Managed Infrastructure Assessment and Onboarding Schedule

The Buffalo Company

Version: 1.0
Document date: 12 November 2026
Related document: Managed Services Agreement
Provider: Obed Klein, trading as The Buffalo Company
Customer: As identified in the applicable Service Confirmation

---

1. Purpose and application

1.1. This Schedule governs the technical assessment, preparation, onboarding and commencement of ongoing Managed Infrastructure services provided by The Buffalo Company ("Provider").

1.2. It forms part of the Managed Services Agreement ("Agreement") and applies to every new ongoing Managed Infrastructure engagement.

1.3. Managed Infrastructure services are individually assessed and scoped. They are not unlimited fixed-price technical support services.

1.4. The purpose of the assessment and onboarding process is to establish whether the Customer's infrastructure can reasonably and safely be managed within an agreed technical and commercial scope.

1.5. This Schedule applies together with the applicable Service Confirmation and any separately commissioned backup, data protection or other service schedules.

2. Technical assessment requirement

2.1. A technical assessment is required before every new ongoing Managed Infrastructure engagement.

2.2. The Provider will assess the relevant infrastructure to the extent reasonably necessary to establish:

• The current technical environment.
• The proposed management scope.
• Existing security and operational risks.
• Required access and permissions.
• Backup and restoration arrangements.
• Monitoring requirements.
• Existing technical limitations and dependencies.
• Required onboarding or remediation work.

2.3. The assessment may involve reviewing available documentation, system configurations, software versions, infrastructure settings, access arrangements and relevant operational information.

2.4. The Customer must provide accurate information and reasonable access necessary to conduct the assessment.

2.5. The assessment does not constitute a full security audit, penetration test, source-code audit, compliance certification or forensic investigation unless expressly commissioned.

2.6. The Provider may recommend additional assessments or specialist investigations where the available information is insufficient to determine whether the infrastructure can be safely managed.

2.7. Additional assessments or investigations may be separately quoted.

3. Assessment areas

3.1. Depending on the infrastructure and proposed scope, the assessment may cover the following areas.

3.1.1. Infrastructure and hosting

• Hosting provider and infrastructure type.
• VPS, dedicated server, cloud or other hosting configuration.
• Server resources and capacity.
• Network configuration and relevant dependencies.
• Domain, DNS and registrar arrangements.
• Existing third-party services and integrations.

3.1.2. Operating systems and software

• Operating system and version.
• Installed services and relevant software.
• Application and runtime versions.
• Package and update status.
• Unsupported or end-of-life components.
• Relevant configuration and maintenance requirements.

3.1.3. Security

• Administrative access arrangements.
• User accounts and privilege levels.
• SSH or other remote access configuration.
• Authentication and MFA arrangements where supported.
• Existing security controls.
• Relevant exposed services and network access.
• Identified vulnerabilities or configuration concerns.

3.1.4. Backups and restoration

• Existing backup arrangements.
• Backup scope and frequency.
• Retention and storage arrangements.
• Availability of usable restoration points.
• Restoration procedures and dependencies.
• Suitability for integration with the Provider's backup services.

3.1.5. Monitoring and operations

• Availability monitoring requirements.
• Security and file-integrity monitoring requirements.
• Existing alerting arrangements.
• Log availability and retention.
• Maintenance and operational requirements.
• Relevant incident history where provided.

3.1.6. Technical debt and limitations

• Outdated software and infrastructure.
• Unsupported applications or components.
• Existing configuration issues.
• Known reliability or performance concerns.
• Dependencies on other providers.
• Risks that may prevent safe or reliable ongoing management.

4. Assessment outcome

4.1. Following the assessment, the Provider may:

a. Accept the infrastructure for ongoing management within a defined scope.

b. Accept the infrastructure subject to specified remediation or preparatory work.

c. Recommend a revised technical configuration or service scope.

d. Decline the engagement where the infrastructure cannot reasonably or safely be managed within an acceptable scope.

4.2. The Provider will communicate material findings and relevant recommendations to the Customer.

4.3. Where remediation is required before ongoing management can begin, the Provider will identify the relevant work and provide a separate quotation where appropriate.

4.4. The Customer is not required to commission recommended remediation unless it is a necessary condition for the Provider to undertake the proposed service safely.

4.5. The Provider is not obliged to accept responsibility for unsupported, insecure or technically unsuitable systems.

4.6. Acceptance of an infrastructure engagement does not constitute a guarantee that all existing defects, vulnerabilities or technical debt have been identified.

5. Assessment fees and preparatory work

5.1. The assessment fee, where applicable, is identified in the Service Confirmation or a separate quotation.

5.2. The assessment fee may reflect the number of systems, infrastructure complexity, required access, documentation quality and estimated assessment effort.

5.3. Standard activation is included where no meaningful setup or preparatory effort is required.

5.4. Customer-specific onboarding, remediation, migration, configuration changes or other substantial preparatory work may be separately quoted.

5.5. The Provider will obtain the Customer's approval before performing separately chargeable work.

5.6. Payment of an assessment fee does not automatically create an ongoing Managed Infrastructure engagement.

6. Scope definition and Service Confirmation

6.1. Before ongoing management begins, the Parties must agree the specific scope in a Service Confirmation.

6.2. The Service Confirmation should identify, as applicable:

• Systems and infrastructure covered.
• Operating systems and relevant applications.
• Administration and maintenance responsibilities.
• Security and hardening services.
• Monitoring services.
• Backup and restoration services.
• Update and patching responsibilities.
• Support arrangements.
• Exclusions and limitations.
• Third-party dependencies.
• Recurring fees and additional work rates.
• Any agreed Managed Infrastructure liability cap.

6.3. The scope must distinguish between services included in the recurring fee and work requiring separate approval or quotation.

6.4. The Provider is responsible only for the systems and activities expressly included in the agreed scope.

6.5. Services not listed in the Service Confirmation are not automatically included merely because the Provider has technical access to the relevant environment.

7. Onboarding

7.1. After the assessment and acceptance of the proposed scope, the Provider will perform the agreed onboarding work.

7.2. Onboarding may include:

• Establishing the agreed administrative access.
• Creating or configuring dedicated Provider accounts where practical.
• Configuring SSH or other authorised access.
• Reviewing or adjusting relevant security settings.
• Configuring agreed monitoring.
• Configuring backup services where commissioned.
• Establishing initial operational documentation.
• Recording relevant system and service information.
• Confirming communication and escalation contacts.

7.3. Onboarding may also include agreed remediation, configuration or migration work where separately commissioned.

7.4. The Provider will not make material changes outside the agreed onboarding scope without the Customer's approval, except where immediate action is reasonably necessary to address a serious security or operational risk and such action is permitted by the Agreement.

7.5. The Customer must provide the access, information and cooperation reasonably required to complete onboarding.

7.6. Delays caused by unavailable access, incomplete information, Customer instructions or third-party dependencies may delay activation.

8. Administrative access and account ownership

8.1. Customer-owned hosting, registrar, DNS, cloud and other third-party accounts remain owned and controlled by the Customer.

8.2. The Provider receives only the access reasonably necessary to perform the agreed services.

8.3. Where practical, the Provider will use a dedicated account or user rather than shared primary administrative credentials.

8.4. On Linux systems, the Provider may use a dedicated non-root user with sudo privileges where technically feasible and appropriate.

8.5. Provider-created monitoring accounts, proprietary platforms, scripts, scanners and other Provider tools remain the Provider's property.

8.6. The Customer must not disclose unnecessary credentials or provide access to unrelated systems.

8.7. The Customer must notify the Provider of changes to access credentials, permissions or account arrangements that may affect the services.

8.8. The Provider will revoke or remove its access credentials when they are no longer required, including following termination.

9. Security and operational responsibilities

9.1. The Provider will perform the agreed infrastructure management and security work with reasonable care and within the agreed scope.

9.2. The Customer remains responsible for:

• The accuracy of information supplied.
• Ownership and administration of Customer-owned accounts.
• Authorising changes requiring Customer approval.
• Licences and rights relating to Customer software and content.
• Systems and services outside the agreed scope.
• Informing the Provider of relevant external changes.
• Cooperating with reasonable security and maintenance recommendations.

9.3. The Provider may recommend security improvements, upgrades, replacement of unsupported components or other corrective measures.

9.4. Recommendations do not automatically include implementation work. Implementation may require separate approval and fees unless already included in the Service Confirmation.

9.5. The Provider does not guarantee that all vulnerabilities, defects or security risks will be identified or prevented.

9.6. The Provider does not guarantee uninterrupted operation of the infrastructure or third-party services.

10. Updates, maintenance and changes

10.1. Updates and maintenance are performed only to the extent included in the agreed service scope.

10.2. The Service Confirmation should identify whether the Provider is responsible for:

• Operating system updates.
• Security patches.
• Application updates.
• Dependency updates.
• Configuration maintenance.
• Other recurring maintenance activities.

10.3. The Provider may defer an update where applying it would create an unreasonable risk of incompatibility, service disruption or data loss.

10.4. The Provider will inform the Customer of material risks identified in connection with deferred or unavailable updates.

10.5. Major version upgrades, application migrations, substantial architecture changes and other significant work are separately scoped and quoted unless expressly included.

10.6. Planned maintenance likely to cause material disruption will be communicated in advance where reasonably possible.

10.7. Emergency maintenance may be performed without advance notice where reasonably necessary to protect or restore the environment. The Customer will be informed as soon as reasonably practicable.

11. External providers and changes

11.1. The Customer remains free to appoint other developers, administrators, hosting providers or technical specialists.

11.2. Where reasonably possible, the Customer must notify the Provider in advance of planned changes likely to affect the managed infrastructure.

11.3. The Customer must promptly notify the Provider of emergency or unplanned changes.

11.4. The Customer should also notify the Provider when another developer, provider or specialist receives administrative access or performs relevant work on the managed environment.

11.5. The Provider may assess the effects of external work on the security, stability and agreed scope of the infrastructure.

11.6. Additional investigation, documentation or corrective work resulting from external changes may be separately quoted and requires the Customer's prior approval.

11.7. The Provider is not automatically responsible for consequences arising from undocumented changes or work performed by the Customer or other providers.

12. Monitoring and incident communication

12.1. Monitoring is provided only to the extent included in the Service Confirmation.

12.2. Monitoring may include availability checks, security monitoring, file-integrity monitoring and other agreed operational checks.

12.3. The Provider reviews alerts within the scope and allowances of the applicable services.

12.4. Monitoring does not constitute continuous human supervision or guaranteed immediate response unless expressly agreed.

12.5. Significant incidents will be communicated in accordance with the Managed Services Agreement and applicable service scope.

12.6. Incident response, forensic investigation, malware removal, extensive remediation and disaster recovery are not automatically included in ongoing infrastructure management. Such work requires express inclusion or separate approval and quotation.

13. Backups and restoration

13.1. Backups are included only where expressly stated in the Service Confirmation.

13.2. Where backup services are commissioned, the Backup and Restoration Schedule applies.

13.3. The Service Confirmation identifies the covered systems, backup frequency, retention, capacity, storage configuration and applicable fees.

13.4. The Provider will not assume responsibility for backup arrangements that have not been expressly commissioned.

13.5. Where backups are included, the Provider will perform the agreed backup and restoration obligations within the applicable technical and commercial scope.

13.6. The absence of a commissioned backup service does not relieve the Customer of responsibility for maintaining appropriate backups where necessary for its business or legal obligations.

14. Acceptance for ongoing management

14.1. Onboarding is considered complete when the agreed onboarding tasks have been completed to a reasonable standard and the Provider confirms that the infrastructure is accepted for ongoing management.

14.2. The Provider will communicate the activation date to the Customer.

14.3. The recurring Managed Infrastructure fee begins only after:

a. The technical assessment has been completed.

b. The scope and fees have been agreed.

c. Required onboarding has been completed.

d. The Provider has accepted the engagement for ongoing management.

14.4. If material technical issues prevent safe ongoing management, the Provider may postpone acceptance and identify the remaining requirements.

14.5. Any additional work needed to address such issues must be agreed separately unless already included in the onboarding scope.

14.6. Acceptance for ongoing management does not constitute a warranty that the infrastructure is free from defects, vulnerabilities or pre-existing problems.

15. Ongoing service and review

15.1. Following acceptance, the Provider performs the agreed Managed Infrastructure services in accordance with the Managed Services Agreement and Service Confirmation.

15.2. The Provider may periodically review the managed environment and identify relevant changes, risks or recommendations within the agreed scope.

15.3. Material changes to infrastructure, service scope, responsibilities or recurring fees require agreement between the Parties.

15.4. The Provider may recommend a revised scope where changes to the environment make the existing arrangement technically unsuitable or commercially unreasonable.

15.5. The Customer remains responsible for approving changes that materially affect its systems, costs or business operations.

16. Documentation and ownership

16.1. The Provider may maintain technical documentation necessary to perform the services.

16.2. Customer-specific infrastructure configurations and documentation created for the Customer will be made available to the Customer, subject to third-party rights and applicable licences.

16.3. The Provider retains ownership of its pre-existing software, scripts, automation, templates, methods, tools and reusable know-how.

16.4. The Customer may use Customer-specific documentation and configurations for its own environment, subject to applicable third-party rights.

16.5. Ownership or licensing of custom development must be expressly agreed in the Service Confirmation or a separate written agreement.

16.6. On termination, documentation and handover are governed by the offboarding provisions of the Managed Services Agreement.

17. Fees and liability

17.1. Assessment, onboarding, remediation and recurring Managed Infrastructure fees are identified in the Service Confirmation.

17.2. Additional work outside the agreed scope requires a separate quotation or prior approval.

17.3. The liability provisions of the Managed Services Agreement apply.

17.4. Any specific Managed Infrastructure liability cap must be expressly stated in the Service Confirmation.

17.5. The cap must be assessed individually in view of the technical scope, infrastructure criticality, data and backup responsibilities, foreseeable risks and agreed fees.

17.6. No liability limitation applies where its application is prohibited by mandatory law.

18. Suspension and termination

18.1. Managed Infrastructure services may be suspended or terminated in accordance with the Managed Services Agreement.

18.2. The Customer must cooperate with reasonable offboarding requirements and provide any necessary instructions for the transfer of its environment.

18.3. On termination, the Provider will remove or revoke its access credentials when no longer required.

18.4. Provider-owned monitoring agents, scripts and proprietary tools may be removed in accordance with the Agreement.

18.5. The Provider will not intentionally delete Customer-owned data or configurations or damage unrelated systems during ordinary offboarding.

18.6. Complex deinstallation, migration, reconstruction or transition work may be separately scoped and quoted.

19. Final provisions

19.1. This Schedule forms part of the Managed Services Agreement.

19.2. Terms not specifically defined in this Schedule have the meaning assigned to them in the Managed Services Agreement.

19.3. In the event of a conflict, the precedence provisions of the Managed Services Agreement apply.

19.4. Amendments to this Schedule must be agreed in writing. Email is sufficient unless mandatory law requires a stricter form.

---

End of Managed Infrastructure Assessment and Onboarding Schedule