Incident Management Procedure Template

Incident Management Procedure Agreement

Effective Date:

WHEREAS

WHEREAS, Service Provider has expertise in incident detection, triage, response, remediation, and post‑incident analysis, and maintains resources and personnel capable of performing incident management services in accordance with accepted industry practices; and

WHEREAS, Client desires to engage Service Provider to perform incident management services for Client's systems and operations on the terms set forth in this Agreement, and Service Provider agrees to provide such services subject to the terms and conditions herein; and

WHEREAS, the parties intend that this Agreement define roles, responsibilities, reporting and escalation practices, confidentiality obligations, compensation and performance expectations associated with incident management.

1. Definitions

For purposes of this Agreement, the following definitions apply: "Incident" means any event that actually or imminently jeopardizes the confidentiality, integrity, or availability of Client systems, or otherwise disrupts normal business operations; "Severity Level" means the classification assigned to an Incident reflecting its business impact and urgency; "Confidential Information" means information designated as confidential or which reasonably should be understood to be confidential given its nature.

2. Scope of Work

Service Provider shall perform incident management services that include identification, reporting, triage, containment, eradication, recovery, escalation, documentation and post-incident review. The specific deliverables, response targets and exclusionary items are described below.

3. Incident Classification

Incidents will be classified by Service Provider according to severity and business impact. Typical classifications include: Severity 1 (Critical) – widespread impact on core operations; Severity 2 (High) – significant but contained impact; Severity 3 (Medium) – limited impact; Severity 4 (Low) – informational or minimal impact. Classification will determine response priority and escalation path.

4. Incident Reporting and Contact Information

Client and Service Provider shall ensure that incidents are reported immediately through the designated channels. Reports must include time of detection, affected systems, observed impact and initial remediation steps.

5. Response, Triage and Escalation

Service Provider shall commence initial triage upon receipt of an incident report and will apply containment and mitigation measures in accordance with the Severity Level. Escalation to senior personnel will occur when incidents meet predefined thresholds or when additional authority or resources are required.

6. Documentation and Recordkeeping

All incidents will be documented by Service Provider in a secure incident log, including timestamps, actions taken, decisions made, and personnel involved. Records shall be retained for the period agreed below and made available to Client upon reasonable request consistent with confidentiality obligations.

7. Post-Incident Review and Corrective Actions

Within a reasonable period following incident resolution, Service Provider shall conduct a post‑incident review to determine root cause, document corrective actions, and provide recommendations to prevent reoccurrence. Client and Service Provider shall agree on implementation timelines for critical corrective actions.

8. Training and Awareness

Service Provider shall provide training materials and periodic awareness sessions to Client personnel as agreed. Training schedules, topics and attendance expectations will be documented in the scope of work.

9. Payment Terms

Client shall pay Service Provider fees for incident management services as set forth below. Unless otherwise agreed in writing, fees are due in accordance with the schedule below.

10. Term and Termination

This Agreement shall commence on and shall continue until unless earlier terminated in accordance with this Section.

Either party may terminate this Agreement for convenience upon days' prior written notice. Either party may terminate for material breach if the breaching party fails to cure the breach within thirty (30) days after written notice.

11. Confidentiality

Each party shall protect the other party's Confidential Information with at least the same degree of care it uses to protect its own confidential information, and in no event less than reasonable care. Confidential Information may be disclosed only to those personnel with a need to know and shall not be used for any purpose other than performing obligations under this Agreement. These obligations survive termination for a period of three (3) years, or longer where required by law with respect to certain regulated data.

12. Liability and Indemnification

Each party shall indemnify and hold harmless the other from third party claims arising from its gross negligence or willful misconduct in connection with this Agreement. Except for liability arising from gross negligence, willful misconduct or breach of confidentiality, neither party's aggregate liability shall exceed the fees paid under this Agreement in the twelve (12) months preceding the claim.

13. Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to conflict of law principles.

14. Entire Agreement; Amendments

This Agreement, including all appendices and incorporated statements of work, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior negotiations and agreements. Any amendment must be in writing and signed by authorized representatives of both parties.

15. Miscellaneous Provisions

Notices shall be in writing and delivered to the addresses provided by the parties. If any provision of this Agreement is held unenforceable, the remainder shall remain in full force and effect. The parties acknowledge they have had the opportunity to seek independent legal advice prior to execution.

Acknowledgement

The undersigned represent and warrant they are authorized to execute this Agreement on behalf of the party for which they sign and that the information provided herein is accurate to the best of their knowledge.

Sign Now