Legal CII CT Presence Agreement

LEGAL CII CT PRESENCE AGREEMENT

This CII CT Presence Agreement ("Agreement") is entered into as of by and between Client Name: , with principal address: (hereinafter "Client"), and Provider Name: , with principal address: (hereinafter "Provider").

Recitals

WHEREAS, Client operates or owns critical infrastructure systems and related information technology and control system assets that require specialized cybersecurity presence and control‑system expertise; and

WHEREAS, Provider maintains a Cyber Threat / Cybersecurity Team ("CII CT Team") experienced in on‑site and remote presence for monitoring, assessment, incident response and testing of critical infrastructure; and

WHEREAS, Client desires to permit Provider and the CII CT Team limited presence and access to specified systems and premises under the terms set forth in this Agreement and Provider agrees to provide such presence under the terms herein.

Now Therefore

NOW THEREFORE, in consideration of the mutual covenants and agreements contained herein and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows.

1. Definitions

1.1 "Presence" means Provider personnel physical or virtual presence at Client premises, network access, privileged access to control systems, remote monitoring sessions, or any activity requiring elevated credentials to observe, test, or respond to cyber or operational events.

1.2 "Covered Systems" means the systems, networks, and assets specifically identified in Section 2 and in any Schedule A attached hereto that are subject to Provider presence or access.

2. Scope of Presence and Access

2.1 Provider is authorized to have Presence at the following Client locations and systems:

2.2 The Covered Systems to be included under this Agreement are described as follows:

2.3 The authorized modality for Presence (check all that apply):

3. Personnel, Credentials and Vetting

3.1 Provider shall ensure that all personnel assigned to perform Presence duties are appropriately qualified, hold required clearances, and have undergone background checks reasonably acceptable to Client. Provider shall provide names and credentials of assigned personnel upon request prior to initial access:

3.2 Provider shall ensure that all access credentials are uniquely assigned, logged, and revoked immediately upon termination of the individual's assignment or upon expiration or termination of this Agreement.

4. Security, Compliance and Operational Controls

4.1 Provider shall comply with Client's site security rules and technical security specifications, including but not limited to network segmentation, least privilege access, multi‑factor authentication where required, logging, and agreed change control procedures.

4.2 Provider shall not alter production control system configurations, introduce unapproved software or devices, or execute tests that may disrupt operations without prior written authorization from Client's designated authority.

5. Confidentiality and Data Handling

5.1 Provider acknowledges that all information obtained through Presence, whether technical, operational, or business in nature, is Confidential Information of Client. Provider shall hold such Confidential Information in strict confidence and use it solely for the purpose of performing Provider's obligations under this Agreement.

5.2 Provider shall implement and maintain administrative, physical and technical safeguards appropriate to the sensitivity of the Confidential Information, including encryption in transit and at rest where applicable, and shall not retain copies beyond the period necessary to perform Services without Client's written consent.

6. Incident Identification and Reporting

6.1 Provider shall report any suspected or confirmed security incidents, data breaches, or operational impacts discovered during Presence to Client's Incident Contact within the shorter of twenty‑four (24) hours of discovery or as otherwise required by applicable law.

7. Liability; Indemnification

7.1 Provider shall indemnify, defend and hold harmless Client and its officers, directors and employees from and against any third party claims, liabilities, losses, damages, costs and expenses (including reasonable attorneys' fees) arising out of Provider's gross negligence, willful misconduct or material breach of this Agreement, provided that Client provides prompt written notice of any claim and cooperates in the defense of the claim.

7.2 Except for liability arising from Provider's gross negligence, willful misconduct or breach of Section 5 (Confidentiality), neither party shall be liable to the other for consequential, incidental, special or punitive damages.

8. Insurance

8.1 Provider shall maintain at its expense commercial general liability insurance and professional liability / cyber liability insurance in amounts sufficient to cover its obligations under this Agreement. Minimum coverages required are set forth below and Provider shall furnish certificates of insurance upon Client request.

9. Term and Termination

9.1 Term. The initial term of this Agreement shall commence on and shall continue until unless earlier terminated in accordance with this Agreement.

9.2 Termination for Convenience. Either party may terminate this Agreement for convenience upon thirty (30) days' written notice to the other party.

9.3 Immediate Termination. Client may immediately suspend or terminate Provider's Presence if Provider's actions create an immediate risk to safety or continuity of Client operations, without prejudice to any rights or remedies available to Client.

10. Fees and Expenses

10.1 Fees. Client shall pay Provider the fees for Presence as set forth in Schedule B or as mutually agreed in writing. If fees are hourly, the hourly rate is:

10.2 Expenses. Client shall reimburse Provider for pre‑approved travel and out‑of‑pocket expenses incurred in connection with on‑site Presence upon submission of reasonable documentation.

11. Notices

All notices required or permitted under this Agreement shall be in writing and delivered to the addresses below by certified mail, courier, or email (with confirmation). Notices shall be effective upon receipt.

12. Amendments; Waiver; Counterparts

12.1 No amendment to this Agreement shall be effective unless in writing and signed by authorized representatives of both parties. No failure or delay in exercising any right shall operate as a waiver of that right.

12.2 This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Facsimile or electronic signatures shall be binding for all purposes.

13. Governing Law; Entire Agreement; Severability

13.1 Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the State of , without regard to conflict of laws principles.

13.2 Entire Agreement. This Agreement, including any Schedules and attachments, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements and understandings, whether written or oral.

13.3 Severability. If any provision of this Agreement is determined to be invalid, illegal or unenforceable, the remainder of this Agreement shall remain in full force and effect and the parties shall negotiate in good faith a substitute provision that most nearly preserves the parties' original intent.

Schedule of Additional Terms (Optional)

Specify additional procedural or technical constraints, special hours of presence, or other agreed limitations below:

Sign Now