Business ISMS Document

BUSINESS ISMS DOCUMENT

This Business ISMS Document (the Agreement) is made and entered into by and between:

Effective Date:

Recitals

WHEREAS, Company is engaged in operating its business and requires the establishment, implementation and maintenance of an Information Security Management System (ISMS) to protect the confidentiality, integrity and availability of Company information assets; and

WHEREAS, Provider possesses experience and expertise in assessing, designing and implementing ISMS frameworks, controls, policies and procedures; and

WHEREAS, the parties desire to set forth the scope, deliverables, payment terms and responsibilities with respect to Provider's engagement to produce, implement and support the ISMS described herein.

Scope of Work

Provider will perform the following services in connection with the ISMS (the Services). Provider shall document controls, produce required deliverables and coordinate acceptance testing with Company.

Typical activities include: asset inventory, risk assessment, definition of risk acceptance criteria, selection and implementation of security controls, development of ISMS policy and procedures, employee awareness training, incident response planning, periodic internal audits and management review.

Deliverables and Acceptance

Provider shall deliver the following items unless otherwise agreed in writing. Company shall review deliverables within the acceptance period described below.

Payment Terms

As consideration for the Services rendered, Company shall pay Provider in accordance with the terms below.

Late payment shall accrue interest at the rate of per month on the outstanding balance, or the maximum rate permitted by law, whichever is lower.

Term and Termination

Term Commencement:

Term Expiration:

Either party may terminate this Agreement for cause if the other party materially breaches any obligation and fails to cure within days after written notice. Either party may terminate for convenience upon days' prior written notice.

Confidentiality

For purposes of this Agreement, "Confidential Information" means all non-public information disclosed by either party, whether oral, written or electronic, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Confidential Information includes without limitation business plans, security configurations, technical data, personal data, risk assessments, control mappings and audit findings.

Receiving Party shall: (a) maintain Confidential Information in strict confidence using at least the same degree of care it uses to protect its own confidential information but no less than a reasonable standard of care; (b) not disclose Confidential Information to any third party except to employees, contractors or advisors who have a need to know and are subject to confidentiality obligations no less protective than those contained herein; and (c) use Confidential Information solely for the performance of this Agreement.

The obligations set forth in this Confidentiality section shall not apply to information that: (i) is or becomes generally available to the public through no fault of the receiving party; (ii) was rightfully known to the receiving party prior to disclosure by disclosing party; (iii) is lawfully received from a third party without restriction; or (iv) is independently developed by the receiving party without use of Confidential Information. Disclosure required by law or court order is permitted so long as the receiving party provides prompt written notice to allow the disclosing party to seek protective relief.

Confidentiality obligations shall survive termination or expiration of this Agreement for a period of five (5) years, except for trade secrets which shall be protected for so long as such information remains a trade secret under applicable law.

Data Security and Incident Notification

Provider shall implement and maintain administrative, technical and physical safeguards appropriate to the sensitivity of the information processed or stored on behalf of Company, including access controls, encryption where appropriate, secure configuration management and logging sufficient to support incident investigation.

Provider shall notify Company without undue delay and in no event later than after becoming aware of any security incident or breach affecting Company data, and shall cooperate in remediation, forensics and regulatory notification as reasonably required by Company.

Audit Rights

Upon reasonable prior written notice and subject to confidentiality protections, Company shall have the right to conduct assessments or audits of Provider's implementation of agreed security controls, either directly or through an independent third-party auditor. Any such audits shall be scheduled to minimize business disruption and the parties shall cooperate in good faith to accept mutually agreeable audit scope and timing.

Governing Law; Dispute Resolution

This Agreement shall be governed by and construed in accordance with the laws of without regard to its rules regarding conflicts of law. The parties shall attempt to resolve disputes in good faith through negotiation. If unresolved, disputes shall be resolved by binding arbitration in accordance with the parties' mutual agreement or, if no agreement is reached, by litigation in the courts of the selected jurisdiction.

Entire Agreement; Amendment

This Agreement, including any exhibits and attachments expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior and contemporaneous understandings, negotiations and agreements, whether written or oral. No amendment or modification of this Agreement shall be effective unless in writing and signed by authorized representatives of both parties.

Representations and Certifications

Each party represents and warrants that it has the full power and authority to enter into this Agreement and that execution and performance will not violate any other agreement to which it is a party. Provider certifies that the personnel performing the Services are qualified to perform those Services and will comply with Company's reasonable security requirements disclosed in writing prior to performance.

The obligations and rights under Sections Confidentiality, Data Security and Audit Rights shall survive termination or expiration of this Agreement as expressly provided.

Sign Now