Managed Oversee: Service Terms

Automated detection runs 24/7 across all instrumented planes. Human coverage, severity clocks, and escalation below are contractual for Managed Oversee clients and stated for Platform clients.

Coverage

• Automated detection: 24/7, all instrumented planes.
• Managed human coverage: duty desk 07:00 to 19:00 America/Phoenix, Monday to Saturday; Severity 1 pages the on-call lead 24/7.
• Platform human support: business hours, Monday to Friday, email and console.

Severity and response

Level	Examples	Managed response	Platform response	Updates	Target
S1 Critical	Off limits (RED) data zone breach; undeclared agent holding a live credential against regulated data; rogue cloud key actively minting credentials or reading secrets.	30 minutes	2 business hours	Hourly until contained	Containment inside 4 hours
S2 High	Governed agent drift (new tool or endpoint); attestation failing at the edge; undeclared application with agent traffic.	2 hours	1 business day	Every 4 business hours	Resolution inside 2 business days
S3 Medium	Candidate findings awaiting triage; a stale fleet sensor; data readiness remediation items.	1 business day	2 business days	Weekly roll up	Resolution inside 10 business days
S4 Low	Reports, tuning requests, questions about findings, portfolio reviews.	2 business days	3 business days	Weekly roll up	Scheduled with the client

Escalation

• L1 Duty analyst: triage, containment start, client notice.
• L2 Practice lead: an S1 uncontained at 1 hour escalates here; owns the incident plan.
• L3 Client named owner and GSIS account lead: an S1 uncontained at 2 hours; business decisions (deactivation, disclosure) are the client's to make, with our evidence.

Service credits

Managed Oversee: a 5 percent fee credit for each month with a missed S1 response target, capped at 25 percent of that month's managed fee. Credits are claimed against the monthly service report, which publishes response performance either way.

Client responsibilities

• Keep the registry declared: new agents, keys, and integrations registered before use.
• Answer approval and triage requests inside the severity clocks.
• Keep collectors and sensors enrolled and current.
• Name and maintain the client side incident owner.

Honest limits

• No detection guarantee outside the instrumented planes. The named blind spot (browser and SaaS session telemetry) is disclosed in every report.
• Incident response plans and evidence are included; litigation support and forensic testimony are a separate engagement.
• Containment executes through the client's own connectors and control points under the client's policy; GSIS does not hold standing write access to client production systems.