Information Security Committee Guidelines

INFORMATION SECURITY COMMITTEE GUIDELINES

Recitals

WHEREAS, Organization Name: recognizes the need to establish governance, oversight and operational guidance for information security consistent with its business objectives and regulatory obligations;

WHEREAS, the parties intend to constitute an Information Security Committee (the "Committee") to define responsibilities, accept risk, oversee security programs, and ensure timely remediation of security findings effective on Effective Date: ;

WHEREAS, these Guidelines set forth the Committee's scope, authority, membership, reporting obligations and operating procedures and, where applicable, the terms under which services related to committee activities are procured and compensated.

Scope of Work

The Committee shall provide governance and oversight as described below and as further detailed in the operational charters and supporting policies.

Committee Composition and Appointments

The Committee shall consist of representatives appointed by the Organization, including executive, technical, and legal representation. Number of members: . Member term (months): .

Chair IT Representative Legal Representative Compliance Representative External Advisor Other

Meetings and Quorum

Meetings will be held with the following cadence: . Quorum for official action requires the lesser of a majority of appointed members or Minimum number: members. Notice to members: days prior to meeting for routine matters.

Responsibilities

The Committee is responsible for oversight of information security strategy, risk acceptance decisions, approval of major security initiatives, review of security assessments, and escalation to executive management. Specific responsibilities include the following:

Reporting and Escalation

The Committee shall produce written minutes and periodic reports to executive leadership. Material incidents, findings that exceed risk thresholds, or unresolved remediation items must be escalated in writing within Escalation timeframe (days): days.

Decision-Making

Committee decisions shall be made by majority vote of members present at a meeting with quorum, unless a higher threshold is required by policy. Voting threshold (percentage): . In the event of a tie, the Chair shall cast the deciding vote.

Information Handling and Confidentiality

Committee members will have access to sensitive and confidential information. All members must adhere to the Organization's confidentiality obligations and applicable data protection requirements. Members shall not disclose confidential information except as required for legitimate Committee duties or as required by law. Breach of confidentiality may result in removal from the Committee and other remedies.

Security Assessments and Audit

The Committee shall oversee periodic security assessments, penetration tests, and audits. Assessment frequency: . Remediation target: days from formal acceptance of findings.

Payment Terms

If the Organization engages external service providers or consultants under these Guidelines, the following payment provisions apply.

Late payments shall accrue a late fee of Late fee (percent): per month on overdue balances, or the maximum permitted by applicable law, whichever is less. Invoices shall be submitted to the Organization's accounts payable in accordance with invoicing procedures.

Term and Termination

These Guidelines shall commence on Start Date: and continue until End Date: unless earlier terminated in accordance with this section. Either party may terminate upon written notice not less than Notice period (days): days, except that termination for material breach may be immediate where permitted by law.

Conflict of Interest

Committee members shall disclose any actual or potential conflicts of interest. Disclosure must be made in writing and included in Committee records. Material conflicts may require recusal or removal.

Amendments and Review

These Guidelines may be amended only by a written instrument signed by authorized representatives of the Organization and the Committee. Review interval (months): for periodic reassessment of the Guidelines.

Governing Law

These Guidelines shall be governed by and construed in accordance with the laws of State: without regard to conflict of law principles.

Entire Agreement

These Guidelines, together with any referenced charters, policies and executed statements of work, constitute the entire agreement between the Organization and the Committee regarding the subject matter herein, and supersede all prior or contemporaneous understandings, agreements, representations and warranties, whether written or oral, relating to the subject matter.

Miscellaneous Provisions

If any provision of these Guidelines is held invalid or unenforceable, the remaining provisions shall continue in full force and effect. Waiver of any breach must be in writing and signed by an authorized representative.

Sign Now