Device Security Verification Form

Device Security Verification Form

This Device Security Verification Form (the "Agreement") is entered into as of between the parties identified below for the purpose of verifying and documenting the security posture of devices managed by or for the Client.

WHEREAS

WHEREAS, the Client requires an independent verification of security controls applied to specified devices and systems to satisfy contractual, regulatory, or internal risk-management obligations; and

WHEREAS, the Verifier has the required technical competence, tools, and personnel to perform device security verification services in accordance with industry-standard practices; and

WHEREAS, the parties desire to set forth the scope, deliverables, payment, confidentiality and other terms governing the verification engagement.

PARTIES

SCOPE OF WORK

The Verifier shall perform device security verification services described below and produce a written Verification Report documenting findings, exceptions, and recommended remediation. Verification activities shall include, at a minimum, the checks and attestations listed in this form.

PAYMENT TERMS

Compensation for the verification services shall be as follows:

TERM AND TERMINATION

The term of this Agreement commences on the Start Date below and terminates on the End Date below unless earlier terminated pursuant to the conditions set forth herein.

Start Date:     End Date:

DEVICE INVENTORY

List each device subject to verification. For large inventories, attach a separate inventory spreadsheet and indicate the attachment reference.

Type:    Manufacturer:    Model:

Serial #:    OS/Version:

Encryption Enabled:    Antivirus Installed:    Firewall Enabled:    Last Patch Date:

Type:    Manufacturer:    Model:

Serial #:    OS/Version:

Encryption Enabled:    Antivirus Installed:    Firewall Enabled:    Last Patch Date:

COMPLIANCE CHECKLIST

Confirm each control is present and functioning for the listed devices. Where an item is not compliant, provide details in the Exceptions and Remediation Plan below.

Full-Disk Encryption in place:    Endpoint Anti-Malware Active:    Firewall Configured:

Patching Current (per policy):    Multi-Factor Authentication for remote access:    Remote Wipe Capability:

Least Privilege / Account Control in effect:    Physical Security Controls Present:

CONFIDENTIALITY

Each party shall maintain in confidence all non-public information disclosed in connection with this Agreement, including Verification Reports, device inventory details, and vulnerability information. The receiving party shall not disclose such information except to its employees and contractors who have a need to know and who are bound by confidentiality obligations no less protective than those herein. Confidential information shall not include information that is or becomes generally known through no breach of this Agreement or is independently developed without reference to the other party's confidential information.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State of , without regard to conflict of law principles.

ENTIRE AGREEMENT

This Agreement, including any attachments and referenced inventory lists, constitutes the entire agreement between the parties concerning the subject matter hereof and supersedes all prior and contemporaneous agreements, representations and understandings, whether written or oral. Any amendment or modification must be in writing and signed by authorized representatives of both parties.

ATTESTATION

The undersigned representative of the Verifier certifies that the verification activities described in this form were performed under the terms of this Agreement to the best of the Verifier's knowledge, and that the Verification Report accurately reflects the findings as of the dates indicated therein. The Client acknowledges receipt of the Verification Report and agrees to the remediation plan where appropriate.

Sign Now