This Addendum applies where Customer is a financial entity subject to Regulation (EU) 2022/2554 on digital operational resilience for the financial sector ("DORA") or equivalent national rules, and has indicated so in an Order or by written notice. It supplements the Terms of Service, the Data Processing Addendum and the Security Addendum and is intended to satisfy the contractual requirements of Article 30(2) DORA for ICT services. Where Customer classifies the Service as supporting a critical or important function, Section 9 applies in addition.
MetisGrid ("MetisGrid") is an ICT third-party service provider for the purposes of this Addendum. Nothing in this Addendum makes MetisGrid a financial entity or subjects it to supervision in its own right.
1. Description of Services
MetisGrid provides MetisForge, a software-as-a-service platform for designing, conducting, evaluating and reporting on cybersecurity tabletop exercises and related readiness activities, including AI-assisted content generation and analysis, as described in the Documentation and the applicable Order.
The Service is a training and readiness tool. It is not an operational security control and is not intended to support the execution of a Customer's business functions, payment processing, transaction handling or incident response in production.
2. Locations of Service Provision and Data Processing
The Service is provided from, and Customer Content is processed and stored in, the United States. Subprocessor locations are listed on the Subprocessor List. MetisGrid will give Customer at least 30 days' notice before changing the country of processing or storage of Customer Content.
3. Data Protection
Provisions on availability, authenticity, integrity and confidentiality of data are set out in the Security Addendum and the Data Processing Addendum. On termination, Customer Content is made available for export and then deleted as set out in Section 12 of the Terms of Service.
4. Service Levels
Service levels, where agreed, are set out in the applicable Order.
MetisGrid will report availability performance on request.
5. Incident Assistance
MetisGrid will notify Customer of Security Incidents within 48 hours and will provide, at no additional cost, reasonable assistance with ICT-related incidents affecting the Service, including information needed for Customer's incident classification and regulatory reporting, as set out in the Security Addendum and the Data Processing Addendum.
6. Cooperation with Competent Authorities
MetisGrid will cooperate with Customer's competent authorities and resolution authorities, including by making available information reasonably requested concerning the Service, to the extent required by DORA.
7. Termination Rights
In addition to the termination rights in the Terms of Service, Customer may terminate the affected Order on written notice where:
- MetisGrid is in significant breach of applicable law, regulation or contractual terms;
- circumstances are identified in the monitoring of ICT third-party risk that are deemed capable of altering the performance of the Service, including material changes affecting the arrangement;
- MetisGrid has evidenced weaknesses in its overall ICT risk management, including in the way it ensures availability, authenticity, integrity and confidentiality of data; or
- Customer's competent authority can no longer effectively supervise Customer as a result of the arrangement.
Where termination is exercised under this Section, MetisGrid will refund prepaid fees for the unused portion of the subscription term.
8. Exit and Transition
MetisGrid will provide a minimum transition period of 90 days following termination, during which Customer may continue to export Customer Content and MetisGrid will provide reasonable assistance to transfer Customer Content to Customer or a replacement provider in a commonly used machine-readable format. Assistance beyond export functionality is chargeable at MetisGrid's then-current rates unless termination results from MetisGrid's breach.
9. Additional Terms for Critical or Important Functions
Where Customer has notified MetisGrid in writing that the Service supports a critical or important function, the following additional terms apply:
- Service-level targets include quantitative performance targets and the right for Customer to require corrective action where targets are not met.
- Notice periods and reporting: MetisGrid will notify Customer of any development that may materially affect its ability to provide the Service in line with agreed service levels.
- Business contingency: MetisGrid will maintain and test business continuity and disaster recovery plans covering the Service and will provide summaries of test results to Customer on request.
- Participation in testing: MetisGrid will participate, at Customer's reasonable request and cost, in Customer's threat-led penetration testing to the extent the Service is in scope.
- Audit and access: Customer, its auditors and its competent authorities have unrestricted rights of access, inspection and audit relating to the Service, on reasonable notice and subject to confidentiality and the protection of other customers' information. MetisGrid will cooperate fully during on-site inspections.
- Exit strategies: MetisGrid will support Customer's exit strategy, including by providing a transition period of up to 12 months on request and the assistance described in Section 8.
- Subcontracting: MetisGrid will notify Customer before engaging a subcontractor that will perform a material part of the Service supporting the critical or important function, and Customer may object on reasonable grounds.
10. Register of Information
On request, MetisGrid will provide the information Customer needs to maintain its register of information under Article 28(3) DORA, including MetisGrid's legal name, registered address, Legal Entity Identifier where one is held, the type of ICT service, data locations, and subprocessor details.
11. Order of Precedence
If this Addendum conflicts with the Terms of Service or an Order on a matter it addresses, this Addendum controls for Customers to which it applies. The Data Processing Addendum controls for processing of Personal Data.