# Paid Exposure Assessment Pilot Readiness and Statement of Work Template Version: July 19, 2026 **Nonbinding template. This document has no legal effect unless completed, approved, and included in an agreement executed by authorized representatives of both parties.** **Provider:** PWLogiConGroup LLC, operator of the ApertureRisks platform ## 1. Parties and effective date - Client legal name: ________________________________________________ - Effective date: ________________________________________________ - Controlling agreement or order-form reference: ________________________________________________ ## 2. Engagement scope Agreed supply-chain exposure question: ________________________________________________________________________________ In-scope business unit, geography, product, supplier population, and time horizon: ________________________________________________________________________________ Base scope is one agreed supply-chain exposure question and up to 100 accepted supplier and operating records. Provider will perform an evidence-backed assessment connecting available disruption evidence to accepted Client records. This is a fixed-scope, time-bound assessment, not an open-ended consulting engagement. Provider does not guarantee that every record, supplier, tier, signal, or dependency can be mapped. ## 3. Delivery specification Target delivery is five U.S. business days after Provider accepts the scoped question, approved intake path, usable records, and accountable Client contact. The delivery clock pauses for missing or unusable data, unresolved clarification, approval delays, security or access issues, scope changes, or material revised inputs. Provider will document start, pause, restart, and target-delivery dates. Illustrative delivery sequence: 1. Day 1: intake validation and baseline preparation. 2. Day 2: signal and dependency analysis. 3. Day 3: evidence classification, gap analysis, and Exposure Score basis. 4. Day 4: Decision Brief and Action Register preparation. 5. Day 5: review, formatting, and delivery. Activities may overlap. This sequence is illustrative and is not a guaranteed daily schedule. ## 4. Client responsibilities and data requirements - Accountable Client contact: ________________________________________________ - Approved intake path: ________________________________________________ - Expected records and due date: ________________________________________________ - Data-handling restrictions: ________________________________________________ - Client review and clarification contact: ________________________________________________ - Client confirms authority to provide the data: Yes / No, with exceptions described below Minimum expected fields may include an internal supplier or vendor identifier; supplier name; country and available location; relevant PO, BOM, component, product, contract, facility, lane, or commitment identifier; and available relationship fields needed for the agreed question. DUNS and UEI are optional matching fields, not universal minimum requirements. Provider will identify an approved, engagement-specific intake path before operational data is exchanged. ## 5. Deliverables 1. Evidence-backed Exposure Baseline across accepted records, including unresolved and unassessed items. 2. Evidence Gap Register. 3. Owner-Based Action Register. 4. Executive Decision Brief with signal, exposure chain, Exposure Score basis, evidence classifications, business impact, and recommended next action. 5. Select one: readout / asynchronous handoff. The assessment does not promise complete risk quantification, complete tier-N visibility, complete supplier mapping, guaranteed identification of hidden risks, or legal, regulatory, or compliance determinations. Recommendations remain subject to named Client review. ## 6. Pilot measurement The measurement basis, starting value, ending value, owner, and approval status may be recorded for: 1. Signal-to-assigned-action time. 2. Previously unmapped exposure identified where supported by accepted evidence. 3. Evidence gaps closed through Client, supplier, or Provider action. 4. Governed Decision Briefs reviewed by named owners. 5. Like-for-like response-time comparison where a defensible baseline exists. No metric, reduction, improvement, or result is represented as achieved until measured, documented, and approved. No publication is permitted without separate written approval. ## 7. Commercial terms Base fixed fee: $1,500 USD one time. Payment is due before assessment intake unless the executed order form states a different payment schedule. Taxes and additions approved in a written scope are extra. Written change control is required for additional questions, increased record volume, integrations, revised data after intake, recurring monitoring, bespoke analysis, enterprise controls, or custom reporting. ## 8. Acceptance - Client review period: ______ business days. - Written acceptance method: ________________________________________________ - Correction process: ________________________________________________ No deemed acceptance term applies through silence, operational use, or expiration of a review period unless expressly negotiated in an executed agreement. New data, new questions, preference changes, expanded analysis, and third-party changes require change control. ## 9. Retention, export, and deletion - Permitted data and purpose: ________________________________________________ - Retention period: ________________________________________________ - Export format: ________________________________________________ - Deletion deadline: ________________________________________________ - Confirmation method: ________________________________________________ - Legal retention exceptions: ________________________________________________ - Backup or archival limitations: ________________________________________________ - Provider-retention limitations: ________________________________________________ - Subprocessors or providers, if separately prepared and executed: ________________________________________________ - DPA or security exhibit, if separately prepared and executed: ________________________________________________ Upon written request and subject to the executed agreement, legal obligations, provider retention, and backup limitations, Provider will export agreed Client data and delete it from active systems within the agreed period. No immediate or universal deletion, deletion from every backup on demand, cryptographic deletion from all systems, or guaranteed Certificate of Deletion is represented. ## 10. Support and escalation Current support window: U.S. business days, 9:00 a.m.-5:00 p.m. Eastern Time. Contact: ian@pwlogicongroup.com. No contractual SLA, guaranteed response time, 24x7 coverage, alternate operator, or continuity commitment is included unless expressly added to the executed agreement. ## 11. Signatures ### Client authorized representative - Name: ________________________________________________ - Title: ________________________________________________ - Signature: ________________________________________________ - Date: ________________________________________________ ### PWLogiConGroup LLC authorized representative - Name: ________________________________________________ - Title: ________________________________________________ - Signature: ________________________________________________ - Date: ________________________________________________ Counsel should review final contract terms. Nonbinding template only.