Cybersecurity Ransomware Response Plan

Cybersecurity Ransomware Response Plan and Services Agreement

This Cybersecurity Ransomware Response Plan and Services Agreement (the "Agreement") is entered into between Client Name: and Service Provider Name: effective as of Effective Date: .

WHEREAS

WHEREAS, Client operates information systems and digital assets requiring professional incident response and remediation services to address ransomware incidents and related cyber threats; and

WHEREAS, Service Provider is experienced in cybersecurity incident response, containment, forensic investigation, and recovery operations and is willing to provide such services under the terms and conditions set forth in this Agreement.

SCOPE OF WORK

Service Provider will develop, document, and execute a ransomware response plan for Client. The plan shall include incident identification, containment, eradication, recovery, forensic preservation, communications, and post-incident remediation activities. Specific tasks include:

INCIDENT RESPONSE PROCEDURES

The following procedural elements shall be incorporated into the Plan and observed during a ransomware incident:

Incident Response Team Roster and Roles:

Containment and Eradication Procedures (high-level): isolate affected hosts, preserve volatile evidence, disable compromised accounts, apply temporary network segmentation, and engage forensic analysis prior to restoration. Service Provider shall not take actions that materially alter evidence without Client approval unless required to protect life or safety.

PAYMENT TERMS

Client shall pay Service Provider for services performed under this Agreement in accordance with the following terms:

Service Provider shall submit itemized invoices and shall include descriptions of services, dates, and personnel. Client shall pay undisputed invoices within thirty (30) days of receipt. Disputed charges must be raised in writing within fifteen (15) days of invoice receipt.

RANSOM PAYMENT POLICY

Client acknowledges that payment of ransom demands carries legal, operational, and reputational risk. Service Provider will not pay, negotiate, or facilitate payment of any ransom unless expressly authorized in writing by Client's authorized representative. If Client authorizes ransom payment, Client remains solely responsible for that decision and associated consequences; Service Provider may provide advisory support at additional cost.

NOTIFICATION AND REPORTING

Service Provider will assist Client in identifying notification obligations to affected individuals, regulators, and contractual counterparties. Client retains final authority on notification timelines and contents.

TERM AND TERMINATION

This Agreement begins on Start Date: and shall continue until End Date: , unless terminated earlier in accordance with this section.

Either party may terminate for convenience upon Written Notice Period: prior written notice. Either party may terminate immediately for material breach that is not cured within thirty (30) days of written notice of such breach. Termination shall not relieve Client's obligation to pay for services performed through the effective date of termination or for any non-cancellable third-party costs incurred by Service Provider.

CONFIDENTIALITY

Each party shall treat as confidential all non-public information received from the other party in connection with this Agreement, including incident-related findings, forensic images, and personal data. Confidential information shall be used solely to perform obligations under this Agreement and shall not be disclosed except to employees, contractors, or advisors who have a need-to-know and are bound by confidentiality obligations at least as restrictive as those herein or as required by law. Confidentiality obligations shall survive termination for a period of five (5) years.

DATA PROTECTION AND PRIVACY

Service Provider will implement commercially reasonable technical and organizational measures to protect Client data during the performance of services. To the extent Service Provider processes personal data on Client's behalf, Service Provider shall process such data only on documented instructions from Client and in compliance with applicable data protection laws.

LIMITATION OF LIABILITY AND INDEMNIFICATION

Each party's liability for direct damages arising out of this Agreement shall be limited to the amounts paid or payable under this Agreement in the twelve (12) months preceding the claim. Neither party shall be liable for indirect, incidental, consequential, punitive, or special damages. Client agrees to indemnify, defend, and hold harmless Service Provider from third-party claims arising from Client's failure to follow mandatory recommendations or from Client's decisions to pay ransom or otherwise act contrary to Service Provider's advice.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the Governing State: without regard to conflict of laws principles.

ENTIRE AGREEMENT; AMENDMENT

This Agreement, including any exhibits and the finalized Ransomware Response Plan developed under this Agreement, constitutes the entire agreement between the parties concerning the subject matter hereof and supersedes all prior and contemporaneous agreements and understandings. Any amendment or modification must be in writing and signed by authorized representatives of both parties.

MISCELLANEOUS PROVISIONS

Assignment: Neither party may assign this Agreement without the prior written consent of the other, except that Service Provider may assign to an affiliate or in connection with a sale of substantially all its assets. Severability: If any provision is held invalid, the remaining provisions shall remain in full force and effect.

Sign Now