Business PCI DSS Proposal

BUSINESS PCI DSS PROPOSAL

Parties

Service Provider Name:

Service Provider Address:

Client Name:

Client Address:

Recitals

WHEREAS, Service Provider is engaged in the business of providing information security consulting and services, including services specific to Payment Card Industry Data Security Standard (PCI DSS) compliance; and

WHEREAS, Client desires to retain Service Provider to perform a PCI DSS assessment, remediation planning, and related services as set forth in this Proposal and the parties desire to set forth the terms and conditions under which those services will be provided;

WHEREAS, the Effective Date of this Proposal is:

Scope of Work

Service Provider will provide professional services to assist Client in achieving and maintaining compliance with applicable PCI DSS requirements. Services to be provided shall include assessment, gap analysis, remediation guidance, assistance with evidence collection, and support during any external validation or attestation process as requested below.

PCI DSS Assessment and Gap Analysis

Remediation Planning and Project Management

Advisory Support for Qualified Security Assessor (QSA) Engagement

Payment Terms

Total Fee: (amount in USD unless otherwise agreed)

Deposit required upon acceptance:

Invoicing: Service Provider will invoice Client in accordance with the payment schedule. Client shall pay all undisputed invoices within days of invoice receipt.

Late payment: Any undisputed amount not paid when due shall accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law, and Service Provider may suspend performance until overdue amounts are paid.

Term and Termination

Term Commencement Date:

Anticipated Completion Date:

Notice period for termination for cause: days written notice to cure is required prior to termination for material breach.

Confidentiality

Each party acknowledges that in the course of performance it may receive Confidential Information of the other party. "Confidential Information" includes non-public business information, system configurations, network diagrams, security findings, remediation plans, and any cardholder data or cardholder data environment (CDE) details. Both parties agree to: (a) treat Confidential Information with at least the same degree of care as their own confidential information but no less than a reasonable standard of care; (b) use Confidential Information only for the purposes of performing under this Proposal; and (c) not disclose Confidential Information to third parties except to employees, agents, or subcontractors who have a need to know and who are bound by confidentiality obligations at least as protective as set forth herein.

Exceptions: Confidential Information does not include information that (i) is or becomes publicly known through no breach by the receiving party; (ii) is rightfully received from a third party without restriction; (iii) is independently developed without use of the disclosing party's Confidential Information; or (iv) is required to be disclosed by law, provided the receiving party gives prompt notice and cooperates to seek a protective order.

Survival: The confidentiality obligations shall survive termination or expiration of this Proposal for a period of three years, except for obligations relating to cardholder data and related security details which shall survive for as long as such information remains confidential under applicable standards.

Compliance and Representations

Service Provider represents that it will perform services in a professional manner consistent with industry standards applicable to PCI DSS assessments and advisory work. Client represents that it will provide access to facilities, systems, personnel, and documentation reasonably necessary for Service Provider to perform the services. Client retains all responsibility for its own implementation of remediation measures and for final acceptance by any external assessor or card brand.

Governing Law

This Proposal and any dispute arising under or related to it shall be governed by and construed in accordance with the laws of the State of , without regard to its conflicts of law principles.

Entire Agreement

This Proposal, together with any written attachments or schedules executed by the parties, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, negotiations, and understandings, whether written or oral. Any amendments must be in writing and signed by authorized representatives of both parties.

Acceptance

The parties acknowledge and agree that execution of this Proposal by authorized representatives constitutes acceptance of the terms herein and authorization for Service Provider to commence work in accordance with the Scope of Work and Payment Terms.

Sign Now