Incident Response Breach Protocol

Incident Response Breach Protocol

WHEREAS

WHEREAS, Client Name: is engaged in processing or holding Confidential Information and personal data; and

WHEREAS, Service Provider Name: provides incident response, forensic and remediation services and is willing to provide such services under the terms of this Protocol; and

WHEREAS, the Parties desire to establish a coordinated, documented Incident Response Breach Protocol effective as of , to define responsibilities, timelines and costs associated with detection, containment, investigation and notification of Security Breaches.

Scope of Work

The Service Provider shall provide incident response services as required by an actual or suspected Security Breach, which shall include detection validation, containment, evidence preservation, forensic investigation, remediation planning and assistance with required notifications and post-incident review. Specific tasks, deliverables, and service levels are described below and in any appended Statement of Work.

Incident Detection, Notification and Escalation

Client shall notify Service Provider immediately upon detection or reasonable suspicion of a Security Breach. Service Provider shall acknowledge receipt and initiate triage within hours of notification.

Notification to affected individuals and regulatory authorities (if required) shall be coordinated per the Communication Plan below and, absent exigent circumstances, Client will prepare and approve any external notification prior to release. Initial regulatory notification timeline: within days of determination of a reportable breach.

Forensic Investigation, Evidence Preservation and Remediation

Service Provider will preserve volatile and persistent evidence, document chain of custody, and perform an investigation to identify root cause, scope of data affected, and recommended remediation. Preservation measures include imaging affected systems, collecting relevant logs, and securing evidence storage. Client shall not alter or destroy evidence without prior written direction from Service Provider.

Service Provider may engage a third-party forensic firm when necessary. Payment responsibility:

Communication Plan

Service Provider will provide status updates at least every hours during active incident response, and will prepare a written incident report within days after conclusion of the investigation.

Payment Terms

Late payments shall incur interest at per month after a grace period of days from invoice date.

Term and Termination

This Protocol commences on Start Date: and continues until End Date: unless earlier terminated as provided herein.

Either party may terminate for material breach if the breaching party fails to cure within the notice period above. Termination shall not relieve Client of payment obligations for services performed through the effective termination date nor for reasonable wind-down costs.

Confidentiality

Each party shall hold Confidential Information of the other in strict confidence and shall not disclose such information except to personnel and subcontractors with a need to know who are bound by confidentiality obligations at least as protective as those herein. Confidential Information excludes information that is (a) publicly known through no breach by the receiving party; (b) rightfully received from a third party without restriction; or (c) independently developed without use of the disclosing party's Confidential Information.

Upon termination or written request, the receiving party shall return or destroy Confidential Information and certify such destruction if requested, except where retention is required by applicable law or approved in writing.

Limitation of Liability and Indemnification

Each party shall indemnify, defend and hold harmless the other from third-party claims arising from its breach of this Protocol or its gross negligence or willful misconduct in connection with performance. EXCEPT FOR A PARTY'S LIABILITY FOR ITS INDEMNITY OBLIGATIONS, A PARTY'S AGGREGATE DIRECT LIABILITY UNDER THIS PROTOCOL SHALL NOT EXCEED THE GREATER OF (A) AMOUNTS PAID BY CLIENT TO SERVICE PROVIDER UNDER THIS PROTOCOL IN THE PRIOR TWELVE (12) MONTHS OR (B) ONE HUNDRED THOUSAND DOLLARS (USD 100,000).

Governing Law

This Protocol shall be governed by and construed in accordance with the laws of the State of without regard to conflict of laws principles.

Entire Agreement

This Protocol, together with any attachments and incorporated Statements of Work, constitutes the entire agreement between the Parties with respect to its subject matter and supersedes all prior and contemporaneous agreements, proposals and communications, whether written or oral. Any modification to this Protocol must be in writing and signed by authorized representatives of both Parties.

Acknowledgement

Each party represents and warrants that it has the authority to enter into this Protocol, and that the individuals signing below are authorized representatives. The Parties agree to cooperate in good faith to carry out the procedures described herein and to minimize harm resulting from any Security Breach.

Sign Now