Legal CISO Agreement

LEGAL CHIEF INFORMATION SECURITY OFFICER (CISO) AGREEMENT

This Chief Information Security Officer Agreement ("Agreement") is entered into effective as of by and between Client Name: , a legal entity with principal place of business at (hereinafter "Company"), and CISO Name: , residing at (hereinafter "CISO").

RECITALS

WHEREAS, Company operates systems and processes that depend on confidential, proprietary, and regulated information and requires executive-level leadership to develop, implement, and maintain an enterprise information security program; and

WHEREAS, CISO represents that CISO has the qualifications, experience, and expertise to serve as Chief Information Security Officer and to perform the security leadership, policy development, incident response, risk management, and compliance obligations described in this Agreement; and

WHEREAS, Company desires to retain CISO to provide such services and CISO desires to provide such services on the terms and conditions set forth herein.

NOW, THEREFORE

In consideration of the mutual covenants contained herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:

1. APPOINTMENT

1.1 Appointment. Company hereby appoints CISO as its Chief Information Security Officer, and CISO accepts such appointment, to perform the duties and responsibilities set forth in this Agreement and such other duties as are reasonably assigned by the Chief Executive Officer or Board of Directors consistent with CISO's role.

1.2 Status. CISO shall perform services as: Employee    Independent Contractor. The parties shall select the applicable tax and benefits treatment on the signature page and as required by law.

2. TERM

2.1 Term. The initial term of this Agreement shall commence on the effective date specified above and continue for a period of unless earlier terminated in accordance with Section 9. Thereafter, this Agreement shall renew automatically for successive periods of unless either party provides written notice of non-renewal at least days prior to expiration.

3. DUTIES AND RESPONSIBILITIES

3.1 Core Responsibilities. CISO shall, to the extent reasonably necessary and appropriate for the role, (a) develop and maintain an enterprise information security strategy and program; (b) design and maintain risk management, vulnerability management, and incident response processes; (c) oversee security architecture and secure system design; (d) ensure compliance with applicable laws, regulations, and contractual security obligations; and (e) provide regular reports to executive management and the board regarding security posture, incidents, and remediation progress.

3.2 Authority. Company grants CISO reasonable authority to implement policies and require remediation actions across information systems subject to Company's governance processes. CISO shall not amend material corporate policies without written approval of the Chief Executive Officer or the Board.

4. COMPENSATION AND EXPENSES

4.1 Base Compensation. As full compensation for services, Company shall pay CISO a base annual compensation of , payable in accordance with Company's payroll practices or invoicing procedures as applicable.

4.2 Bonus and Equity. CISO may be eligible for performance-based bonuses or equity awards at the discretion of the Board. Any such awards shall be documented in a separate written award agreement that governs terms, vesting, and forfeiture.

4.3 Expenses. Company shall reimburse CISO for reasonable, documented business expenses incurred in the performance of duties in accordance with Company's policies upon submission of appropriate documentation within days.

5. CONFIDENTIALITY

5.1 Confidential Information. CISO acknowledges that during the term of this Agreement CISO will receive or have access to Confidential Information. "Confidential Information" includes trade secrets, customer data, security architecture, incident details, vulnerability reports, internal policies, and other non-public information. CISO shall hold Confidential Information in strict confidence and shall not disclose or use Confidential Information other than as necessary to perform duties under this Agreement.

5.2 Exceptions. Confidentiality obligations shall not apply to information that (a) is or becomes publicly known through no breach by CISO; (b) is rightfully received from a third party without restriction; or (c) is independently developed by CISO without use of Confidential Information. CISO may disclose Confidential Information to the extent required by law or valid legal process, provided CISO gives Company prompt written notice and cooperates with Company's efforts to limit or contest such disclosure.

6. INTELLECTUAL PROPERTY

6.1 Work Product. All inventions, discoveries, developments, enhancements, designs, analyses, reports, tools, processes, software, and other works of authorship conceived, reduced to practice, or created by CISO, alone or with others, in the course of performing obligations under this Agreement and related to Company's business or Confidential Information (collectively "Work Product") shall be the exclusive property of Company. CISO hereby assigns to Company all right, title, and interest in and to such Work Product and shall execute assignments reasonably necessary to effectuate ownership.

6.2 Preexisting Materials. CISO shall identify in writing any preexisting materials or background IP that CISO intends to use in the performance of services prior to such use. To the extent CISO incorporates background IP into Work Product, CISO grants Company a nonexclusive, royalty-free, perpetual license to use those portions as incorporated.

7. DATA SECURITY AND PRIVACY

7.1 Security Standards. CISO shall implement and maintain administrative, technical, and physical safeguards to protect information assets in accordance with accepted industry standards, applicable legal and regulatory requirements, and Company's policies. CISO shall promptly report security incidents to Company's designated incident response authority.

7.2 Incident Response. CISO shall lead and coordinate the Company's incident response activities, prepare post-incident reports, and recommend corrective actions. CISO shall preserve evidence, maintain chain of custody where required, and cooperate with lawful investigations.

8. NON-SOLICITATION AND NON-DISCLOSURE

8.1 Non-Solicitation. During the term of this Agreement and for a period of months thereafter, CISO shall not directly solicit for employment or engagement any employee or contractor of Company with whom CISO had material contact in the 12 months preceding termination.

8.2 Non-Disclosure Survives. The confidentiality obligations set forth in Section 5 and ownership provisions in Section 6 shall survive termination or expiration of this Agreement for a period of years, except for trade secrets which shall survive to the maximum extent permitted by law.

9. TERMINATION

9.1 Termination for Cause. Company may terminate this Agreement for cause effective immediately upon written notice if CISO commits a material breach of this Agreement, willful misconduct, gross negligence, willful violation of law, or acts that materially harm Company's business or reputation and such breach is not cured within thirty (30) days of written notice where curable.

9.2 Termination Without Cause. Either party may terminate this Agreement without cause upon days' prior written notice. In the event of termination by Company without cause, Company shall pay any earned but unpaid compensation and vested benefits in accordance with applicable plans, subject to offset for amounts owed to Company.

10. RETURN OF PROPERTY

Upon termination or expiration of this Agreement, CISO shall promptly return to Company all Company property, including documents, devices, credentials, and copies of Confidential Information, and shall certify in writing the return or destruction of such items within seven (7) days.

11. INDEMNIFICATION; INSURANCE

11.1 Indemnification. Company shall indemnify and hold harmless CISO from and against any third-party claims, liabilities, losses, and expenses arising out of or relating to CISO's performance of duties under this Agreement, except to the extent resulting from CISO's gross negligence, willful misconduct, or breach of this Agreement.

11.2 Insurance. Company shall maintain, at its expense, directors' and officers' liability and cyber liability insurance in commercially reasonable amounts and shall provide such coverage information to CISO upon reasonable request.

12. NOTICES

All notices, requests, consents, claims, demands, waivers and other communications hereunder shall be in writing and addressed to the parties at the addresses set forth below or to such other address that a party may designate in writing. Notices shall be delivered by hand, certified mail (return receipt requested), nationally recognized overnight courier, or email with confirmed receipt.

13. AMENDMENTS; WAIVER

No amendment, modification or supplement of this Agreement shall be valid unless in writing and signed by both parties. No waiver shall be effective unless set forth in a written instrument signed by the party granting the waiver. The failure of either party to enforce any provision shall not constitute a waiver of future enforcement of that or any other provision.

14. GOVERNING LAW; DISPUTE RESOLUTION

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to conflicts of law principles. Any dispute arising out of or relating to this Agreement shall be resolved by binding arbitration upon agreement of the parties; if arbitration is not agreed, the parties submit to the exclusive jurisdiction of the state and federal courts located in the county where Company's principal place of business is located.

15. ENTIRE AGREEMENT; SEVERABILITY; COUNTERPARTS

15.1 Entire Agreement. This Agreement, together with any exhibits and written award or assignment agreements expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior and contemporaneous agreements, representations and understandings.

15.2 Severability. If any provision of this Agreement is held invalid or unenforceable, the remainder of this Agreement shall continue in full force and effect and the parties shall negotiate in good faith to replace the invalid provision with a valid provision that, to the extent possible, effects the parties' intent.

15.3 Counterparts. This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Signatures transmitted by electronic means shall be binding.

MISCELLANEOUS

The parties acknowledge that CISO's duties may require access to privileged information and that CISO shall comply with Company's conflict of interest policies. CISO certifies that to the best of CISO's knowledge there are no existing obligations inconsistent with the performance of services under this Agreement.

Sign Now