Legal Email Security Addendum

LEGAL EMAIL SECURITY ADDENDUM

This Legal Email Security Addendum (the "Addendum") is entered into as of by and between Client Name: (hereinafter "Client") and Service Provider Name: (hereinafter "Provider"). This Addendum amends and supplements the existing agreement between the parties titled dated .

RECITALS

WHEREAS, Client and Provider exchange or transmit information by electronic mail and require controls to ensure the confidentiality, integrity and availability of email content and attachments; and

WHEREAS, Provider maintains services and infrastructure that send, receive, route, scan or store Client email and has represented that it will implement and maintain reasonable and industry-standard technical and organizational measures to protect such email; and

WHEREAS, the parties desire to set forth additional obligations and procedures relating to email security, incident response, audit and notification in order to reduce risk to Client data.

NOW THEREFORE

NOW THEREFORE, in consideration of the mutual promises and covenants contained herein and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:

1. DEFINITIONS

For purposes of this Addendum, the following capitalized terms shall have the meanings set forth below: "Email Data" means content, attachments, metadata and other information transmitted or stored through electronic mail systems on behalf of Client. "Incident" means any confirmed or reasonably suspected unauthorized access, disclosure, loss or alteration of Email Data.

2. SCOPE OF ADDENDUM

2.1 Applicability. This Addendum governs all Email Data exchanged between the parties and applies to Provider's personnel, subcontractors and agents who have access to such Email Data in the performance of Provider's obligations under the Base Agreement.

2.2 Services Covered. Services covered by this Addendum include email routing, hosting, filtering, archiving, scanning, delivery, or any feature that processes or stores Email Data. Provider shall identify services covered:

3. EMAIL SECURITY REQUIREMENTS

3.1 Transmission Security. Provider shall use industry-standard transport security to protect Email Data in transit. At a minimum Provider shall support and enforce Opportunistic or Forced Transport Layer Security (TLS) for SMTP sessions and shall implement forward secrecy where supported.

3.2 Message and Attachment Encryption. Provider shall implement encryption controls to protect Email Data at rest and, where required by Client, end-to-end encryption for message bodies and attachments. Encryption standards to be used:

3.3 Authentication and Anti-Spoofing. Provider shall publish and maintain, as applicable, SPF, DKIM and DMARC records and shall enforce validation and quarantine/rewriting policies for messages that fail authentication checks. Provider shall describe DNS and enforcement procedures:

3.4 Malware and Content Scanning. Provider shall implement malware detection, attachment scanning and anti-phishing controls with signature and behavioral detection. Provider will apply quarantining and blocking consistent with industry practice.

4. ACCESS CONTROL AND ACCOUNT MANAGEMENT

Provider shall implement least-privilege access controls for administrative interfaces, multi-factor authentication for privileged accounts, role-based access control and unique credentials for each user. Provider shall maintain an access log and shall promptly remove or suspend accounts upon termination or Change in access requirements.

5. INCIDENT RESPONSE AND NOTIFICATION

5.1 Incident Detection and Response. Provider shall maintain and operate an incident response program reasonably designed to detect, contain and remediate Incidents affecting Email Data. Provider shall document procedures for containment, eradication and recovery.

5.2 Notification Timing. Provider shall notify Client of any Incident involving Email Data within hours of confirmation and provide an initial report including the nature of the Incident, categories of Email Data affected, estimated number of impacted accounts, and corrective actions taken. Thereafter Provider shall provide regular updates until resolution.

5.3 Incident Report Content. Incident reports shall include: (a) summary of the Incident and timeline; (b) technical indicators; (c) data types affected; (d) remediation steps; and (e) measures to prevent recurrence.

6. AUDIT RIGHTS AND COMPLIANCE

6.1 Audit. Upon reasonable prior written notice and subject to confidentiality protections, Client shall have the right to audit Provider's controls as they relate to Email Data no more than . Provider shall cooperate and provide evidence of compliance, including third-party audit reports, logs, and artifacts.

6.2 Subprocessors. Provider shall obtain written agreement with any subcontractor performing services involving Email Data imposing obligations at least as protective as this Addendum. Provider remains liable for subcontractor compliance.

7. DATA RETENTION, RETURN AND DELETION

Provider shall retain Email Data only as necessary to provide services and in accordance with Client's retention policy:

Upon termination or written request, Provider shall securely return or irreversibly delete Email Data within days and certify completion in writing.

8. CONFIDENTIALITY

Email Data shall be considered Confidential Information of Client. Provider shall restrict disclosure to personnel with a need to know and shall use at least the same degree of care to protect such information as it uses to protect its own confidential information, but in no event less than reasonable care.

9. INDEMNIFICATION AND LIMITATION OF LIABILITY

9.1 Indemnity. Provider shall indemnify, defend and hold harmless Client from any third-party claims arising out of Provider's breach of this Addendum, including failure to implement agreed security controls.

9.2 Limitation. Except for liability arising from gross negligence, willful misconduct, or indemnity obligations in this Addendum, the parties' liability shall be governed by the limitation of liability provisions of the Base Agreement.

10. REPRESENTATIONS AND WARRANTIES

Provider represents and warrants that it shall perform its obligations hereunder in compliance with applicable law and with commercially reasonable security practices and procedures appropriate to the nature of Email Data.

11. NOTICES

Notices shall be given in writing and shall be deemed effective upon receipt when delivered personally, by nationally recognized overnight courier, or on the date of confirmed electronic transmission when sent to the designated notice contacts above.

12. AMENDMENT; WAIVER; COUNTERPARTS

Any amendment to this Addendum must be in writing and signed by authorized representatives of both parties. No failure or delay in exercising any right under this Addendum shall operate as a waiver.

This Addendum may be executed in counterparts, each of which shall be deemed an original and together constitute one instrument.

13. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

This Addendum shall be governed by and construed in accordance with the laws of the State of , without regard to conflicts of law principles.

This Addendum, together with the Base Agreement, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements and understandings relating thereto.

If any provision of this Addendum is held to be invalid or unenforceable, such provision shall be reformed only to the extent necessary to make it valid and enforceable, and the remaining provisions shall remain in full force and effect.

ADDITIONAL PROVISIONS

Sign Now