NIMBRIS Microsoft 365 Assessment Service Agreement

SERVICE AGREEMENT

This Microsoft 365 Assessment Service Agreement (“Agreement”) is entered into between NIMBRIS (“Consultant”) and the customer identified below (“Client”). This Agreement governs the Microsoft 365 assessment services purchased by the Client from NIMBRIS.

The Client acknowledges that NIMBRIS provides scheduled Microsoft 365 consulting and assessment services and is not providing continuous monitoring, emergency support, incident response, or 24/7 managed IT services under this Agreement.

1. SCOPE OF SERVICES

NIMBRIS will perform a read-only review of the Client’s Microsoft 365 environment based on the assessment package purchased by the Client.

Essential — $299 — Up to 10 users
Core Microsoft 365 health review, key security and access checks, licensing review, and prioritized findings.

Professional — $499 — Up to 25 users
Full 58-control assessment across eight review areas, prioritized findings and action plan, and executive summary report.

Complete — $799 — Up to 25 users
Full 58-control assessment across eight review areas, detailed action plan, executive summary report, and a 60-minute findings review.

Organizations with more than 25 users require a custom scope and quote.

The assessment may review applicable configuration and information relating to identity and authentication, administrative access, Exchange Online, Intune and managed devices, SharePoint and OneDrive, Microsoft licensing, domains and DNS, and operational practices and documentation.

NIMBRIS will not make configuration changes to the Client’s environment as part of the assessment. Any remediation, implementation, configuration changes, migrations, or other consulting services identified during the assessment require separate authorization and may be subject to additional fees.

2. CLIENT AUTHORIZATION & ACCESS

The Client represents that the person signing this Agreement is authorized to approve the assessment of the Client’s Microsoft 365 environment and to authorize NIMBRIS to access information necessary to perform the assessment.

The Client agrees to provide the temporary permissions and access reasonably required to perform the purchased assessment. NIMBRIS will request only the access necessary for the applicable assessment activities and will use that access solely to perform authorized services for the Client.

NIMBRIS will not request the Client’s passwords or MFA verification codes. The Client should not send passwords, MFA codes, recovery codes, or other authentication secrets to NIMBRIS.

Unless separately authorized in writing, NIMBRIS will use the provided access for assessment and review purposes only and will not intentionally modify the Client’s Microsoft 365 configuration.

The Client is responsible for removing or disabling temporary NIMBRIS access after completion of the engagement. NIMBRIS will also notify the Client when assessment access is no longer required.

3. ASSESSMENT LIMITATIONS

The NIMBRIS Microsoft 365 Assessment is a point-in-time review of the configuration and information reasonably accessible to NIMBRIS during the assessment. Findings and recommendations are based on the environment as it exists and is accessible at the time of review.

The assessment is not a penetration test, vulnerability scan, threat-hunting service, formal security audit, continuous monitoring service, Security Operations Center (SOC) service, incident-response service, or legal or regulatory compliance certification.

NIMBRIS does not represent or warrant that the assessment will identify every security weakness, configuration issue, operational risk, licensing inefficiency, or other condition that may exist within the Client’s environment.

Recommendations are provided to assist the Client in evaluating its Microsoft 365 environment. The Client remains responsible for deciding whether and how to implement recommendations and for maintaining the ongoing security, administration, backup, and operation of its systems.

4. DELIVERABLES & REMEDIATION

NIMBRIS will provide the deliverables included with the assessment package purchased by the Client. Deliverables may include assessment findings, prioritized recommendations, an action plan, an executive summary, and, where included in the purchased package, a findings review meeting.

Assessment findings may be categorized by priority or severity to help the Client understand which items warrant attention. Such classifications are intended as practical guidance and do not constitute a guarantee regarding the likelihood or impact of any particular event.

Remediation is not included in the assessment fee unless expressly stated otherwise in writing. Configuration changes, implementation work, migrations, tenant cleanup, security improvements, licensing changes, or other corrective services require separate authorization from the Client.

If the Client requests remediation, NIMBRIS may provide a separate proposal describing the applicable scope, pricing, and terms. The Client is under no obligation to purchase remediation services from NIMBRIS.

5. FEES, PAYMENT & CANCELLATION

The Client agrees to pay the fee associated with the selected assessment package. Assessment fees are due in full before NIMBRIS begins the engagement unless otherwise agreed in writing.

The Client may cancel the assessment and request a full refund before NIMBRIS begins assessment work.

Once NIMBRIS has begun assessment work, including review or analysis of the Client’s Microsoft 365 environment, the assessment fee becomes non-refundable.

If NIMBRIS is unable to perform the assessment because the Client does not provide required information or access, NIMBRIS may pause the engagement and request that the Client provide the outstanding requirements before work continues.

Any remediation, implementation, or additional consulting services are outside the assessment fee and will be separately quoted and authorized.

6. CLIENT RESPONSIBILITIES
The Client agrees to provide accurate information reasonably necessary for NIMBRIS to perform the assessment and to cooperate with reasonable requests related to access, configuration details, and clarification of the Client’s Microsoft 365 environment.

The Client is responsible for ensuring that it has the authority to grant NIMBRIS access to the Microsoft 365 tenant, domains, systems, and information included within the assessment.

The Client is responsible for maintaining appropriate backups, business continuity procedures, administrative controls, and security protections during and after the engagement.

NIMBRIS is not responsible for delays caused by incomplete or inaccurate information, unavailable systems, insufficient permissions, third-party service interruptions, or the Client’s failure to provide required access.

7. CONFIDENTIALITY & DATA HANDLING
NIMBRIS will use information obtained from the Client solely for providing the authorized services and related administrative purposes.

NIMBRIS will use reasonable measures to protect confidential information received or accessed during the engagement and will not knowingly disclose the Client’s confidential information to third parties except as reasonably necessary to provide the services, as authorized by the Client, or as required by law.

The Client should not provide NIMBRIS with passwords, MFA verification codes, recovery codes, or other authentication secrets.

Assessment reports and findings may contain sensitive information about the Client’s Microsoft 365 environment. The Client is responsible for controlling access to reports and other deliverables after delivery.

8. THIRD-PARTY & MICROSOFT SERVICES
The assessment may rely upon information and functionality provided by Microsoft 365, Microsoft Graph, Exchange Online, SharePoint Online, Intune, DNS providers, and other third-party services used by the Client.

NIMBRIS does not control and is not responsible for the availability, performance, security, functionality, licensing terms, or changes made by Microsoft or other third-party providers.

References to Microsoft products or services do not imply endorsement, certification, sponsorship, or affiliation with Microsoft.

9. ACCEPTANCE & GENERAL TERMS

By signing below, the Client confirms that the signer is authorized to enter into this Agreement on behalf of the Client and authorizes NIMBRIS to perform the purchased Microsoft 365 assessment under these terms.

NIMBRIS provides these services as an independent consultant. This Agreement does not create an employment, partnership, joint venture, or agency relationship.

This Agreement is governed by the laws of the State of New Jersey. It, together with any applicable written proposal or order, constitutes the agreement between NIMBRIS and the Client concerning the purchased assessment. Changes to the assessment scope or this Agreement must be agreed to in writing.