Sophos Managed Detection and Response – Service Description

Managed Detection and Response and Managed Detection and Response Plus

This Service Description describes Sophos Managed Detection and Response (“Sophos MDR”) and Sophos Managed Detection and Response Plus (“Sophos MDR Plus”) (each a “Service”).

This Service Description is part of and incorporated into, as applicable: (i) Customer’s or Managed Service Provider’s (“MSP”) manually or digitally‐signed agreement with Sophos covering the purchase of a Service subscription; (ii) Managed Service Provider’s manually or digitally-signed agreement(s) with Sophos covering its purchase of Offerings of which the Service is a part; or (iii) if no such signed agreement exists, then this Service Description will be governed by the terms of the Sophos End User Terms of Use posted at https://www.sophos.com/legal (collectively referred to as the “Agreement”). To the extent there is a conflict between the terms and conditions of the Agreement and this Service Description, the terms and conditions of this Service Description will take precedence.

Notwithstanding anything to the contrary in the Agreement, Customer/MSP acknowledges and agrees that: (i) Sophos may modify or update the Service from time to time, provided that such modifications do not materially reduce the overall scope or level of the Service; and (ii) Sophos may modify or update this Service Description from time to time to reflect changes to the Service, provided that such updates do not materially reduce Sophos’s obligations with respect to the Service. Any updated Service Description will become effective upon posting to https://www.sophos.com/legal.

I. DEFINITIONS

Capitalized terms used in this Service Description, and not otherwise defined in the Agreement, have the meaning given below:

“Agentless Third-Party Endpoint” means any devices or server systems running a supported third-party endpoint security product and configured to transmit telemetry continuously to Sophos Central without the need of Sophos XDR or XDR Sensor (i.e., API-based ingestion, log or event streaming/exports, connectors, or other supported transmit methods).

“Case” means a record within Sophos Central that documents and tracks an investigation, query, or request, including, without limitation, associated Detections, analysis, communications, Response Actions, status updates, and resolution details. Cases may be automatically generated or upon Customer/MSP request via Sophos Central.

“Covered Endpoint(s)” means any Monitored Endpoint or Agentless Third-Party Endpoint that is designated by the Customer/MSP to be covered by the Service and that, as a condition of Service delivery, is properly configured in accordance with Sophos documentation, operational, and continuously transmitting required telemetry such that it remains visible to Sophos through Sophos Central.

“Detection” means a determination by Sophos, or by a Sophos-supplied detection mechanism (including Sophos-authored rules, signatures, models, analytics, threat intelligence, and correlation logic), that data generated by a Covered Endpoint or Integrated System is an indicator of malicious or suspicious activity. For clarity, Detection does not include data generated by detection content authored by Customer/MSP (or by a Partner or Beneficiary on Customer/MSP's behalf) whether within Sophos Central or within any third-party tool.

“Health” means the state of configurations and settings of Covered Endpoints and Integrated Systems, visible within Sophos Central that affect the efficacy of security controls or Sophos's ability to deliver the Service.

“Incident” means a Sophos confirmed compromise or unauthorized access of system(s) threatening the confidentiality, integrity, or availability of Customer/MSP assets, and requires Incident Response due to the presence of malicious activity such as interactive attacker behavior, data encryption or destruction, credential abuse, or data exfiltration.

“Incident Response” means the technical process performed remotely by Sophos to Investigate, contain, mitigate, and neutralize an Incident, as described in Article III, Section 2.

“Incident Response Advisor” or “Advisor” means a Sophos personnel assigned as the primary point of contact for Customer/MSP during an Incident, as further described in Article III, Section 2.1.2(a).

“Integrated System(s)” means supported Sophos or non-Sophos systems (for example, identity, cloud, email, firewall, network, or other security relevant systems), which are configured to send telemetry, alerts, or security events into Sophos Central using Sophos supported integrations and integration mechanisms. Integrated Systems do not include Covered Endpoints.

“Investigation” means the formal process and methods used by Sophos to determine whether activity in a Case is malicious and requires Threat Response.

“Investigation Case” means a Case that originates from a Detection or from a Threat Hunting finding and that, in Sophos's reasonable judgment, has security relevance warranting analysis to determine whether the activity is malicious. Investigation Cases are conducted through a combination of human review and automated processes by Sophos, and may also be manually created by Sophos.

“Monitored Endpoint(s)” means any system on which Sophos XDR or XDR Sensor is installed and operational in support of Service delivery. Supported operating systems and platforms are as set forth in Sophos documentation, which Sophos may update from time to time.

“Priority Investigation” means an Investigation Case that Sophos has classified as high or critical severity, based on a holistic assessment of available evidence including potential impact, urgency, attacker behavior, and affected assets. Sophos's classification of an Investigation Case as a Priority Investigation is final for all purposes of this Service Description.

“Remediation Guidance” means guidance provided by Sophos regarding actions Customer/MSP may need to take on Covered Endpoints, Integrated Systems, or Customer/MSP security tools to address Health conditions, support Threat Response, or mitigate or resolve an Incident.

“Response Action” means an action performed by Sophos, manually or through Sophos's automated systems, to investigate, contain, disrupt, or neutralize malicious or suspicious activity, including actions performed within Sophos Central and actions executed on or against Monitored Endpoints or Integrated Systems. Response Actions may include, without limitation, customer notification, remote query, host isolation, process termination, deletion or quarantine of malicious artifacts, blocking indicators, disabling users, revoking sessions, modifying configurations, policies, or other settings within Sophos Central, updating or inserting indicators into supported products, and other actions supported by the applicable integration. For Agentless Third-Party Endpoint, Response Action means host isolation and host un-isolation only. The Response Actions available for supported Sophos products and integrations are described in the Sophos MDR Response Actions documentation, as updated from time to time.

“Service Software” means Sophos XDR and/or XDR Sensor, as applicable in the context of the Service.

“Sophos XDR” means Sophos Endpoint Protection with XDR.

“Threat Hunting” means the process of proactively and iteratively searching through data available within Sophos Central using a combination of manual and automated activities to identify signals and indicators of malicious activity that may have evaded existing controls.

“Threat Response” means the methods, processes, communications, and Response Actions used by Sophos, with Customer/MSP cooperation as applicable, to contain, disrupt, mitigate, or neutralize malicious or suspicious activity. Threat Response may include Response Actions performed by Sophos and Remediation Guidance provided to Customer/MSP.

“Threat Response Mode” means the authorization model selected by Customer/MSP in Sophos Central that governs whether and how Sophos takes Response Actions during Threat Response, as further described in Section 1.2.

“XDR Sensor” means Sophos XDR Sensor.

II. TIERS OF SERVICE

There are two tiers of Service available for purchase by Customer/MSP:

1. Sophos MDR: Includes only the activities and benefits described in Article III, Section 1.
2. Sophos MDR Plus: The MDR Plus tier includes the activities and benefits described in Article III, Sections 1 and 2. Incident Response under Section 2.1 is conducted only on Monitored Endpoints running Sophos XDR; the Service Level Agreement (Section 2.2) and Breach Protection Warranty (Section 2.3) apply as set forth in those Sections, subject to the requirements and exclusions stated therein and in Articles IV and V.

III. SCOPE OF SERVICE

The Service consists of the activities described below for the tier purchased by Customer/MSP.

1. Activities applicable to Sophos MDR and Sophos MDR Plus

1.1 Onboarding. During onboarding, the following activities must be performed by Customer/MSP as a precondition to delivery of the Service:

a. Customer/MSP will (i) provide contact information, (ii) determine communication preferences (for example, email, telephone, and/or Sophos Central), and (iii) select the Threat Response Mode within Sophos Central. MSP must act as the contact for Services provided to a Beneficiary of MSP.

b. MSP is solely responsible for: (i) obtaining any consents or information required from its Beneficiaries in order for Sophos to perform the Service, (ii) ensuring Beneficiaries take all actions required of Customers under this Service Description, and (iii) advising Beneficiaries of the risks and potential impacts of the Service.

c. Customer/MSP or Partner will configure the environment so that Covered Endpoints and Integrated Systems transmit applicable telemetry to Sophos Central in accordance with Sophos documentation. This may include (i) installing and configuring applicable Service Software on Monitored Endpoints, and (ii) configuring applicable Agentless Third-Party Endpoints to transmit telemetry to Sophos Central.

1.2. Threat Response Modes

In accordance with 1.1 above, Customer/MSP will select the desired Threat Response Mode in Sophos Central. Available Threat Response Modes are:

1. Authorize: Grant pre-authorization to Sophos to perform Threat Response and be notified after Response Actions are taken.

2. Collaborate: Sophos will conduct Investigations, but no Response Actions are taken without Customer/MSP’s written consent. However, certain Response Actions such as remote query or evidence collection may be undertaken without Customer consent or involvement.

   • Collaborate then Authorize: An option exists under Collaborate, which if selected, authorizes Sophos to operate in Authorize mode in the event Sophos does not receive acknowledgment from Customer/MSP after making reasonable attempts to contact all Customer defined contacts.

3. Notify Only: Sophos will conduct Investigations and provide Remediation Guidance. Customer/MSP acknowledges and agrees that Notify Only can materially delay containment and disruption actions and may increase risk to Customer/MSP systems, business operations, and data.

1.3 Health Checks. Sophos will perform an initial assessment of Health within thirty (30) days after completion of the onboarding process described in Section 1.1, which may include a review of Sophos XDR configurations and settings to identify conditions that may impact the effectiveness of security controls or the delivery of the Service. Sophos may identify Health conditions in connection with the initial assessment or at any time during the Service subscription term and may notify Customer/MSP and provide Remediation Guidance, where appropriate. Failure to timely implement Remediation Guidance may result in diminished Service quality, or limitations in Sophos's ability to perform Investigations and take Response Actions.

1.4 Triage, Investigation, and Threat Response.

a. Triage and Prioritization. Sophos analyzes Detections to identify, aggregate, and prioritize activity for further analysis. Triage may produce machine-generated Cases for review by Sophos.

b. Investigation. Sophos conducts Investigations to confirm whether activity is malicious or suspicious and to determine an appropriate response. Investigations leverage telemetry, threat intelligence, automation, and human analysis. Sophos may use Investigation outcomes to filter out expected or benign activity and to enhance the visibility of suspicious activity in Customer/MSP's environment. Filtering decisions are made in Sophos's reasonable judgment based on then-available information, and Sophos is not obligated to retroactively re-investigate previously filtered activity. An Investigation Case may be resolved without Response Action where Sophos determines the activity is not malicious, does not warrant Threat Response, or where the Threat Response Mode selected by Customer/MSP does not authorize Sophos to act.

c. Severity Classification. Sophos classifies Investigation Cases by severity to inform prioritization and response. Severity classifications are determined by Sophos in good faith based on the totality of available evidence, with no single factor being determinative. Sophos's severity classification will control for purposes of this Service Description, including Service Level Agreement measurement under Section 2.2. Investigation Cases classified as Critical or High severity are Priority Investigations as defined in Article I.

Sophos may reclassify an Investigation Case as additional information becomes available. An Investigation Case reclassified as High or Critical severity, becomes a Priority Investigation at the time of reclassification.

The indicators below are illustrative only. Severity is determined based on the totality of available evidence as described above, and no individual indicator determines the severity classification.

 

d. Threat Response. Where Threat Response is warranted, Sophos performs Threat Response in accordance with the Threat Response Mode selected by Customer/MSP. Threat Response may include (i) Response Actions performed by Sophos on Covered Endpoints, in Sophos Central, or against Integrated Systems where technically supported through Sophos product capabilities or supported integrations, and (ii) Remediation Guidance provided to Customer/MSP for actions Customer/MSP may need to perform on Covered Endpoints, Integrated Systems, or Customer/MSP security tools. Customer/MSP is solely responsible for configuring and enabling the applicable product features and integrations necessary for Response Actions to be performed. Sophos may at its sole discretion add, modify, or remove the Sophos products and Response Actions supported under the Service from time to time.

e. Notification and Reporting. Sophos notifies Customer/MSP of Cases in accordance with Article IV, Section 7 (Service Notifications), and may also provide notifications regarding significant Health issues or misconfigurations. Sophos provides reporting and status updates related to Detections, Cases, and Response Actions through Sophos Central in such form, content, and frequency as Sophos determines is appropriate for the Service. Custom reporting beyond the standard reporting available through Sophos Central is out of scope and may be available as a separate professional services engagement.

1.5 Availability. All monitoring, Investigations, and actions described in Section 1.4 will be provided on a 24/7/365 basis. Customer/MSP will also have direct call in access to Sophos to review suspected Incidents on a 24/7/365 basis.

1.6 Service Level Targets. The following service level targets are utilized to provide Customers/MSPs with timing guidelines for Investigation Cases (and not from Threat Hunting activities). These targets only apply to Investigations on Covered Endpoints and Integrated Systems. These targets are not a service level agreement and may vary by integration type, data availability, and the Customer/MSP’s selected Threat Response Mode.

 

1.7 Threat Hunting. Sophos will conduct Threat Hunting using a combination of manual and automated methods to search for threats that may have evaded existing controls based on threat intelligence and relevant indicators of compromise observed in Investigations. Threat Hunting is limited to data available within Sophos Central for Covered Endpoints and supported Integrated Systems and focuses on identification of attacker behaviours and tactics. If Threat Hunting reveals indicators of malicious activity, an Investigation Case will be created. For clarity, automated analytics, correlation rules, or alert-triggered workflows operating in response to existing Detections constitute reactive Investigation and do not constitute Threat Hunting.

1.8 Remote Access and Administrative Access. To support Service delivery, Sophos may utilize Sophos owned or selected remote access tools to access or make changes to Covered Endpoints and may utilize administrative access to Customer/MSP’s Sophos Central environment to view or modify configurations.

If Customer/MSP has selected Authorize Threat Response Mode, then such access will not require additional approval for each action. If Customer/MSP has selected Collaborate Threat Response Mode, then Sophos will request authorization before performing any modifications. All access by Sophos to Covered Endpoints and Sophos Central is recorded and logged.

CUSTOMER/MSP ACKNOWLEDGES AND AGREES THAT CUSTOMER’S AUTHORIZATION FOR SOPHOS TO MAKE ANY CHANGES TO, OR MODIFY CONFIGURATIONS IN, CUSTOMER’S/MSP’S/BENEFICIARY’S ENVIRONMENT COULD RESULT IN INTERRUPTION OR DEGRADATION OF CUSTOMER’S/MSP’S/BENEFICIARY’S SYSTEMS AND INFRASTRUCTURE. CUSTOMER/MSP FURTHER ACKNOWLEDGE THAT FAILURE TO GRANT AUTHORIZATION FOR SUCH CHANGES COULD RESULT IN NEW MALICIOUS ACTIVITY OR THE WORSENING OF EXISTING MALICIOUS ACTIVITY. SOPHOS WILL HAVE NO LIABILITY TO CUSTOMER/MSP FOR ANY DAMAGES ARISING FROM OR RELATED TO SUCH NEW OR WORSENED MALICIOUS ACTIVITY IF THE CUSTOMER/MSP HAS DENIED SOPHOS’S REQUEST FOR AUTHORIZATION TO MAKE CHANGES OR MODIFICATIONS.

1.9 Language Support. Sophos may offer optional language support as part of the standard Service and/or product capability, or translation support through third party providers (“Language Support”). Customer/MSP acknowledges and agrees that Sophos is not responsible for the accuracy, completeness, or reliability of third-party translation, and Sophos is not liable for issues arising from Language Support.

2. Additional Scope and Benefits only to MDR Plus Service Tier.

2.1 Incident Response. Incident Response is performed remotely and applies only to Incidents affecting Monitored Endpoints running Sophos XDR. Customer/MSP remains responsible for containment, eradication, and recovery on all other systems, supported by Remediation Guidance from Sophos. Investigation activities and Remediation Guidance under this Section 2.1 may extend to Integrated Systems and other Customer/MSP systems where supported by available telemetry and Service capabilities, provided that the applicable Integrated Systems are configured to send telemetry to Sophos Central prior to the occurrence of the Incident and in accordance with Sophos documentation.

Incident Response includes the activities and support described below.

2.1.1 Incident Response Initiation.

Sophos, at its sole discretion, initiates Incident Response after validating that observed or reported activity constitutes a confirmed Incident. Potential Incidents may be identified through Detections, Integrated Systems, Customer/MSP reports, threat intelligence, Threat Hunting, or Sophos’s internal analysis; and such activity is subject to triage and severity classification prior to initiation of Incident Response. For clarity, Customer/MSP reports of suspected activity may prompt review but do not, by themselves, trigger Incident Response.

Conditions that may trigger Incident Response initiation include, but are not limited to:

• Interactive attacker activity on Monitored Endpoints
• Confirmed compromise of privileged or access-enabling credentials
• Unauthorized access to, or exfiltration of data
• Encryption, destruction, or material disruption of Monitored Endpoints
  

Severity of an activity is determined based on a holistic assessment of available evidence by Sophos, and no single indicator or condition is independently determinative. Sophos retains sole discretion to initiate or decline Incident Response for any activity based on its professional assessment of the activity’s severity.

2.1.2 Incident Response Scope.

The following activities are in scope during an Incident Response:

a. Incident Response Advisor. Upon Incident Response initiation, Sophos will assign an Incident Response Advisor for the duration of the Incident.

1. Assignment: Sophos will make reasonable efforts to maintain Advisor continuity throughout the Incident but may reassign Advisors based on availability or operational requirements.
2. Availability: The Advisor is available during their standard business hours. Outside of these hours, a member of Sophos is available to assist. Sophos maintains 24/7/365 availability for all active Incidents regardless of individual Advisor availability.
3. Scope: The Advisor provides coordination and communication support only, and does not manage the overall Incident lifecycle or assume operational control of Customer/MSP response activities, including stakeholder coordination, action prioritization, or cross-functional alignment.

b. Triage and Investigation

1. Conduct triage and Investigation to identify Incident severity, scope, impact and priority to support containment.
2. Analyze Detections, telemetry, and relevant data sources to determine the nature and scope of the malicious activity, the techniques employed, and relevant contributing factors.
3. Develop an Incident timeline, where feasible.

c. Containment and Threat Response

1. Execute supported Response Actions, as reasonably determined by Sophos, to contain, mitigate, disrupt, or neutralize malicious activity.
2. Provide Remediation Guidance for actions requiring Customer/MSP involvement or that cannot be performed by Sophos.
3. Provide recommendations to reduce the risk of further malicious activity and help prevent recurrence.

d. Communication and Collaboration

1. Provide Case correspondence, status updates, and tracking through Sophos Central.
2. Schedule meetings upon Customer/MSP request during active Incidents, subject to resource availability.

e. Incident Closure

1. Sophos determines when an Incident is closed, based on its assessment that the malicious activity has been contained, mitigated, or neutralized, or that no further Incident Response activity is warranted. Upon closure, the Incident Response Advisor assignment concludes and delivery reverts to the standard Service activities described in Section 1, including 24/7/365 monitoring, Investigation, and Threat Response.
   
   

f. Post-Incident Support

1. Deliver an incident summary within the existing Priority Investigation describing the nature and scope of the activity, the techniques employed, relevant contributing factors, and recommendations to reduce recurrence.
2. Conduct a Health assessment following Incident closure reviewing Sophos Central configurations, policies, and protection status, and provide Remediation Guidance to help prevent recurrence.

2.1.3 Third-Party Handover.

If Customer/MSP elects to engage a third-party Digital Forensics and Incident Response firm , or where a tripartite agreement is in place between Sophos, Customer/MSP and a third-party in connection with Incident Response (each, a “Third Party Firm”), Customer/MSP may request in writing (including by email) that Sophos transition Incident Response activities for the affected Incident to the Third Party Firm. Sophos will reasonably cooperate in facilitating an orderly transition and will provide relevant Investigation findings, status updates, and artifacts collected by Sophos up to the point of transition. All such findings and artifacts are provided on an as-available basis based on Sophos telemetry, and do not constitute a complete forensic record. Customer/MSP must provide reasonable cooperation to facilitate the transition, including timely communication of Third Party Firm requirements and coordination of necessary access or information sharing. Sophos may participate in transition discussions at Customer/MSP’s request but is not responsible for organizing, scheduling or managing engagements with the Third Party Firm.

Following the transition, Sophos will cease Incident Response activities for the affected Incident and release the assigned Incident Response Advisor. Standard Service delivery under Section 1 continues unaffected.

At Customer/MSP's written request, Sophos may share relevant Sophos telemetry and Investigation findings with the Third Party Firm.

Reactivation of Incident Response activities for that Incident is at Sophos's discretion.

2.1.4 Exclusions.

Activities not explicitly mentioned in Section 2.1.2 are outside the scope of Incident Response, including without limitation:

• Preparation of formal legal chain-of-custody documentation or court-admissible evidence
• Decryption services
• Dark web monitoring
• System restoration or recovery
• Disk-level forensic imaging or analysis
• E-discovery or litigation support
• Ransomware negotiation
• On-site services
• Regulatory, compliance, or breach notification guidance
  

Incident Response does not apply to any Customer/MSP assets that were not in compliance with the requirements set forth in Section 2.1 at the time of the Incident. Incident Response is also excluded for any penetration testing, red team engagements, adversary simulation exercises, or similar testing activities.

2.2 Service Level Agreement (“SLA”). The SLA set forth in this Section applies only to Customers or, in the case of an MSP, to individual MSP Beneficiaries that have purchased an MDR Plus subscription. For clarity, the SLA applies on a per-Customer or per-Beneficiary basis and does not apply to an MSP account in the aggregate.

a. Definitions. The following defined terms apply to this Service Level Agreement:

“Priority Investigation” has the meaning set forth in Article I.

“Time to Respond” means the elapsed time between Sophos’s identification of a Priority Investigation and the earlier of: (i) Sophos initiating outreach to notify the applicable Customer/MSP via agreed communication channels, or (ii) Sophos initiating a Response Action where Customer/MSP has selected Authorize Threat Response Mode.

b. Service Commitment. Time to Respond will be within sixty (60) minutes for ninety percent (90%) of Priority Investigations measured on a monthly basis beginning on: (i) sixty (60) days from the Service purchase date for net new Customer or Beneficiary (via MSP), or (ii) the first day of the Service subscription renewal date for existing Customers or Beneficiaries (via MSP). If Sophos fails to meet the foregoing monthly Time to Respond commitment in more than three months during any rolling twelve-month period, then Sophos shall be deemed to have missed the SLA.

c. Service Credit. If Sophos misses the SLA for an eligible Customer or Beneficiary as described above, the applicable Customer or MSP (on behalf of the affected Beneficiary) will be eligible to receive a service credit equal to the lesser of: (i) five percent (5%) of the fees paid for the Service during the previous billing cycle, or (ii) five thousand dollars ($5,000 USD) (the “Service Credit”). Service Credit will be applied toward the subscription fee for the next Service subscription term. For MSPs, Service Credits are issued solely to the MSP account associated with the affected Beneficiary. Sophos has no obligation to issue any payment or credit directly to a Beneficiary, and the MSP remains solely responsible for any downstream adjustments to the accounts of its Beneficiaries. If the applicable subscription lapses following the prepaid term, any earned Service Credit will be forfeited.

d. Service Credit Request Procedure. Customer/MSP must request the Service Credit in writing and deliver such request to [email protected] with “MDR Service Credit” in the subject line within thirty (30) calendar days from the time Customer or Beneficiary becomes eligible to receive a Service Credit. Requests must be supported with evidence from relevant logs or report data. Customer/MSP may claim a Service Credit no more than three (3) times in any calendar year. All Service Credit requests are subject to verification by Sophos.

e. Exclusions. Sophos shall not be responsible for meeting the SLA in whole or in part due to conditions set forth in Articles IV and V.

2.3 Breach Protection Warranty. This warranty is available in accordance with the terms at www.sophos.com/legal.

IV. CUSTOMER/MSP RESPONSIBILITIES

For either Service tier, Customer/MSP acknowledges and agrees that, in addition to the actions required of Customer/MSP in Article III, Section 1.1 and elsewhere in this Service Description, Customer/MSP must take the following actions to facilitate and enable delivery of the Service, and Sophos shall have no liability for any degraded, incomplete, or failed Service delivery which may result from Customer/MSP’s failure to take the required actions. Sophos reserves the right to suspend Service delivery until such time as Customer/MSP performs the required actions. Failure to complete the required actions after written notice from Sophos (including email notice from Sophos to the Customer/MSP designated contacts) shall constitute a material breach by Customer/MSP of the Agreement.

1. Onboarding: Customer/MSP will complete required onboarding activities.
2. Installation and Integration Requirements: Customer/MSP/Beneficiary must:
   1. have a valid, active Sophos Central account;
   2. deploy and configure the applicable Service Software to the Monitored Endpoints;
   3. configure Agentless Third-Party Endpoint;
   4. configure required Integrated Systems to transmit applicable telemetry to Sophos Central in compatible formats;
   5. maintain compliance with Health check requirements where applicable (as described in Article III Section 1.3); and
   6. run only supported versions of Sophos software and supported third party tools and integrations.
3. Minimum Required Deployment: Customer/MSP acknowledges and agrees that Service Software must be deployed on at least eighty percent (80%) of licensed volume as this is necessary to provide Sophos with sufficient visibility into Customer’s/MSP’s environment for Service delivery.
4. Remediating Known Threats: Customer/MSP must make reasonable efforts to timely remediate compromises reported by Sophos or by other third-party technologies used by Customer/MSP/Beneficiary. Sophos will not be responsible or liable for any issues caused by Customer’s/MSP’s failure to take remediation steps in a timely manner. Additionally, Sophos has no obligation to notify Customer/MSP or generate new Cases from Detections for which Sophos has already provided recommended Remediation Guidance.
5. Time and Date Settings: Customer/MSP must ensure that all Covered Endpoints maintain accurate time and date settings.
6. Customer/MSP Personnel: Customer/MSP must designate, and keep current within Sophos Central, at least one primary and one alternate authorized contact, each with the technical and business knowledge and authority to (i) approve Response Actions during Threat Response, (ii) authorize configuration or policy changes, and (iii) act as escalation point during Priority Investigations and Incidents. For Beneficiaries, MSP must act as the authorized contacts on behalf of the Beneficiary.
7. Service Notifications. Sophos will provide Service-related communications and notifications as follows: (i) Case and Investigation details will be made available through Sophos Central; (ii) notifications regarding Cases and Investigations will be sent by email to Customer/MSP’s designated contacts and may direct the recipient to Sophos Central for additional details; and (iii) telephone outreach will be initiated as described in Article III, Section 1.4(c). Customer/MSP is responsible for maintaining accurate and current contact information and ensuring that its designated contacts are reasonably available to receive Service communications. Sophos will not be responsible for any delay or failure in communication resulting from inaccurate or outdated contact information or the unavailability of Customer/MSP’s designated contacts. A notice or communication from Sophos is effective when delivered through any of the foregoing channels.
8. Timely Response: Customer/MSP must acknowledge and respond to Sophos outreach and requests in a timely manner. For Priority Investigation, Customer/MSP agrees to use commercially reasonable efforts to acknowledge Sophos outreach within sixty (60) minutes, and Customer/MSP acknowledges that delays may increase risk and impact.
9. Actions Outside Scope of Service: All activities that are not expressly provided in this Service Description are outside of the scope of the Service. Customer/MSP is solely responsible and liable for: (i) taking any actions that are outside of the scope of the Service (e.g., Sophos’s suggestions regarding on-site response; all litigation and e-Discovery support; and collaboration with law enforcement); and (ii) for any actions undertaken by Sophos that are not provided in this Service Description under Customer’s/MSP’s specific direction. Customer/MSP acknowledge and agree Sophos is not responsible for any security incidents, threats or compromises that occurred or existed prior to Service subscription start date. In addition, Customer/MSP is responsible for neutralizing any Incidents and/or confirmed threats in Integrated Systems that cannot be resolved by Sophos.
10. Non Sophos Systems: Customer/MSP acknowledges and agrees that: (i) Sophos is not responsible for changes made to non Sophos systems by their vendors or any party that impact integrations or Sophos’s ability to provide the Service; and (ii) Sophos may add, remove, and modify supported integrations. Customer/MSP must ensure integrations function properly and notify Sophos if telemetry is not flowing or integrations are misconfigured.
11. Actions Taken by Partners: Customer may allow Partners to take certain actions within the scope of the Service on Customer’s behalf, in which case Customer is responsible for all actions or omissions of such Partner. Sophos will not be liable for Partners’ actions or omissions.
12. MSP Additional Responsibilities: MSP is solely responsible for: ensuring that any Beneficiary for which MSP performs this Service has agreed to accept all risks described in this Service Description or otherwise inherent in the Service. MSP will indemnify and hold Sophos harmless for any claim brought against Sophos by a Beneficiary if such claim results, in whole or in part, from MSP’s failure to fully perform its obligations under this Service Description or the Agreement with respect to the Service.
13. Security Testing and Penetration Testing: To the extent, Customer/MSP conducts vulnerability or penetration testing, or other security testing activities, Customer/MSP must comply with Sophos’s vulnerability testing and penetration testing policies, as made available by Sophos at MDR Penetration Testing Policy.

V. ADDITIONAL TERMS

1. Service Exclusions: Customer/MSP agrees and acknowledges that Sophos will not be liable or be considered in breach of this Service Description or the Agreement (including any applicable SLA): (i) due to any delay or failure to perform its obligations hereunder as a result of industry or infrastructure wide ransomware, cyberwarfare or other cyberattacks that causes Sophos to be unable to provide resources to address an Incident in a timely manner; (ii) due to unforeseen circumstances or to causes beyond Sophos reasonable control including but not limited to war, strike, riot, crime, acts of God, or shortage of resources; (iii) due to legal prohibition, including but not limited to, passing of a statute, decree, regulation, or order; (iv) during any period of Service suspension by Sophos in accordance with the terms of the Agreement; (v) if Customer/MSP is in breach of the Agreement (including without limitation if Customer has any overdue invoices); or (vi) during any scheduled maintenance windows.
2. Service Capabilities: Customer/MSP agrees and acknowledges while Sophos has implemented commercially reasonable technologies and process as part of the Service, and Sophos makes no guarantee that the Service will detect, prevent, contain, neutralize or mitigate all threats, and Incidents. Customer/MSP agrees not to represent to anyone that Sophos has provided such a guarantee or warranty.

 

Revision Date: 20 August 2026