Business Security Metrics Template

BUSINESS SECURITY METRICS TEMPLATE AND AGREEMENT

This Business Security Metrics Template and Agreement (the Agreement) is entered into by and between: Company Name: and Security Provider Name: . Effective Date:

RECITALS

WHEREAS, Company requires defined, measurable security metrics to manage information security, demonstrate compliance, and reduce operational risk; and

WHEREAS, Security Provider has expertise, staff, tools and processes to collect, measure, report and remediate security metrics in accordance with agreed service levels; and

WHEREAS, the parties desire to set forth the metrics, responsibilities, reporting cadence and associated terms under which Security Provider will produce and manage the Business Security Metrics described herein.

SCOPE OF WORK

Security Provider shall collect, calculate and report the metrics listed in the Security Metrics section below, maintain source data and calculation methodology, and provide remediation tracking and trend analysis in accordance with the Payment Terms, Term and Termination, Confidentiality and other contract provisions set forth herein.

SECURITY METRICS (CORE TEMPLATE)

The following template defines metric attributes to be completed for each tracked security metric. Security Provider will maintain a live register populated from operational tools and will deliver periodic reports as specified in Reporting and Review.

REPORTING AND REVIEW

Reports produced from the security metrics register shall be the authoritative operational record for the metrics and will be delivered in accordance with the cadence and distribution below.

Dashboard Written Report Presentation / Review Meeting

PAYMENT TERMS

Company shall pay Security Provider the fees set forth below in consideration for the services described in this Agreement. Unless otherwise agreed in writing, fees are exclusive of applicable taxes.

Security Provider may suspend reporting or withhold deliverables if invoices remain unpaid beyond the agreed payment due date after written notice and the expiration of the cure period specified in the Payment Schedule.

TERM AND TERMINATION

This Agreement commences on Start Date and continues until End Date unless earlier terminated in accordance with this section.

Either party may terminate for material breach if the breaching party fails to cure within 30 days after written notice of such breach or immediately for gross negligence or willful misconduct affecting data security. Upon termination, Security Provider will deliver the final metrics register and source data extract subject to Confidentiality obligations.

CONFIDENTIALITY

Each party shall treat as confidential all non-public information disclosed by the other party that is marked or reasonably should be understood to be confidential, including metric source data, calculation methods, vulnerabilities and remediation plans. Confidential Information shall not be disclosed except to personnel with a need to know or as required by law. Confidentiality obligations survive termination for a period of three (3) years or as otherwise required by applicable law.

AUDIT RIGHTS; DATA ACCURACY

Company may, upon reasonable notice and during normal business hours, audit the metric calculation methodology, sample source data and controls related to reported metrics. Security Provider warrants that it will apply consistent measurement methodology and promptly disclose material errors. Where errors materially affect reported metrics, Security Provider will correct historical values and notify the distribution list.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction specified below without regard to its conflicts of law rules.

ENTIRE AGREEMENT

This Agreement, including the metrics templates, represents the entire agreement between the parties with respect to the subject matter and supersedes all prior and contemporaneous agreements and understandings, whether written or oral. Any modification must be in writing and signed by authorized representatives of both parties.

REPRESENTATIONS AND WARRANTIES

Each party represents that it has full power and authority to enter into this Agreement and perform its obligations. Security Provider represents it will perform services in a professional manner consistent with industry standards for information security operations.

MISCELLANEOUS PROVISIONS

If any provision of this Agreement is held invalid, illegal or unenforceable, the remaining provisions will remain in full force and effect. Headings are for convenience and do not affect interpretation. Notices required under this Agreement shall be in writing and delivered to the parties' addresses specified in their respective internal records.

Sign Now