2026 Rate Schedule and Terms of Service

Consulting rates and Emergency Incident Management rates

1. Purpose

This schedule sets out the hourly rates charged by Carlson Tech Systems, LLC ("CTS") for calendar year 2026. It explains what each rate covers and what separates an ordinary consulting hour from an hour of Emergency Incident Management.

The two rates are different because the two services are different. One is a service I schedule. The other is a commitment to drop everything else until your problem is solved.

2. The Two Rates

2.1 Standard Consulting: $150 per hour

Standard Consulting is planned, scheduled and routine work. The client chooses when and whether to call, and what to ask for. I schedule the work around my other commitments and my normal working hours.

There is no minimum charge and no monthly commitment.

2.2 Emergency Incident Management: $250 per hour

Emergency Incident Management is a different service from consulting. It applies only when an incident occurs that significantly disrupts business. From the moment of declaration, CTS halts all other activities, suspends availability to every other client, and works continuously until the incident is resolved and services are restored.

The Emergency rate reflects what that commitment costs. Other clients are set aside. Nights, weekends and holidays are worked as needed. Personal and work-life balance are not protected for the duration of the incident. The rate covers the whole of that commitment, and I do not add separate surcharges for after-hours, weekend or holiday work.

3. What Counts as an Emergency Incident

An Emergency Incident is an event that threatens, interrupts or damages the security, integrity or availability of a client's systems or data, and that cannot responsibly wait for scheduled work. Examples include the following.

• IT license expiration and recovery.
• A production outage that stops the client's business from operating.
• A confirmed or suspected security breach, malware or ransomware infection.
• Loss or corruption of critical data that requires immediate recovery.

3.1 Declaring an Incident

• The client may request Emergency Incident Management by telephone, text or email, or CTS may recommend it after assessing the situation.
• A verbal declaration is all that's needed as the priority must be to recover business operations.
• The Emergency rate applies from the time the client reports the issue and work began.

3.2 Closing an Incident

An incident is closed when services are fully restored, the client has been told so, and the immediate risk has been contained. CTS will say when it considers the incident closed. Follow-up work after that point returns to the Standard Consulting rate unless the client and CTS agree otherwise in writing.

4. Side by Side

5. How the Two Services Work

The two rates describe two different ways of working. It matters which one applies, because they set different expectations for how much I do without being asked and how quickly I do it.

5.1 Standard Consulting: Part Time, As Time Allows

Standard Consulting is part-time work, delivered as time is available. It is a best-effort service. It is not a monitoring service, a managed service or an on-call arrangement unless a separate written agreement says so.

• Work is reactive. I do what the client asks, when the client asks, and when my schedule allows.
• I do not do proactive work in response to business needs. I do not watch for problems, patch, review or maintain systems on my own initiative.
• If I notice a risk while doing requested work, I will tell the client. Sharing a risk is not a commitment to fix it.
• Risks that have been shared are not enforced or acted on unless the client explicitly asks me to act, with a specific date for the work to be done.
• Where no date is given, the work is done on a best effort basis when time allows. No date and no request means no action.
• The decision to act on a risk, defer it or accept it belongs to the client.

5.2 Emergency Incident Management: Autonomous, At Maximum Capacity

Emergency Incident Management is a more autonomous way of working, carried out at the maximum capacity I can bring above the needs of every other customer. Resolving the incident is my priority from declaration until it is closed.

• I take the initiative. I investigate, contain, rebuild and restore without waiting for a request for each step.
• I act on my own judgment within the authority the client gives when the incident is declared.
• I work continuously, and I bring in automated and AI assisted tools to do more at once, under my supervision.
• I keep the client informed of what has been found, what has been done and what comes next.
• Decisions that belong to the client stay with the client. These include business decisions, legal and regulatory notices, public statements, and spending beyond what has been agreed.

6. What the Time Includes

Billable time at either rate is the time spent on the client's work. During an Emergency Incident this includes the following.

• Investigation, containment, evidence preservation and forensic review.
• Rebuilding, restoring, testing and redeploying systems.
• Communication with the client, the client's vendors, insurers, advisors and card processors.
• Documentation, incident reports and supporting records.
• Monitoring and directing automated tools and AI assisted work performed on the client's behalf.

Time is one team's time. Work performed with the help of software, automation or AI tools is billed the same as work performed by hand. These tools are paid for, supervised, directed and checked by CTS, and that responsibility is part of the service. Where tools run in parallel, the clock runs once and the time is never counted twice.

7. Records and Invoicing

CTS keeps a time record for every engagement. For an Emergency Incident the record shows the date, the time window, the minutes, a short subject and a description of the work, with the hours, the rate and the total for each entry. The client receives that record with the invoice.

Where there is no written agreement, invoices are due on receipt.

8. Other Costs

The hourly rates cover CTS's time only. Hardware, software licenses, hosting, subscriptions and other third-party charges are billed separately, at cost, and are not marked up. CTS will tell the client about a material third party cost before incurring it, except where waiting would extend the incident.

9. Term and Revision

These rates took effect on January 1, 2026. They remain in effect through December 31, 2026, when they will be revised. Work performed on or before December 31, 2026, is billed at these rates, including work on an incident declared before that date and still open after it.

This schedule sets rates and describes the two ways of working. The Terms of Service below apply to all work at either rate.

Questions about these rates or terms? Email Justin Carlson at justin@carlsontechsystems.com.