Legal Information Security Regulations

LEGAL INFORMATION SECURITY REGULATIONS

This Legal Information Security Regulations (the "Regulations") is entered into as of Effective Date: by and between Party A: whose principal address is , and Party B: whose principal address is .

RECITALS

WHEREAS, the parties process, store, or otherwise hold certain electronic and physical information that may include non-public personal information, confidential business information, and other regulated data (collectively, "Protected Information"); and

WHEREAS, the parties desire to establish uniform technical, administrative, and physical safeguards to protect the confidentiality, integrity and availability of Protected Information and to allocate responsibilities for security, incident response, compliance and audit with respect thereto; and

WHEREAS, the parties intend that these Regulations govern the parties' obligations with respect to information security for the duration set forth herein.

NOW, THEREFORE, in consideration of the mutual covenants and agreements contained herein, the parties agree as follows:

1. DEFINITIONS

For purposes of these Regulations, the following terms shall have the meanings set forth below. "Protected Information" means any information that is non-public, proprietary, personal data, or otherwise designated as confidential by either party. "Security Incident" means any confirmed or reasonably suspected event that jeopardizes the confidentiality, integrity or availability of Protected Information.

2. SCOPE AND APPLICABILITY

These Regulations apply to all systems, services, facilities and personnel of the parties that create, receive, maintain, or transmit Protected Information in connection with the parties' relationship. Unless otherwise agreed in writing, they apply to all processing whether performed internally or by subcontractors.

3. INFORMATION CLASSIFICATION

The parties shall classify information into at least the following categories and apply controls proportionate to risk: Personal: Confidential: Public: Additional categories or deviations must be documented in writing and approved by the designated security officer.

4. ACCESS CONTROLS AND AUTHENTICATION

Access to Protected Information shall be granted on a least-privilege, need-to-know basis. The parties shall maintain logon accounts and unique identifiers for authorized users, enforce password complexity and rotation policies, and deploy multi-factor authentication for remote or privileged access where feasible.

5. DATA HANDLING, TRANSMISSION AND ENCRYPTION

Protected Information in transit and at rest must be protected using industry-standard cryptographic mechanisms. Encryption at rest: , encryption in transit: . Where specific algorithms or key lengths are required, the parties shall comply with:

6. PHYSICAL SECURITY

Each party shall maintain reasonable physical safeguards to prevent unauthorized access to facilities, systems and media containing Protected Information, including personnel identification, visitor controls, and environmental protections appropriate to the sensitivity of the Protected Information.

7. PERSONNEL SECURITY AND TRAINING

Each party shall screen personnel with access to Protected Information to the extent permitted by law and shall provide regular security awareness and privacy training. Any personnel who violate these Regulations shall be subject to disciplinary action, up to and including termination.

8. INCIDENT RESPONSE AND BREACH NOTIFICATION

Upon discovery of a Security Incident affecting Protected Information, the discovering party shall: (a) promptly take reasonable steps to contain and mitigate the incident; (b) notify the other party without undue delay and in any event within hours of discovery; and (c) provide a written report describing the incident, affected data, remediation measures and recommended corrective actions. Notification shall not constitute an admission of liability.

9. AUDIT, MONITORING AND RECORDS

Either party shall have the right to audit or request evidence of compliance with these Regulations upon reasonable prior written notice. The parties agree to cooperate with audits and provide access to relevant records, logs and personnel subject to confidentiality protections. Audit request lead time: days.

10. SUBCONTRACTORS AND THIRD PARTIES

Use of subcontractors to process Protected Information is permitted only where the engaging party: (a) provides advance written notice to the other party; (b) imposes contractual obligations on the subcontractor equivalent to those in these Regulations; and (c) remains liable for the subcontractor's compliance. Require approval for new subcontractors: . Require flow-down of obligations:

11. RECORDS RETENTION

Protected Information shall be retained only as long as necessary to fulfill contractual or legal obligations. Minimum retention period (if any): . Upon expiry of retention periods, Protected Information shall be securely destroyed or irreversibly anonymized.

12. CONFIDENTIALITY

Each party shall treat Protected Information as confidential and shall not disclose it except as permitted under these Regulations or required by law, provided that the disclosing party gives prior notice where legally permissible and cooperates in any efforts to limit disclosure.

13. LIABILITY, INDEMNITY AND INSURANCE

Each party shall be liable for its own acts and omissions. To the extent permitted by law, the parties agree that liability for direct damages arising from a breach of these Regulations shall be capped at . Neither party shall be liable for indirect, incidental, consequential, special or punitive damages. Each party shall indemnify the other for third-party claims resulting from its failure to comply with these Regulations.

14. REMEDIES

Remedies for breach include injunctive relief, specific performance and recovery of damages. The exercise of one remedy shall not preclude the exercise of others. A party's failure to impose a remedy shall not constitute a waiver of rights.

15. TERM AND TERMINATION

These Regulations commence on the Effective Date and continue for the term of the parties' relationship unless earlier terminated for material breach after thirty (30) days' written notice and failure to cure. Sections that by their nature survive termination shall continue in effect.

16. GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State of , without regard to its conflict of laws principles.

17. NOTICES

Formal notices required under these Regulations shall be in writing and sent to the designated contact for each party set forth below or to any other address that a party designates by written notice.

18. AMENDMENTS AND WAIVER

No amendment to these Regulations shall be effective unless in writing and signed by authorized representatives of both parties. Waiver of any provision shall be effective only if in a signed writing and shall not constitute a waiver of any other provision or subsequent breach.

19. COUNTERPARTS

This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument. Facsimile or electronic signatures shall be deemed original signatures for purposes of validity and enforceability.

20. ENTIRE AGREEMENT; SEVERABILITY

These Regulations constitute the entire agreement between the parties with respect to the subject matter and supersede all prior discussions and agreements. If any provision is held invalid or unenforceable, the remaining provisions shall remain in full force and effect and the parties shall replace the invalid provision with a valid provision that most closely approximates the parties' intent.

ADDITIONAL SECURITY MEASURES

DESIGNATED SECURITY OFFICER

Sign Now