Business CVE Template

BUSINESS CVE AGREEMENT

This Business CVE Agreement (the Agreement) is made effective as of Effective Date: by and between:

RECITALS

WHEREAS, Company operates software, systems, products or services (collectively, Company Systems) that are subject to security review and potential vulnerability disclosure; and

WHEREAS, Service Provider possesses expertise in identifying, assessing and coordinating the disclosure of security vulnerabilities and in the process of obtaining Common Vulnerabilities and Exposures (CVE) identifiers where applicable; and

WHEREAS, the parties desire to set forth the terms under which Service Provider will identify, validate, coordinate CVE requests, and support remediation of vulnerabilities discovered in the Company Systems.

SCOPE OF WORK

The Service Provider shall perform vulnerability discovery, validation, severity classification, CVE coordination and remediation support as set forth below. Provider shall act in accordance with the disclosure timelines and roles described in this Agreement.

VULNERABILITY REPORTING, CVE COORDINATION, AND REMEDIATION

Provider shall report confirmed vulnerabilities to Company promptly and in writing. The parties agree the Provider's initial report will include a technical description, affected components, reproducible steps and risk classification. Company shall acknowledge receipt within days. Provider will prepare and submit CVE requests where appropriate using the agreed attribution. Company retains final authority over public disclosure timing in accordance with the remediation timeline set forth below.

Remediation Timeline for reported vulnerabilities: Company will use reasonable efforts to remediate or mitigate reported vulnerabilities in accordance with severity. For critical vulnerabilities, Company shall use commercially reasonable efforts to provide a patch or mitigation within days following validation. If remediation cannot be provided within the stated timeframe, Company shall notify Provider and provide a remediation plan and estimated completion date.

PAYMENT TERMS

In consideration for the services described herein, Company shall pay Provider the amounts and on the schedule set forth below.

Late Payment: Any overdue amounts shall accrue interest at a rate of percent per annum (or the maximum permitted by law), calculated daily from the due date until paid. Company shall also reimburse Provider for reasonable collection costs.

TERM AND TERMINATION

Term: This Agreement commences on Start Date: and continues until End Date: unless earlier terminated as provided herein.

Termination for Convenience: Either party may terminate this Agreement upon written notice to the other party delivered at least days prior to the effective date of termination.

Termination for Cause: Either party may terminate immediately for material breach that is not cured within thirty (30) days after written notice of such breach. Termination shall not relieve either party of obligations accrued prior to termination.

CONFIDENTIALITY

Each party (Recipient) shall keep confidential and not disclose or use any Confidential Information of the other party (Discloser) except as necessary to perform its obligations under this Agreement. Confidential Information includes vulnerability reports, exploit code, remediation details, and non-public technical documentation. Confidential information does not include information that is or becomes publicly available through no breach of this Agreement, or that is independently developed without use of Discloser’s Confidential Information.

The obligations in this section shall survive termination or expiration of this Agreement for a period of years.

INTELLECTUAL PROPERTY, CVE ASSIGNMENT, AND PUBLICATION

Company retains all ownership rights in its systems and any fixes, patches or code developed to remediate vulnerabilities. Provider retains authorship rights in technical analysis prepared by Provider except that Provider assigns to Company a non-exclusive, royalty-free license to use any remediation guidance provided. Where a CVE identifier is requested or assigned, parties will agree on attribution and acknowledgements in writing; absent agreement, attribution shall follow Provider's reasonable request subject to Company's operational security concerns.

INDEMNIFICATION AND LIMITATION OF LIABILITY

Indemnification: Each party shall indemnify the other from third-party claims arising from its negligent or willful misconduct in performing this Agreement. The indemnifying party shall defend, settle or pay any final judgment against the indemnified party arising from such claims.

Limitation of Liability: Except for liability arising from willful misconduct, gross negligence, or a party's breach of confidentiality or indemnification obligations, neither party's aggregate liability for all claims arising under this Agreement shall exceed the total fees paid or payable by Company to Provider in the twelve (12) months preceding the event giving rise to the claim.

NOTICES

All notices required or permitted under this Agreement shall be in writing and delivered to the addresses listed above or to such other address as either party may designate in writing. Notices are deemed given upon personal delivery, one business day after delivery to an overnight courier, or three business days after deposit in the mail, postage prepaid.

GOVERNING LAW AND DISPUTE RESOLUTION

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to conflict of law rules. The parties shall attempt in good faith to resolve disputes amicably prior to commencing any litigation.

ENTIRE AGREEMENT

This Agreement constitutes the entire understanding between the parties with respect to the subject matter herein and supersedes all prior or contemporaneous agreements, representations and understandings. Any amendment or modification must be in writing and signed by authorized representatives of both parties.

MISCELLANEOUS PROVISIONS

Severability: If any provision is held unenforceable, the remainder will remain in full force and effect. Waiver: No waiver is effective unless in writing signed by the waiving party. Assignment: Neither party may assign this Agreement without the other party's prior written consent, except to a successor in interest in connection with a merger or sale of substantially all assets.

Sign Now