Incident Response Support Plan

INCIDENT RESPONSE SUPPORT PLAN

RECITALS

This Incident Response Support Plan (the "Plan") is entered into by and between Service Provider: and Client Name: .

WHEREAS, Service Provider maintains staffed incident response capabilities, technical expertise, and processes to investigate, contain, remediate, and report information security incidents; and

WHEREAS, Client desires to retain Service Provider to provide incident response support services under the terms and conditions set forth in this Plan; and

WHEREAS, the parties agree to define scope, service levels, fees, confidentiality obligations and procedures for engagement of incident response services as set forth below.

OBJECTIVE

The objective of this Plan is to establish the services, response levels, responsibilities and contractual terms by which Service Provider will provide incident response support to Client in the event of a suspected or confirmed security incident.

SCOPE OF WORK

INCIDENT CLASSIFICATION & RESPONSE LEVELS

Incidents will be classified by severity. Service Provider's initial prioritization and recommended actions will be consistent with industry practice and the particulars provided by Client.

Critical — widescale service outage, active data exfiltration or confirmed major breach.
High — localized outage, confirmed intrusion with limited scope.
Medium — suspected intrusion, anomalous activity requiring containment.
Low — investigative or advisory support only.

SERVICES AND DELIVERABLES

Services to be provided may include remote incident triage, containment guidance, forensic data collection coordination, malware analysis, eradication guidance, recovery support, and preparation of an incident report.

SERVICE LEVELS

Initial response time is the elapsed time from Client notification to initial analyst contact or assignment of incident to an on-call responder.

24/7 emergency support:

CLIENT RESPONSIBILITIES

PAYMENT TERMS

Client will pay Service Provider for the services and deliverables in accordance with the following fees and schedule.

TERM AND TERMINATION

This Plan commences on Effective Date and continues until terminated in accordance with this section.

Effective Date:

Term End Date:

Either party may terminate this Plan for material breach if the breaching party fails to cure within the stated notice period following written notice. Termination does not relieve Client of payment obligations for services performed prior to termination.

CONFIDENTIALITY

Each party will keep confidential all non-public information disclosed by the other party in connection with this Plan that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure ("Confidential Information"). Confidential Information excludes information that is (a) publicly known other than by breach of this Plan; (b) rightfully received from a third party without restriction; or (c) independently developed without access to the disclosing party's Confidential Information.

Service Provider may disclose Confidential Information to subcontractors and personnel strictly on a need-to-know basis, provided Service Provider remains responsible for such persons' compliance with confidentiality obligations. Confidential Information containing personal data or business-critical information shall be handled and returned or securely destroyed upon Client's request following the conclusion of incident response activities, to the extent permitted by law and forensic obligations.

LIMITATION OF LIABILITY & INDEMNIFICATION

Except for willful misconduct or gross negligence, neither party will be liable for incidental, consequential, indirect or punitive damages. Service Provider's aggregate liability arising from or relating to this Plan will not exceed the total fees paid by Client to Service Provider under this Plan in the twelve months preceding the claim.

Client will indemnify, defend and hold harmless Service Provider and its personnel from third-party claims arising from Client's use of services, Client's negligence, or Client's failure to follow Service Provider's reasonable containment and remediation instructions.

GOVERNING LAW

This Plan will be governed by and construed in accordance with the laws of , without regard to conflict of law principles.

ENTIRE AGREEMENT

This Plan, together with any executed statement of work, fee schedule or appendix expressly incorporated herein, constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior agreements, proposals and communications, whether written or oral.

CONTACTS FOR INCIDENT NOTIFICATION

MISCELLANEOUS

Any amendments to this Plan must be in writing and signed by authorized representatives of both parties. If any provision is found unenforceable, the remainder of the Plan will remain in effect.

Sign Now