Cybersecurity Incident Response Plan

CYBERSECURITY INCIDENT RESPONSE PLAN AND AGREEMENT

This Cybersecurity Incident Response Plan and Agreement (the Plan) is entered into by the parties identified below effective as of .

WHEREAS

WHEREAS, Client Name: seeks to retain specialized incident response services to prepare for and respond to cybersecurity incidents; and

WHEREAS, Incident Response Provider: has the technical, legal and operational capabilities necessary to provide incident response, containment, remediation and reporting services on the terms set forth herein; and

WHEREAS, the parties desire to set forth the scope, responsibilities, timelines, and commercial terms governing the provision of incident response services and the procedures to be followed in the event of a cybersecurity incident.

SCOPE OF WORK

The Provider shall: (a) perform identification, containment, eradication, recovery and remediation activities as required; (b) coordinate with Client stakeholders and third-party service providers; (c) preserve evidence in accordance with chain-of-custody procedures; and (d) deliver interim and final technical and executive reports as specified below.

INCIDENT CLASSIFICATION & PRIORITIZATION

Incidents will be classified by severity. Provider will prioritize response according to the classification selected at discovery:

Incident Categories Data breach / exfiltration
Ransomware / extortion
Malware / persistent compromise
Service disruption / availability attack
Unauthorized access / privilege abuse

NOTIFICATION & ESCALATION

The Provider shall initiate initial notification to Client within of detection of a confirmed incident, and shall follow the escalation procedures below.

CONTAINMENT, ERADICATION & RECOVERY

Provider is authorized to recommend containment measures. If emergency containment is required to preserve systems or data, Provider may, subject to Client approval where practicable, isolate affected systems and implement temporary controls. Client authorizes Provider to take the following emergency actions without prior written approval:

Isolate compromised systems and remove network connectivity where immediate risk to other systems exists
Reset or revoke credentials suspected to be compromised
Apply critical patches or temporary controls to prevent ongoing exploitation

Provider will document all containment and remediation activities and prepare a recovery plan that addresses restoration of production services, verification of integrity, and testing prior to return to normal operations.

REPORTING & PRESERVATION OF EVIDENCE

Provider will produce a technical incident report and an executive summary. Final technical report delivery timeframe:

PAYMENT TERMS

All invoices are payable within the payment terms specified above. Client shall reimburse Provider for reasonable third-party costs incurred with prior approval. Provider reserves the right to suspend services for invoices overdue beyond the agreed payment period after providing written notice as described in Term and Termination.

TERM AND TERMINATION

Term Start Date:    Term End Date:

Either party may terminate this Plan for material breach if such breach remains uncured thirty (30) days after written notice. Termination for convenience requires the notice period set forth above. Upon termination Client shall pay Provider for services performed and reasonable wind-down costs.

CONFIDENTIALITY

Each party shall treat as Confidential Information any non-public information disclosed by the other party in connection with this Plan, including but not limited to incident details, forensic data, system configurations, vulnerability information and personal data. Confidential Information shall be used solely for the purposes of performing obligations under this Plan and shall not be disclosed except as required by law, regulation, or with prior written consent. Recipient shall apply at least the same degree of care to protect Confidential Information as it uses to protect its own confidential information, but in no event less than reasonable care.

The obligation of confidentiality will survive termination or expiration of this Plan for a period of three (3) years, or with respect to personal data for as long as required by applicable law.

LIMITATION OF LIABILITY & INSURANCE

Except for willful misconduct or gross negligence, Provider’s aggregate liability to Client for any claim arising under or relating to this Plan shall not exceed the total fees paid to Provider under this Plan during the twelve (12) months preceding the event giving rise to the claim. Client is encouraged to maintain insurance adequate for its needs. Provider shall maintain professional liability insurance in commercially reasonable amounts.

TESTING, TRAINING & EXERCISES

GOVERNING LAW

This Plan shall be governed by and construed in accordance with the laws of the State of without regard to conflict of law principles.

ENTIRE AGREEMENT

This Plan, including all attachments and schedules agreed in writing by the parties, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior negotiations, representations, and agreements, whether written or oral. Any modification to this Plan must be in writing and signed by authorized representatives of both parties.

MISCELLANEOUS PROVISIONS

If any provision of this Plan is held invalid or unenforceable, the remaining provisions will remain in full force and effect. Neither party may assign this Plan without the prior written consent of the other, except that Provider may assign to an affiliate or in connection with a merger or sale of substantially all of its assets.

Sign Now