Incident Response Policy Agreement

INCIDENT RESPONSE POLICY AGREEMENT

This Incident Response Policy Agreement ("Agreement") is made as of by and between Company Name: with principal address: and Service Provider Name: with principal address: .

RECITALS

WHEREAS, Company operates systems, networks, or services that process, store, or transmit Confidential Information and desires to establish a uniform incident response policy to address cybersecurity incidents, data breaches, and other security events; and

WHEREAS, Provider provides services and support to Company and has obligations to cooperate in the detection, containment, remediation, and reporting of security incidents affecting Company systems or Company data; and

WHEREAS, the parties wish to set forth their mutual responsibilities, notification timelines, evidence preservation procedures, and limits on liability in respect of incidents impacting the confidentiality, integrity, or availability of Company information or systems.

NOW, THEREFORE, in consideration of the mutual covenants contained herein, the parties agree as follows:

1. DEFINITIONS

1.1 "Incident" means any confirmed or reasonably suspected security event that compromises, or could compromise, the confidentiality, integrity, or availability of Company data or systems, including but not limited to unauthorized access, use, disclosure, modification, destruction, malware, ransomware, or denial of service attacks.

1.2 "Confidential Information" has the meaning set forth in the parties' underlying services agreement and includes personal data, proprietary information, and any other non-public information of Company.

2. SCOPE

2.1 This Agreement governs detection, notification, response, remediation, evidence preservation, communication, and post-incident review for Incidents that affect Company systems, networks, or Company Confidential Information where Provider's services, products, personnel, or subcontractors are implicated.

3. INCIDENT CLASSIFICATION

3.1 Incidents will be classified to prioritize response and resources. Classification determines notification timelines and escalation.

Critical — immediate threat to life, safety, or material business operations; significant data compromise.

High — material impact to operations or sensitive data exposure requiring accelerated response.

Medium — localized impact with limited exposure.

Low — minor events, low business impact, or false positives.

4. NOTIFICATION PROCEDURES

4.1 Company and Provider shall maintain current contact information for incident notifications. Provider shall notify Company of any Incident affecting Company within the timelines below and provide ongoing updates until resolution.

5. INCIDENT RESPONSE TEAM; ROLES AND RESPONSIBILITIES

5.1 Each party shall designate an Incident Response Team (IRT) and a Team Lead with authority to make remediation decisions. The Team Lead will coordinate all technical and business decisions related to an Incident.

6. CONTAINMENT, ERADICATION AND RECOVERY

6.1 The parties shall take reasonable and proportionate measures to contain the Incident, eradicate the root cause, and restore affected systems consistent with industry-accepted practices. Temporary containment measures may be implemented without prior approval if necessary to prevent further damage.

7. EVIDENCE PRESERVATION AND CHAIN OF CUSTODY

7.1 Both parties shall preserve logs, system images, and other potential evidence. Preservation shall be conducted in a manner that maintains an audit trail and chain of custody sufficient for internal, regulatory, or legal use.

8. REPORTING, COMMUNICATION AND EXTERNAL NOTIFICATIONS

8.1 Provider shall supply Company with timely, accurate incident reports containing material facts, remediation steps taken, evidence collected, and recommended follow-up actions. Company retains sole authority to determine external notifications to regulators, affected individuals, or partners.

9. THIRD-PARTY COOPERATION; PROVIDER OBLIGATIONS

9.1 Provider shall (a) promptly provide relevant logs and forensic artifacts; (b) permit Company or Company-approved forensic investigators to access systems for analysis; and (c) cooperate with regulatory or law enforcement requests as required by law.

Notify Company of any Incident within the timelines set forth in Section 4.

Provide access to logs, artifacts, and personnel to assist forensic investigation.

10. CONFIDENTIALITY

10.1 All information exchanged in connection with Incident response, including forensic findings and remediation plans, shall be treated as Confidential Information subject to the parties' confidentiality obligations. Disclosure is permitted only as required by law or with the disclosing party's written consent.

11. INDEMNIFICATION; LIMITATION OF LIABILITY

11.1 Provider shall defend, indemnify, and hold harmless Company from third-party claims arising from Provider's gross negligence or willful misconduct in connection with an Incident. The parties agree that neither party shall be liable for consequential, incidental, or punitive damages except in cases of willful misconduct or gross negligence.

12. INSURANCE

12.1 Provider shall maintain insurance appropriate for cyber liability, professional liability, and data breach coverage and shall provide proof of such insurance upon reasonable request.

13. AUDIT, TESTING AND TABLETOP EXERCISES

13.1 The parties shall jointly schedule and conduct periodic incident response tests, including tabletop exercises and technical drills, to validate procedures and readiness. Provider shall participate in at least the following frequency:

14. TRAINING

15. RECORDKEEPING; RETENTION

15.1 All incident records, reports, and evidence related to an Incident shall be retained in accordance with the parties' retention schedules and applicable law.

16. NOTICES

16.1 All notices required or permitted under this Agreement shall be in writing and delivered to the addresses below by certified mail, overnight courier, or email with confirmation to the designated incident contacts.

17. AMENDMENTS; WAIVER; COUNTERPARTS

17.1 No amendment or waiver of any provision of this Agreement will be effective unless in writing and signed by authorized representatives of both parties. Failure to enforce any provision does not constitute waiver. This Agreement may be executed in counterparts, each of which shall be deemed an original.

18. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

18.1 Governing Law: This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction specified in the parties' principal services agreement or, if none, the laws of the state where Company maintains its principal place of business.

18.2 Entire Agreement: This Agreement, together with any referenced appendices and the parties' underlying agreements, constitutes the entire understanding between the parties with respect to incident response and supersedes all prior agreements and understandings, whether written or oral.

18.3 Severability: If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall continue in full force and effect.

19. POST-INCIDENT REVIEW

19.1 Following closure of a material Incident, the parties shall conduct a joint post-incident review to identify root causes, lessons learned, and corrective actions. A written post-incident report will be prepared and delivered to designated contacts.

Sign Now