Legal PCI-DSS Proposal Agreement

Legal PCI-DSS Proposal Agreement

This Legal PCI-DSS Proposal Agreement ("Agreement") is made as of between Service Provider Name: , having a principal place of business at , and Client Name: , having a principal place of business at . Together, the Service Provider and Client shall be referred to as the Parties.

RECITALS

WHEREAS, Service Provider is engaged in the business of providing security assessments, consulting and implementation services including services necessary to evaluate and assist in achieving Payment Card Industry Data Security Standard (PCI-DSS) compliance; and

WHEREAS, Client desires to obtain from Service Provider certain assessment, remediation, testing and attestation services described in this Agreement and in the Proposal attached as Exhibit A, and Service Provider is willing to provide such services subject to the terms and conditions set forth herein; and

WHEREAS, the Parties intend that the scope and terms described in this Agreement govern the performance of services, allocation of responsibilities and the exchange of confidential and cardholder data for purposes of achieving or maintaining PCI-DSS compliance.

NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth below, the Parties agree as follows:

1. DEFINITIONS

1.1 "Assessment" means any vulnerability scan, penetration test, on-site review, gap analysis or other evaluation performed by Service Provider to determine Client's compliance with PCI-DSS requirements.

1.2 "Attestation" means the written statement, report on compliance, or letter of attestation prepared by Service Provider or an authorized Qualified Security Assessor reflecting the results of an Assessment.

2. SCOPE OF SERVICES

2.1 Services. Service Provider shall perform the services described in the Proposal (Exhibit A) which may include: PCI-DSS gap analysis, internal and external vulnerability scanning, penetration testing, segmentation validation, remediation planning and verification, assistance with policy and procedure drafting, and preparation of an Attestation of Compliance (AOC) or Report on Compliance (ROC) where applicable.

2.2 Client Responsibilities. Client shall provide timely access to systems, personnel, facilities and documentation reasonably necessary for Service Provider to perform the Services. Client shall ensure that any third-party vendors under Client control required for the Assessment cooperate in a timely manner. Delays caused by Client will extend deadlines and may increase fees.

3. PROPOSAL, DELIVERABLES AND TIMELINE

3.1 Proposal Summary. The Parties agree the principal deliverables include: written gap analysis report, remediation plan, penetration test report, vulnerability scan reports, and final Attestation. Summarize special deliverables or exclusions below.

4. FEES AND PAYMENT

4.1 Fees. Client shall pay Service Provider the fees set forth in the Proposal. The initial assessment fee and any milestone fees are payable as described below. All fees are exclusive of applicable taxes and out-of-pocket expenses.

5. TERM AND TERMINATION

5.1 Term. This Agreement commences on the Effective Date and continues until the completion of the Services or earlier termination pursuant to this Section.

5.2 Termination for Convenience. Either Party may terminate this Agreement for convenience upon thirty (30) days' prior written notice. Client shall pay for Services performed and non-cancellable commitments made through the effective date of termination.

5.3 Termination for Cause. Either Party may terminate immediately for material breach if the breaching Party fails to cure such breach within fifteen (15) days after receiving written notice specifying the breach.

6. CONFIDENTIALITY AND DATA HANDLING

6.1 Confidential Information. Each Party agrees to hold in confidence all Confidential Information disclosed by the other Party. Confidential Information includes, without limitation, cardholder data, system architecture, network diagrams, and vulnerability reports.

6.2 Cardholder Data. Service Provider shall at all times handle cardholder data in accordance with PCI-DSS requirements. Service Provider shall implement administrative, physical and technical safeguards reasonably necessary to protect cardholder data and shall not store Primary Account Numbers (PANs) beyond what is necessary for the performance of the Services unless expressly authorized in writing.

6.3 Breach Notification. In the event of any unauthorized access or disclosure of cardholder data or other Confidential Information, Service Provider shall notify Client promptly, provide a written incident report, and cooperate with Client in investigation and remediation.

7. PCI-DSS COMPLIANCE OBLIGATIONS

7.1 No Guarantee of Certification. Service Provider will use commercially reasonable efforts to assist Client in achieving PCI-DSS compliance, but Service Provider does not guarantee that the Attestation or Report on Compliance will be accepted by any card brand, acquiring bank, or regulator. Final compliance determinations are made by the applicable card brands, acquirers, or Qualified Security Assessors as applicable.

7.2 Cooperation. Client acknowledges that attainment of compliance may require remediation, configuration changes, software updates, and third-party coordination. Client shall be responsible for implementing remediation and for providing evidence of remediation as reasonably requested by Service Provider.

8. WARRANTIES; DISCLAIMER

8.1 Mutual Warranties. Each Party represents and warrants that it has the full power and authority to enter into this Agreement, and that its performance will not violate any applicable law or third-party agreement.

8.2 Service Provider Warranty. Service Provider warrants that Services will be performed in a professional and workmanlike manner consistent with industry standards. Client's sole and exclusive remedy for breach of this warranty shall be re-performance of the defective Services at Service Provider's expense.

8.3 Disclaimer. EXCEPT AS EXPRESSLY PROVIDED HEREIN, SERVICE PROVIDER DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

9. INDEMNIFICATION

9.1 Client Indemnity. Client shall indemnify, defend and hold harmless Service Provider, its officers, directors and employees from any claims, losses, damages or liabilities arising out of Client's breach of this Agreement, Client's negligence, or Client's failure to implement recommended remediation.

9.2 Service Provider Indemnity. Service Provider shall indemnify and hold Client harmless from claims arising from Service Provider's willful misconduct or gross negligence in the performance of the Services.

10. LIMITATION OF LIABILITY

10.1 Exclusion of Consequential Damages. EXCEPT FOR LIABILITY ARISING FROM A PARTY'S GROSS NEGLIGENCE, WILLFUL MISCONDUCT, OR BREACH OF CONFIDENTIALITY OBLIGATIONS, NEITHER PARTY SHALL BE LIABLE TO THE OTHER FOR CONSEQUENTIAL, INCIDENTAL, SPECIAL OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS.

10.2 Liability Cap. EXCEPT FOR LIABILITY ARISING FROM A PARTY'S GROSS NEGLIGENCE, WILLFUL MISCONDUCT, OR INDEMNIFICATION OBLIGATIONS HEREUNDER, A PARTY'S AGGREGATE LIABILITY SHALL NOT EXCEED THE AMOUNTS PAID OR PAYABLE BY CLIENT TO SERVICE PROVIDER UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.

11. AUDIT, REPORTING AND RECORDS

11.1 Access for Audit. Upon reasonable notice, Client may request copies of Service Provider's work papers, scan reports and test results created in connection with the Services, subject to redaction of Service Provider's internal methodologies and trade secrets and subject to reasonable confidentiality protections.

11.2 Retention. Service Provider will retain working papers and remediation documentation for a commercially reasonable period and will provide archived reports to Client upon request for purposes reasonably related to PCI-DSS compliance verification.

12. NOTICES

All notices required or permitted under this Agreement shall be in writing and delivered to the contact persons and addresses set forth below. Notices shall be effective upon delivery if by hand, or three (3) business days after deposit in certified mail; email delivery shall be effective upon confirmation of receipt where email is agreed for notices.

13. AMENDMENTS, WAIVER, COUNTERPARTS

13.1 Amendment. This Agreement may be amended only by a writing signed by authorized representatives of both Parties.

13.2 Waiver. No waiver of any right or remedy under this Agreement shall be effective unless in writing and signed by the Party granting such waiver.

13.3 Counterparts. This Agreement may be executed in counterparts, each of which shall be an original and all of which together shall constitute one instrument.

14. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

14.1 Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the state or jurisdiction specified by the Parties below without regard to conflict of law principles.

14.2 Entire Agreement. This Agreement, including the Proposal and any exhibits, constitutes the entire agreement between the Parties with respect to the subject matter and supersedes all prior understandings and agreements.

14.3 Severability. If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

MISCELLANEOUS

15.1 Independent Contractors. The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture or agency relationship.

15.2 Subcontracting. Service Provider may engage subcontractors to perform portions of the Services provided Service Provider remains responsible for performance and compliance with this Agreement.

Sign Now