Cybersecurity Agreement

CYBERSECURITY AGREEMENT

This Cybersecurity Agreement (the Agreement) is made and entered into as of Effective Date: by and between Provider Name: , a , with principal place of business at (Provider), and Client Name: , a , with principal place of business at (Client). Provider and Client are each a Party and together the Parties.

RECITALS

WHEREAS: Provider has expertise and provides cybersecurity services, including but not limited to risk assessment, monitoring, incident response, and remediation;

WHEREAS: Client desires to engage Provider to perform cybersecurity services for Client's information systems and data in accordance with the terms and conditions set forth in this Agreement;

WHEREAS: The Parties intend to define responsibilities, security standards, incident response protocols, and liabilities arising from cybersecurity events affecting Client Systems.

NOW, THEREFORE, in consideration of the mutual covenants set forth herein, the Parties agree as follows.

1. DEFINITIONS

1.1. "Client Data" means all electronic and physical data, information, and records provided by or on behalf of Client to Provider or acquired by Provider in connection with the Services. 1.2. "Client Systems" means the information technology systems, networks, applications, and devices owned, operated or controlled by Client that are within the scope of the Services. 1.3. "Confidential Information" shall have the meaning set forth in Section 6. 1.4. "Incident" means any actual or suspected cybersecurity event that compromises the confidentiality, integrity, or availability of Client Data or Client Systems.

2. SCOPE OF SERVICES

2.1. Provider shall perform the cybersecurity services described in Statement of Work or Service Schedule: (Services). Services may include vulnerability scanning, penetration testing, continuous monitoring, incident response, threat intelligence, and remediation assistance.

2.2. Provider shall perform Services in a professional manner consistent with industry standards and with appropriate technical and organizational measures to protect Client Data.

3. SECURITY STANDARDS AND CONTROLS

3.1. Provider shall implement administrative, technical and physical safeguards appropriate to the nature of the Client Data and the risks, including but not limited to: access control, least privilege, encryption in transit and at rest where applicable, secure configuration, vulnerability management, logging and monitoring, and patch management.

3.2. The Parties acknowledge that Provider's measures will meet or exceed the following selected baseline control set (select all that apply): ISO/IEC 27001 Industry-recognized security framework Client-specific controls as set forth in the Service Schedule

4. INCIDENT RESPONSE AND NOTIFICATION

4.1. Provider shall notify Client of any Incident affecting Client Data or Client Systems without undue delay and in any event within of discovery. Provider's initial notification shall include a description of the Incident, scope, affected systems, and immediate mitigation measures taken.

4.2. Provider shall lead technical containment and remediation activities and provide regular status updates until the Incident is resolved. Provider shall preserve and, upon Client request, make available forensic data necessary for Client's regulatory obligations and legal claims.

5. CONFIDENTIALITY

5.1. Each Party shall protect Confidential Information of the other Party using at least the same degree of care as it uses to protect its own confidential information, but no less than a reasonable degree of care. Confidential Information includes Client Data, security assessments, logs, and any non-public business information.

5.2. Provider shall not use Client Data except as necessary to perform the Services. Provider shall restrict access to Confidential Information to personnel and subcontractors with a need to know and bound by confidentiality obligations at least as protective as this Agreement.

6. AUDIT AND COMPLIANCE

6.1. Client may, upon reasonable prior notice not less than , conduct audits or engage a third-party auditor to verify Provider's compliance with the security obligations set forth herein. Audits shall be conducted during normal business hours and in a manner that minimizes disruption to Provider.

6.2. Provider shall provide documentation reasonably requested by Client to demonstrate compliance, including policies, procedures, and evidence of controls. Where audit findings identify deficiencies, Provider shall remediate such deficiencies within a mutually agreed remediation period.

7. SUBCONTRACTORS

7.1. Provider may engage subcontractors to perform parts of the Services provided that Provider remains responsible for the acts and omissions of its subcontractors and ensures they are bound by obligations consistent with this Agreement.

8. LIABILITY AND INDEMNIFICATION

8.1. Each Party shall indemnify, defend and hold harmless the other Party from claims arising out of its gross negligence, willful misconduct, or material breach of this Agreement. Provider's indemnity for breaches of security obligations shall include reasonable costs of notification, forensic investigation, and mitigation.

8.2. EXCEPT FOR LIABILITY ARISING FROM A PARTY'S GROSS NEGLIGENCE, WILLFUL MISCONDUCT, OR INDEMNIFICATION OBLIGATIONS, NEITHER PARTY SHALL BE LIABLE FOR INDIRECT, INCIDENTAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES. PROVIDER'S AGGREGATE LIABILITY FOR DIRECT DAMAGES ARISING FROM A BREACH OR NEGLIGENCE SHALL BE LIMITED TO THE GREATER OF (A) THE TOTAL FEES PAID BY CLIENT TO PROVIDER UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM; OR (B) .

9. INSURANCE

Provider shall maintain and provide evidence of commercial general liability, professional liability (errors & omissions), and cyber liability insurance with limits appropriate to the Services and reasonably acceptable to Client. Upon request, Provider shall deliver certificates of insurance.

10. TERM AND TERMINATION

10.1. This Agreement shall commence on the Effective Date and continue for an initial term of unless earlier terminated as provided herein.

10.2. Either Party may terminate this Agreement for material breach of this Agreement by the other Party if such breach remains uncured for a period of after written notice specifying the breach.

11. REMEDIES

The Parties acknowledge that a breach of Provider's confidentiality or security obligations may cause irreparable harm for which monetary damages may be inadequate and that the non-breaching Party shall be entitled to seek injunctive and equitable relief in addition to any other remedies available at law or in equity.

12. NOTICES

All notices required or permitted under this Agreement shall be in writing and delivered to the Parties at the addresses below by certified mail, courier, or overnight delivery, or to such other address as a Party designates by notice in accordance with this Section.

13. AMENDMENTS; WAIVER

This Agreement may not be amended except by a written instrument signed by authorized representatives of both Parties. No waiver of any provision shall be effective unless in writing and signed by the waiving Party. A waiver of any breach shall not constitute a waiver of any subsequent breach.

14. COUNTERPARTS; ELECTRONIC SIGNATURES

This Agreement may be executed in counterparts, each of which constitutes an original and all of which constitute one instrument. Signatures delivered by electronic means shall be binding.

15. GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction specified by the Parties: Governing Jurisdiction: , without regard to conflict of law principles.

16. ENTIRE AGREEMENT; SEVERABILITY

16.1. This Agreement, together with any Service Schedules, exhibits, and attachments expressly incorporated herein, constitutes the entire agreement between the Parties with respect to the subject matter and supersedes all prior proposals, negotiations, and agreements, whether written or oral.

16.2. If any provision of this Agreement is held invalid or unenforceable, the remainder of this Agreement shall remain in full force and effect and the invalid provision shall be reformed to the minimum extent necessary to make it enforceable.

17. MISCELLANEOUS

17.1. Relationship of Parties. The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency or employment relationship between the Parties. 17.2. Assignment. Neither Party may assign its rights or obligations under this Agreement without the prior written consent of the other Party, except that Provider may assign to an affiliate or in connection with a merger or sale of substantially all of its assets.

ATTACHMENTS AND SERVICE SCHEDULES

Sign Now