the products described in such deliverables. Deliverables are not subject to any maintenance, support or updates. - c. Customer may not record, film, stream or otherwise capture in video or audio format any performance or aspect of the Technical Services. - d. To facilitate security of Customer Data and associated systems, Customer will not grant Snowflake access to Customer Data under this SOW. In addition, except for access to the applicable Snowflake Account (if contemplated within the scope of the Technical Services described herein), Customer will not grant Snowflake access to any non-Snowflake systems, networks, or applications. If applicable, Customer is solely responsible for ensuring that the duration and scope of access to the Snowflake Account is strictly limited to the access required hereunder and such access may not extend past the Term of this SOW. Snowflake will have no liability under this SOW related to the access noted in this Section. - e. Snowflake reserves the right to subcontract the Technical Services described herein. Snowflake will be responsible for the performance of any subcontractors engaged in the delivery of the subcontracted Technical Services. - f. Customer will assign a Project Manager for the duration of the project who will coordinate meeting schedules and availability of Customer personnel reasonably needed for the delivery of the Technical Services. - g. Customer will be responsible for determining if, how and when it will implement any recommendations made by Snowflake. - h. The Technical Services will be provided during regular business hours (8am to 5pm local time), Monday through Friday (holidays excluded). - i. If applicable, any onsite Technical Services will be delivered at the ship to address listed on the Order Form or other documentation referencing the SOW. - j. Technical Services do not include any custom configurations.