Information Protection Plan

INFORMATION PROTECTION PLAN AND SERVICES AGREEMENT

Parties and Recitals

This Information Protection Plan and Services Agreement (the "Agreement") is entered into as of by and between:

WHEREAS, Client collects, processes, and stores certain non-public and sensitive information (collectively, "Protected Information") in connection with its business operations; and

WHEREAS, Provider has expertise in information security, risk management, and data protection and is willing to provide services to implement, maintain, and monitor an Information Protection Plan described herein; and

NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth below, the parties agree as follows.

Scope of Work

Provider shall develop, implement, and maintain the Information Protection Plan for Client which includes, without limitation, the following elements and services described in detail below.

The Scope of Work shall include, at minimum: inventory and classification of data, access control policies and role assignments, encryption and key management strategy, incident response planning and testing, employee security awareness training, third-party vendor oversight, retention and secure disposal procedures, and periodic audits and reporting.

Data Inventory and Classification

Access Controls and Authentication

Access to Protected Information will be limited to authorized personnel on a need-to-know basis. Provider will implement and maintain the following controls as applicable:

Role-based access controls
Multi-factor authentication for privileged accounts
Principle of least privilege and periodic access reviews

Encryption and Key Management

Provider agrees to implement commercially reasonable encryption for Protected Information in transit and at rest and to implement key management procedures to protect cryptographic keys from unauthorized access.

Incident Response

Provider shall maintain an incident response plan that provides for timely detection, containment, eradication, and recovery from security incidents affecting Protected Information. Provider shall notify Client in accordance with the notification provisions below.

Training and Awareness

Provider will provide regular security awareness training to identified personnel responsible for handling Protected Information. Training will cover secure handling, phishing awareness, data minimization, and reporting suspected incidents.

Vendor and Third-Party Management

Audits and Reporting

Provider shall provide periodic reports of security posture and remediation activities and shall permit Client or an agreed-upon independent auditor to perform audits of controls subject to reasonable notice and scope limitations as set forth below.

Client's right to audit is subject to reasonable confidentiality protections for Provider's proprietary information and shall not unreasonably disrupt Provider's operations.

Record Retention and Secure Disposal

Payment Terms

Client shall pay Provider for the services described in this Agreement in accordance with the following terms.

All fees are exclusive of taxes or duties, which shall be the responsibility of Client unless otherwise required by law. Provider may suspend services for nonpayment after providing written notice and a minimum of ten (10) days to cure past due amounts.

Term and Termination

This Agreement shall commence on and shall continue until unless earlier terminated as provided herein.

Either party may terminate this Agreement for material breach by the other party if the breach is not cured within thirty (30) days after written notice. Termination shall not relieve either party of payment obligations accrued prior to termination.

Confidentiality

For the purposes of this Agreement, "Confidential Information" means any non-public information disclosed by either party to the other that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and circumstances of disclosure, including Protected Information. Confidential Information excludes information that (i) is or becomes generally known to the public through no fault of the receiving party, (ii) was rightfully known to the receiving party prior to disclosure, (iii) is rightfully obtained from a third party without breach of any obligation owed to the disclosing party, or (iv) is independently developed by the receiving party without use of or reference to the disclosing party's Confidential Information.

Each party shall protect the other's Confidential Information with at least the same degree of care it uses to protect its own confidential information, but in no event less than a reasonable degree of care, and shall not use Confidential Information except to perform its obligations under this Agreement. Upon termination, the receiving party shall return or securely destroy Confidential Information as directed by the disclosing party and certify destruction upon request.

Breach Notification

In the event of a confirmed security incident materially affecting Client's Protected Information, Provider shall notify Client without undue delay and, where feasible, within seventy-two (72) hours of discovery. Provider shall cooperate with Client in investigation, regulatory notifications where required by law, and required remediation actions.

Limitation of Liability

Except for breaches of confidentiality or willful misconduct, neither party shall be liable to the other for consequential, indirect, incidental, punitive or special damages. Provider's aggregate liability arising under this Agreement shall not exceed the total fees paid by Client to Provider under this Agreement during the twelve (12) months preceding the claim, except as otherwise required by applicable law.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction indicated below, without regard to conflict of law principles.

Entire Agreement; Amendments

This Agreement, including any exhibits or attachments, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements and understandings. No amendment or modification shall be effective unless in writing and signed by authorized representatives of both parties.

Miscellaneous Provisions

If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect. Neither party may assign this Agreement without the prior written consent of the other, except to a successor in interest in connection with a merger, acquisition, or sale of substantially all assets.

Acceptance and Implementation

By signing below, the parties acknowledge that they have read, understood, and agree to be bound by the terms of this Agreement and authorize Provider to begin implementation of the Information Protection Plan in accordance with the Scope of Work and schedule set forth herein.

Sign Now