1. Introduction

   The Managed Network - Internet service provides an internet connection together with security services.

2. Features

   The Managed Network - Internet service includes the following features:

   • Internet Connection An N4L internet connection of a specified bandwidth (see clause 1.2 Internet Connection).
   • Internet Safety & Security Services comprising a suite of protection capabilities including Web Filtering, Firewall, and DNS Threat Protection over your N4L-provided Internet Connection (see clause 1.2.4 Internet Safety & Security Services).
   • Cybersecurity Services: Proactive monitoring, reporting, support and guidance material across cybersecurity incidents, vulnerabilities and exposed services.
   • Customer Support Services: Centralised help with internet troubleshooting, service requests and fault resolution. With the exception of the Christmas holiday period the N4L Customer Support Team is available 8am-5pm Monday to Friday, excluding national public holidays.

   If you receive an Internet Connection from N4L, some of the services within Cybersecurity Services are required to help us to protect schools from Prohibited Use, as defined in our Acceptable Use Policy. Internet Safety & Security Services and the full Cybersecurity Service is not required, though for a higher level of cybersafety and cybersecurity protection, we strongly recommend that all Managed Network - Internet features and Recommended Settings are enabled.

3. Service Eligibility and Funding

   1. Eligibility

      All New Zealand state and state-integrated schools are eligible for the Managed Network - Internet service. Independent Schools and Charter Schools may also connect to the service, however charges will apply as described below.

   2. Funding and Charges

      With the exceptions below, the Managed Network - Internet service is fully funded by the Ministry of Education for:

      • State Schools
      • State Integrated Schools
      • Partnership Schools
      • Health Schools
      • The Correspondence School
      • Activity Centres.

      The funded service includes a reasonable volume of Moves, Adds and Change (MAC) requests (refer clause 4 of Service Description - Self Service). N4L will monitor the volume of MAC requests being made by Schools and will work with Schools to ensure that the efficiency of the MAC request process is optimised.

      The only exceptions to full funding for state and state-integrated Schools are where:

      • a School continues to require an unreasonable number of MACs after being fairly advised by N4L that its use is unreasonable; or
      • there is a physical change at a School site that was not required by the Ministry.

      In each case N4L will notify the Schools in advance and will invoice the School for N4L’s time and costs resulting from the additional MACs or physical change (as applicable).

      MAC fees for chargeable MACs will be detailed in a quote. Invoices are payable in arrears in accordance with 4.5 of our School General Terms.

      Service feature	Charge
      Firewall installation and service provisioning*	Ministry funded for state and state-integrated schools. Charges apply for Independent and Charter schools.
      Ongoing service fee - internet connection + managed firewall	Ministry funded for state and state-integrated schools. Charges apply for Independent and Charter schools.
      Remote MAC Can be completed remotely	Advised by quote, where charges apply (ref 1.1.3 (b) above)
      Onsite MAC	POA - generally requires detailed investigation or design work to implement.
      Optional: Additional internet connection for high availability or redundancy	POA - subject to design and connection type
      Optional: Additional firewall(s) for high availability or redundancy	POA - subject to design and hardware model

      * Infrastructure build costs to lay fibre and install LFC equipment for new property builds are not included. These should be requested and funded by the relevant capital build project budget.

      ** Refer to commentary above table regarding when these charges apply.

4. Recommended Settings

   RECOMMENDED SETTINGS FOR INTERNET SAFETY & SECURITY SERVICES

   N4L strongly recommends that Schools use the Internet Safety & Security Services and adopt our Recommended Settings, in conjunction with endpoint protection, N4L other safety and security solutions, and good security practices, to help increase protection for users from objectionable content and online threats.

   If we identify you have removed or opted-out of the Recommended Settings, we will endeavour to either work with you to correct this or record your decision to opt-out (in which case, your school will then be solely responsible for managing the safety and security of your Internet Connection and for ensuring that your School and Your Users comply with N4L’s Acceptable Use Policy).

   You will automatically be deemed to have opted-out of our Recommended Settings if you remove any of the following components of the Internet Safety & Security Services: Web Filtering, Firewall or DNS Threat Protection.

   For more information, see section 6 - Additional Information - Recommended Settings

1. Standard Components

   The standard components of the “Internet Connection” are:

   • Uncapped access to national and international internet. Use of the internet is subject to N4L’s Acceptable Use Policy.
   • Bandwidth as specified in clauses 1.2.2 (Standard Internet Connection Allocation), or 1.2.3 (Upgrades to the Service).
   • DDoS Protection to deflect denial of service attacks towards the school, which would impact internet services.
   • Managed Firewall that does not constrain reasonable use. We will monitor your Internet Connection and upgrade you to a larger Managed Firewall when required.
   • IP Address Management providing a range of fixed IP addresses to you.
   • DNS Resolution providing a URL to IP address resolution service.
   • Device and Access Management providing proactive (threshold monitoring, troubleshooting errors) and reactive (device/interface down scenarios) management of the Managed Firewall to ensure continued operations and availability of services.
   • Bandwidth Management providing differing individual types of traffic or individual weights using a traffic scheduler and policies.

2. Standard Internet Connection Allocation

   We utilise a range of connectivity and bandwidth options depending on the wholesale access services available at your location. This includes digital microwave radio, satellite, rural broadband and fibre (including hyperfibre).

   Where possible, we allocate a 1Gbps standard Internet Connection to you regardless of your size, provided:

   • you are connected to a UFB Wholesale Access Service, or RBI Wholesale Access Service that supports 1G connections; and
   • we can reasonably make the connection available (which is determined at our discretion).

3. Upgrades to the Service

   At its discretion, N4L may upgrade the bandwidth of a School’s Internet Connection. For Schools, such upgrades may be implemented if considered appropriate based on the following considerations:

   • a School’s bandwidth usage regularly approaches the maximum standard Internet Connection allocation;
   • the upgrade is needed to maintain fit for purpose connectivity for online teaching and learning
   • the upgrade enables efficient service delivery - for example avoiding the need for a revisit if a School’s roll is likely to expand in the short term.

4. Internet Safety & Security Services

   The standard components of Internet Safety & Security Services are as follows:

   • Web Filtering provides a level of control over access to websites, by filtering URLs that may lead to harmful or malicious websites.
   • Firewall using our Recommended Blocked Firewall Rules monitors and controls all traffic in and out of the school network, and, depending on the design of your school network, all internal traffic on the network, to promote only legitimate access and use of your network.
   • DNS Threat Protection provides filtered DNS resolution to protect against access to online security threats via the Internet Connection, including but not limited to malware sites and botnet command and control servers.
   • DDoS Protection delivered as part of your internet connection, which deflects denial of service attacks towards the school, which would impact internet services.
   • SafeSearch delivered as part of our DNS Threat Protection service, enforces SafeSearch mode for Google and Bing, which blocks explicit images being returned in search results.

5. Internet Safety & Security Services - Recommended Settings

   Internet Safety & Security Services with our Recommended Settings provide a baseline level of protection against identifiable internet threats and websites known to contain objectionable content. Our Recommended Settings for Internet Safety & Security Services are as follows:

   • Web Filtering - Recommended Blocked Categories by default we block access to categories of websites, such as websites known for child abuse, pornography, self harm, and sites containing malicious software that could compromise the security of your network or end users.
   • Firewall - Recommended Blocked Firewall Rules by default we block all inbound connections and will monitor and flag any firewall rules that are likely to put school users or systems at unnecessary risk.
   • DNS Threat Protection - making use of N4L’s secure DNS servers which provide filtered DNS resolution to help prevent access to online security threats via the internet connection, including but not limited to malware sites and botnet command and control servers.
   • SafeSearch - enabled through our DNS Threat Protection service, enforces SafeSearch mode for Google and Bing, which blocks explicit images being returned in search results.

   See our webpage Internet Safety & Security Services Recommended Settings for full details.

   N4L strongly recommends that Schools use the Internet Safety & Security Services with our Recommended Settings - refer to clause 1.1.4 above.

   Removing or not making full use of all the components of Internet Safety & Security Services, including our Recommended Settings, are likely to significantly increase the risk of exposing your school network and users to objectionable content and online threats.

   In any case, Schools must be aware that, while Internet Safety & Security Services with our Recommended Settings provides a baseline level of protection, due to the inherent nature of the internet, N4L cannot guarantee that Internet Safety & Security Services with our Recommended Settings provides complete protection against all internet threats and objectionable content. It remains the responsibility of Schools to determine their individual preferences for Web Filtering and Firewall settings, and to act responsibly on behalf of their users, when making any changes to settings. You must notify N4L immediately if you become aware of any actual or potential breach of security or unauthorised access or use of any part of our Services.

   See clause 1.5 for further information relating to Internet Safety & Security Services Product Options

6. Service Boundary

   The boundary of the Managed Network - Internet service ends at the Managed Firewall on your premises. That is to say, the service does not extend into your LAN infrastructure, end user devices, or other ICT infrastructure. However, if you have completed Equipment Replacement, your LAN infrastructure will be covered by our Managed Wi-Fi Service

7. Prerequisites

   The prerequisites for us to accept your order for the Managed Network - Internet service are:

   • the availability of a Wholesale Access Service which is acceptable to us, to connect you to the service; and
   • a suitable location for housing our Equipment (Managed Firewall) at your premises which meets the following criteria:
   • the server room must have adequate air circulation to maintain temperature and humidity levels
   • the server room and/or rack housing Equipment must have restricted access
   • there must be suitable clearance around the rack to enable maintenance
   • the Managed Firewall must utilise a permanent ground connection, installed in a secure location.
   • your acceptance of the Terms of Service

8. Ordering

   This Service may be ordered as follows:

   • New Internet Connection – via an N4L Order Form.
   • Moves, Adds or Changes – via:
   • manual order form (where available); or
   • call or email the N4L Customer Support Team.

9. Term

   The term of Your Managed Network - Internet service:

   • commences on completion of its provisioning; and
   • continues until terminated by us or your, on at least one month’s written notice to the other.

   If you terminate the service as above, N4L may invoice additional Charges to the extent they are payable by N4L to its suppliers in relation to that termination. N4L will advise you of those charges when you notify us you wish to terminate.

   Upon termination of this service:

   • On our request, you will return our Equipment. We will arrange a suitable method to do this e.g arrange courier collection. The Equipment must be returned in excellent condition. N4L reserves the right to charge for loss or damage of Equipment.
   • If required by either party, both parties will work together in good faith to jointly develop and agree a plan to effect your disengagement from this service with minimum disruption to either party.
   • We will give you all reasonable assistance, at reasonable rates, if you wish to transition to another service provider.

10. Service Level Targets

    N4L will use reasonable endeavours to meet the following service level targets for the Managed Network - Internet service. However, we will not be considered to have failed a target, to the extent the failure is due to:

    • you not notifying us of the failure;
    • any maintenance on or in relation to the service carried out within a planned maintenance window;
    • any Wholesale Access Service outage;
    • any breach by you of your agreement with N4L; or
    • an Excusable Event for the purposes of clause 7.5 (Causes beyond our control) of our School General Terms or any other event or circumstances outside the reasonable control of N4L or its subcontractors (including a failure of or within your LAN infrastructure, end user devices or other ICT infrastructure).

    Availability	Description
    Definition	The proportion of time the Internet Connection is: functioning; and available to the School, meeting the latency service level target below.
    Target	Over a rolling 12 months: UFB and RBI >99.863% Metro >99.817% Non-Metro Others: Best endeavours Remote Access >99.7%
    Measurement	Manually measured by historical unplanned downtime in relation to P1 and P2 Incidents recorded in the network provider’s systems. Downtime caused outside of the Network Boundary is excluded.
    Calculation	Calculated by: Percentage Uptime = Uptime / (Uptime + Downtime) x 100 Where: Uptime is the total time in the period in which the service is operating as defined above. Downtime is the total time in the period that is not Uptime. The calculation is expressed as a percentage.
    Data Source	Network monitoring system

    Latency	Description
    Definition	The time taken between an IP packet being transmitted and received at an N4L defined endpoint.
    Target	Best Effort Average over a month: UFB and RBI 200 byte packets: <215ms 1472 byte packets: <215ms Others: Best endeavours
    Measurement	Samples from a loopback address from the Managed Firewall at one site to the loopback address from the Managed Firewall, at another site nominated by N4L.
    Calculation	Measured as an average on a monthly basis
    Data Source	Network monitoring system

11. Local Fibre Company Terms

    Some Managed Network - Internet services are delivered over the Government’s ultra-fast broadband (UFB) initiative. The UFB network is provided by Local Fibre Companies (LFCs). A list of LFCs may be found at https://nationalinfrastructure.govt.nz/fibre/.

    Each LFC has LFC “End User Terms” relating to the supply, installation, ownership and use of the line (and any associated equipment and infrastructure) (the LFC End User Terms). You agree to comply with the LFC End User Terms of any LFC connected to your premises. LFC End User Terms are generally available on the website of your LFC. If that is not the case, then you should ask your LFC to provide you with a copy or a link to its End User Terms.

12. Safeguarding the Managed Network - Internet

    So that our Services to you and other Customers are not disrupted, it is important that you help safeguard the service. It is your responsibility to take all reasonable:

    • security precautions to protect the service including our Equipment at your premises;
    • ensure you do not introduce any faults, viruses or other Disabling Code (and the like) into the service; and
    • prevent interference with, or damage to, the service and our Equipment at your premises.

13. IP Addresses

    Depending on the Services you acquire from us, we will arrange for appropriate IP addresses to be allocated to you. Unless we have agreed otherwise with anybody else, all IP addresses allocated to you remain our property. You must not transfer or sell those IP addresses to anyone else. We may change any IP address that we allocated to you. We will always give you as much notice as we reasonably can before making these changes.

14. Terms relating to the Equipment

    Your responsibilities

    We remain the owner or licensee of our Equipment. Where our Equipment is at your premises, the Equipment will be at your risk and you will (and, where applicable, you will ensure that Your Users will):

    • only use our Equipment for your own lawful business use and for the purposes for which we provide it;
    • not change or interfere with our Equipment in any way, unless authorised by us and in accordance with our instructions;
    • comply with our reasonable directions and restrictions regarding use of our Equipment;
    • comply with any manufacturer’s terms of use for our Equipment;
    • make sure nothing or no-one on property or premises under your control interferes with or damages any of our Equipment;
    • if requested by us, insure our Equipment against loss or damage by fire, theft or otherwise, with a reputable insurer for its full replacement cost;
    • let us know immediately if any of our Equipment is lost, stolen or damaged;
    • not sell, dispose of, grant any security interest in or otherwise part with possession of, any of our Equipment; and
    • pay our charges for repairing or replacing any of our Equipment which is lost or damaged (however caused) while at your premises, but there is no charge where damage occurs through normal wear and tear.

    Our responsibilities

    Where we provide Equipment (or any other goods) to you, we give you, except to the extent our Equipment is affected by any failure to meet your responsibilities in clause 2.17 above, our Equipment will:

    • be safe, durable, substantially free from defects and in good working order;
    • be fit for the purposes which we describe in writing and for which we are providing it to you;
    • be as we describe in writing or demonstrate to you and will do everything we say in writing it will do; and
    • be approved for connection to the Managed Network - Internet service at the time we provide it to you.

    If our Equipment does not comply with the requirements set out in clause 2.17 above, we will replace or repair the Equipment (at our cost) as soon as reasonably practicable and such replacement or repair will be your sole and exclusive remedy in respect of any failure of the Equipment to comply with such requirements.

    We will also:

    • ensure that we have the right to provide our Equipment to you and it will be free from any undisclosed security; and
    • not interfere with your possession of our Equipment except where both of us agree otherwise.

    Risk of loss of Equipment

    Each party will be responsible for the risk of loss of, and damage to, any Equipment (as the case may be), software, systems and other materials used in the provision of the Services under this Agreement, in its possession or under its control. Unless otherwise agreed in writing, risk of any loss of, or damage to Services will pass to N4L upon delivery to N4L’s premises, your premises or receipt by N4L.

    Title

    Where you purchase any Equipment from N4L, all rights, title and interest will pass to you when the Charges for such Equipment, including any required hardware and software licenses, have been paid to N4L in full.

    Access to your premises

    Where required for us to provide our Services to you, you will provide us with reasonable access to your premises. This includes access to install, test, repair and carry out maintenance on our Equipment, and to remove any of our Equipment which is no longer required to provide our Services to you.

Managed Network - Internet

1. Internet Connection

   MAC Transaction	MAC Type	Description
   Managed Firewall upgrade / downgrade	Onsite MAC	Upgrade or downgrade of a Managed Firewall
   Access circuit upgrade / downgrade	Complex Remote MAC	Change to the access circuit within profiles and within the capability of the Managed Firewall
   IP Address add / remove / change	Complex Remote MAC	Changes to IP Addressing
   IPsec VPN add / remove / change	Complex Remote MAC	Change to a VPN defined within the network
   VLAN add / remove / change	Complex Remote MAC	Change to a VLAN defined within the network
   Security zone add / remove / change	Complex Remote MAC	Change to a security zone defined within the network
   QoS traffic add / remove / change	Simple MAC	Change to the QoS traffic classification
   Pre-approved Firewall rule add / remove / change	Simple MAC	Change to a pre-approved firewall rule on the Managed Firewall
   Customised Firewall rule add / remove / change	Complex Remote MAC	Change to any other firewall rule on the Manager Firewall
   DHCP add / remove / change	Complex Remote MAC	Change to the DHCP settings on the Managed Firewall
   Relinquish Service	Onsite MAC	Relinquishment of the Managed Network Service
   Site to site VPN add / remove / change	Complex Remote MAC	Change to site to site VPN routing for a School

2. Web Filtering change

   MAC Transaction	MAC Type	Description
   Web Filtering rule change	Simple MAC	Change to a filter rule within the “Web Filtering” Service

3. Remote Access

   MAC Transaction	MAC Type	Description
   Remote VPN add / remove / change	Complex Remote MAC	Change remote VPN access for a School
   Remote access user add / remove / change	Simple Remote MAC	Change remote access for a user

The service areas of our Cybersecurity Services are as follows:

• Support: we will support schools with the following services, regardless of how issues are discovered.
  • Cybersecurity Incident Management: we will provide coordination, guidance and management across cybersecurity incidents at your school.
  • Vulnerability Management: we will support schools to remediate vulnerabilities and exposed services.
• Proactive Monitoring and Notification: we will proactively monitor school networks and (by agreement) selected school systems, notifying schools of any issues in the following service areas:
  • Cybersecurity Incident Management: we will monitor cybersecurity incidents, including: phishing, business email compromise, unusual remote traffic and active exploits.
  • Vulnerability Management: we will monitor for vulnerabilities and exposed services.
• Cybersecurity Information: we will provide guidance material and vulnerability advisories to help schools improve their cybersecurity posture.
  • Reporting: we will provide schools with reporting regarding any issues that are detected via our security operations team
  • Advice: we will provide schools with cybersecurity advice, with a specific focus on how it relates to your use of N4L’s Services.

The optional features of Managed Network - Internet are:

1. Secure Remote Access

   Secure Remote Access allows remote users to connect securely to the school network using a Virtual Private Network (VPN), to access services and applications located within the school. It is typically set up for teaching and administration staff, or third party service providers to securely connect to school services.

2. TLS Inspection

   TLS Inspection is a security feature that enables the Managed Firewall to inspect and block malicious traffic even when it is encrypted within HTTPS traffic. To use TLS Inspection, your school will need management access to end user devices that access the network, such as tablets and mobile phones, to add the necessary configuration needed to support the feature. You will also need to ensure that you have suitable policies and end-user agreements in place to implement TLS inspection.

   TLS inspection is highly recommended by N4L to help detect and block a greater volume of malicious traffic.

3. Identity Integration

   Identity Integration is a feature that delivers a stronger security posture for schools, by enabling the individual identification of infected devices (i.e. faster quarantine), and a more granular set of filtering profiles that can differentiate website access for students, staff and guest users. It requires connection to the school directory service and mobile device management to help manage the end user device.

4. Additional Internet connection

   Where desired, a school can order a second internet connection, which can be provided to enable high availability. N4L will work with the school to understand their requirements and will advise on the right type of connection. Charges will apply for the installation and ongoing provision of the secondary connection, whether or not it is in active use.

5. Additional Firewall

   Where desired, a school can order a second firewall, which can be provided to support high availability. N4L will work with the school to understand their requirements and advise on the right model of firewall. N4L will quote for the hardware and any licenses required for its ongoing use.

6. Cybersecurity Services

   Prerequisites	Description
   Internet Connection	Required Proactive monitoring and reporting will not be available if you don’t use our Internet Connection with Internet Safety & Security Services enabled.
   Internet Safety & Security Services
   Internet Safety & Security Services - Recommended Settings	Strongly Recommended - These settings form part of the recommendations of the Cybersecurity Services

   Service Features	Description
   Support	Cybersecurity incident support will always be available to you, regardless of whether you are a customer of our Cybersecurity Services. However, the efficacy of this support may be severely limited if you are not a fully-fledged customer of this service.
   Proactive Monitoring & Reporting	In accordance with our Acceptable Use Policy and Privacy Statement, we will proactively monitor the network for Prohibited Use, including Cybersecurity Events. If such an event is discovered, we will generally notify you and depending on the severity, may also notify other agencies and/or the police. If you wish to reduce the frequency of cybersecurity reporting, N4L can work with you to understand your requirements, though baseline reporting will remain in place.
   Cybersecurity Information	If you prefer not to receive cybersecurity information from N4L (e.g. in circumstances where you receive a similar service from a third party), we can turn this feature off.

If we identify you have removed the Recommended Settings, we will endeavour to either work with you to correct this or record your decision to opt-out of our Recommended Settings. By opting out of our Recommended Settings you accept that:

• your School (and not N4L) will be solely responsible for managing the safety and security of your end users, the security of your school network and associated digital services and applications connected to the network.
• your School must ensure that it complies with N4L’s Acceptable Use Policy (for example, to ensure that Your Users do not use the Managed Network for any Illegal Uses)

If in future you wish to re-enable our Recommended Settings, N4L will work with you to do so.

1. Opting-out of Recommended Settings for Internet Safety & Security Services

   Your school may elect to opt-out of our Recommended Settings by notifying us (please note that we do not recommend this).

   If you remove our Recommended Settings, you are likely to significantly reduce the effectiveness of your protection against identifiable internet threats and objectionable content, and will still be required to meet our Acceptable Use Policy.

   Your school will also automatically be deemed to have opted-out of our Recommended Settings if any of the following components are identified as having been removed:

2. Web Filtering

   • This component is considered to be removed if you allow any of our Recommended Blocked Categories through a change request or via self-service.
   • By removing this component, you acknowledge that:
     • we will not be taking any action to stop or warn against access to websites in our Recommended Blocked Categories, and you are taking full responsibility for determining what level of filtering is appropriate for your school;
     • although we won’t filter the Recommended Blocked Categories, we will retain records of your filtering settings, who requested them, and of websites your users visit, in accordance with our Service Descriptions and Privacy Statement; and
     • if you have allowed any of the Recommended Blocked Categories, the Recommended Blocked Categories are not automatically reset by N4L at any time and you are solely responsible for updating your filtering settings if changes you have made do not reflect your preferences in the future. However, we may contact you from time to time to understand why you set your filtering settings as you did and whether the settings remain appropriate in light of your preferences and the risks that our Recommended Blocked Categories are intended to protect against.

3. Firewall

   • This component is considered to be removed if you allow any of our Recommended Blocked Firewall Rules through a change request or via self-service.
   • By removing this component, you acknowledge that:
     • you are taking full responsibility for all firewall features and for the external access that any parties have to your LAN, services within that LAN, and to any public facing internet services you operate;
     • we will not be able to provide advice on the firewall rules that you establish, nor will we be able to assist with the implementation of those rules; and,
     • we will not be taking any action to stop traffic flowing either to or from your Managed Firewall; you are responsible for all the effects that traffic has on both your internal LAN, our Managed Network, and the networks of any other sites connected to our Managed Network that are impacted by any inappropriate traffic originating from your network, such as but not limited to malware, viruses Trojans or other Disabling Code.

4. DNS Threat Protection

   • This component is considered to be removed if we identify that this service is not in use, or has been removed at your request.
   • By removing this component, you acknowledge that we will not be taking any action to stop or warn against DNS resolution requests to access online security threats via the Internet Connection, including but not limited to malware sites and botnet command and control servers. You will also lose SafeSearch protection, which is enabled via DNS resolution rules.

1. Mail Relay

   Provides a basic SPAM and AV scanning service over SMTP for email from on-site mail servers, providing:

   • outbound SPAM and AV/Malware filtering
   • the ability to send bulk emails from school email servers.

   Mail Relay is not enabled by default.