Legal MDR Agreement

LEGAL MDR AGREEMENT

This Managed Detection and Response Agreement (the "Agreement") is entered into as of Effective Date: by and between Provider Name: , Provider Address: , and Client Name: , Client Address: .

RECITALS

WHEREAS, Provider operates and maintains managed detection and response services including threat monitoring, alerting, investigation, and remediation assistance (collectively, the "Services"); and

WHEREAS, Client desires to engage Provider to provide the Services with respect to Client's designated systems and network assets under the terms and conditions set forth herein; and

WHEREAS, Provider agrees to perform the Services pursuant to the terms of this Agreement and any applicable schedules or statements of work executed by the parties.

NOW, THEREFORE, in consideration of the mutual promises set forth herein, the parties agree as follows:

1. DEFINITIONS

For purposes of this Agreement, the following terms shall have the meanings set forth below: "Services" means the managed detection and response services described in Section 2; "Incident" means an adverse event that materially compromises the confidentiality, integrity, or availability of Client Systems or Client Data; "Client Data" means data provided by or collected from Client in connection with the Services; and "Confidential Information" includes nonpublic information exchanged by the parties as further described in Section 6.

2. APPOINTMENT AND SCOPE OF SERVICES

2.1 Appointment. Client hereby engages Provider, and Provider accepts such engagement, to perform the Services described in this Agreement and any executed statement of work. Provider shall exercise commercially reasonable skill and care in the performance of the Services consistent with industry practice.

2.2 Service Hours and Coverage. Provider shall monitor Client Systems during the hours set forth in the applicable statement of work. Standard monitoring coverage: . Provider's obligations do not include on-site remediation unless expressly agreed in writing.

2.3 Service Levels. Provider will use commercially reasonable efforts to meet response targets as follows: Critical incidents response within , High within . Service credits, if any, are the sole remedy for failure to meet service levels as set out in an applicable schedule.

3. TERM AND TERMINATION

3.1 Term. The initial term of this Agreement shall commence on Effective Date and continue for months (the "Initial Term"). Thereafter the Agreement shall automatically renew for successive twelve (12) month terms unless either party provides written notice of non-renewal at least days prior to the end of the then-current term.

3.2 Termination for Cause. Either party may terminate this Agreement for material breach by the other party if the breaching party fails to cure within thirty (30) days after receipt of written notice specifying the breach. Termination shall not relieve Client of its obligation to pay for Services performed prior to termination.

4. FEES AND PAYMENT

4.1 Fees. Client shall pay Provider the fees set forth in the applicable statement of work or invoice. Monthly recurring fee: $.

4.2 Payment Terms. Invoices are payable within days of invoice date. Late payments accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law.

5. CONFIDENTIALITY

5.1 Each party shall maintain the confidentiality of the other party's Confidential Information using at least the same degree of care as it uses for its own confidential information, but in no event less than a reasonable standard of care. Confidential Information may only be used for the performance of this Agreement.

5.2 Exceptions. Confidential Information does not include information that: (a) was known to recipient without obligation of confidentiality prior to disclosure; (b) is or becomes publicly available through no fault of recipient; or (c) is lawfully obtained from a third party without confidentiality obligation.

6. DATA SECURITY AND HANDLING

6.1 Security Measures. Provider shall implement and maintain administrative, physical, and technical safeguards designed to protect Client Data against unauthorized access, disclosure, alteration or destruction consistent with industry standards for managed detection and response providers.

6.2 Data Retention. Provider will retain Client Data only for the period necessary to provide the Services and as otherwise required by law or as agreed in writing. Upon expiration or termination, Provider will return or securely destroy Client Data in accordance with Client's reasonable instructions.

7. INCIDENT RESPONSE AND NOTICE

7.1 Notification. Provider will notify Client of known or suspected security incidents involving Client Data within of discovery and will provide reasonable details concerning the incident and Provider's mitigation steps.

8. LIABILITY, LIMITATIONS AND INDEMNIFICATION

8.1 Limitation of Liability. Except for liability arising from willful misconduct, gross negligence, or Provider's breach of confidentiality obligations, neither party shall be liable for indirect, incidental, consequential, punitive, or special damages, including lost profits, even if advised of the possibility of such damages. Provider's aggregate liability for claims arising under this Agreement shall not exceed the fees paid by Client to Provider under this Agreement during the twelve (12) month period preceding the claim.

8.2 Indemnification. Provider shall defend, indemnify and hold Client harmless from and against third-party claims to the extent such claims arise from Provider's negligent acts or willful misconduct in performing the Services. Client shall defend, indemnify and hold Provider harmless from and against third-party claims arising out of Client's misuse of the Services or Client Data.

9. AUDIT RIGHTS; REPORTING

9.1 Audit. Client may, upon reasonable prior written notice and no more than once annually (unless a material security concern exists), audit Provider's relevant records and controls related to the Services during normal business hours. Audits shall be conducted in a manner that does not unreasonably interfere with Provider's business operations.

9.2 Reporting. Provider will provide periodic reports summarizing alerts, investigations, and remediation recommendations as set forth in the applicable statement of work.

10. INSURANCE

Provider shall maintain at its expense commercially reasonable insurance coverage appropriate for a managed security service provider, including professional liability/errors and omissions and cyber liability insurance, with limits sufficient to cover its obligations under this Agreement.

11. COMPLIANCE WITH LAWS

Each party shall comply with all applicable laws, rules and regulations in the performance of its obligations under this Agreement. Provider shall notify Client if Provider becomes aware of any legal requirement that would materially affect Provider's ability to provide the Services.

12. NOTICES

All notices required or permitted under this Agreement shall be in writing and delivered to the addresses set forth below or to such other address as a party may designate by notice in accordance with this Section.

13. AMENDMENT; WAIVER

This Agreement may be amended only by a written instrument signed by authorized representatives of both parties. No waiver of any provision shall be effective unless in writing and signed by the waiving party.

14. GOVERNING LAW; VENUE

This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction specified below without regard to conflict of law principles. The parties consent to the exclusive jurisdiction of the courts located in that jurisdiction for the resolution of disputes.

15. ENTIRE AGREEMENT; SEVERABILITY

This Agreement, including any schedules and statements of work expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior oral or written understandings. If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

16. COUNTERPARTS

This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Electronic or facsimile signatures shall be deemed binding.

Sign Now