Legal VRA Appendix

LEGAL VRA APPENDIX

This VRA Appendix (the "Appendix") is made and entered into as of by and between Client Name: with principal address: , and Vendor Name: with principal address: .

RECITALS

WHEREAS, Client and Vendor are parties to a principal agreement under which Vendor provides certain services to Client (the "Agreement"), and the parties desire to set forth supplemental technical, security and compliance obligations related to the Vendor Risk Assessment program ("VRA");

WHEREAS, the parties intend that the requirements in this Appendix apply to all systems, processing activities and data flows that relate to the services identified below and that support Client's operations; and

WHEREAS, the parties desire to allocate responsibilities for security controls, incident reporting, audit and remediation rights, and disposition of Client data upon termination or expiration of the Agreement.

NOW, THEREFORE, in consideration of the mutual covenants herein and other good and valuable consideration, the sufficiency of which is acknowledged, the parties agree as follows:

1. DEFINITIONS

For purposes of this Appendix: "Client Data" means all electronic or physical data, records or information provided by Client to Vendor or collected, processed, stored or transmitted by Vendor on behalf of Client in connection with the Agreement. "Confidential Information" includes Client Data and other information reasonably identified as confidential. "Material Non-Compliance" means a failure to satisfy an express security, privacy or legal obligation in this Appendix that is not cured within the remediation period set forth herein.

2. SCOPE

This Appendix applies to the following services, systems and processing locations:

3. SECURITY REQUIREMENTS

3.1 Controls. Vendor shall implement and maintain administrative, technical and physical safeguards appropriate to the nature of Client Data and the risks presented, including, at minimum, access controls, encryption in transit and at rest, multi-factor authentication for privileged access, least-privilege principles for accounts, secure configuration management, and logging sufficient to support incident investigation and forensic analysis.

3.2 Encryption. Vendor shall employ industry-standard cryptographic controls to protect Client Data in transit and at rest. If encryption algorithms or key lengths change materially, Vendor shall provide prior written notice to Client and demonstrate equivalent or stronger protection.

3.3 Vulnerability Management and Patch Management. Vendor shall maintain a documented vulnerability management program, perform regular vulnerability scanning and remediation, and apply critical and high-severity patches in accordance with the remediation timelines set forth in Section 5.

4. COMPLIANCE FRAMEWORKS

Vendor represents that, for services covered by this Appendix, the following attestations or certifications apply (check all that apply):

SOC 2 Type II ISO 27001 HIPAA Other

5. INCIDENT REPORTING AND REMEDIATION

5.1 Notification. Vendor shall notify Client of any actual or reasonably suspected security incident affecting Client Data no later than hours after detection. Notification shall include a description of the incident, impact assessment, remedial actions taken to date, and proposed remediation plan.

5.2 Remediation. Vendor shall implement temporary containment measures promptly and complete remediation within days, unless a longer timeframe is agreed in writing by Client. Material Non-Compliance that remains uncured within the remediation period shall entitle Client to exercise remedies under Section 8.

6. AUDIT RIGHTS AND ASSESSMENTS

6.1 Audit Rights. Client shall have the right, at its expense and upon reasonable prior notice, to conduct on-site or remote audits, assessments and reviews necessary to verify Vendor's compliance with this Appendix. Vendor shall reasonably cooperate, provide relevant documentation, and grant access to systems and personnel as necessary to perform the audit.

6.2 Third-Party Reports. In lieu of an on-site audit, Vendor may provide recent third-party audit reports, certifications, or SOC/assessment reports, together with a written attestation that no material exceptions exist or that any exceptions have been remediated in accordance with an agreed plan.

7. SUBCONTRACTORS

Vendor shall not engage any subcontractor to process Client Data without Client's prior written consent. Vendor shall remain fully liable for the acts and omissions of its subcontractors and shall impose on each subcontractor obligations no less protective than those set forth in this Appendix.

8. DATA RETURN, DESTRUCTION AND TRANSITION

Upon termination or expiration of the Agreement, Vendor shall, within days, return to Client all Client Data in a mutually agreed format and securely delete or destroy residual copies. If immediate return is not reasonably feasible, Vendor shall preserve Client Data and provide continued protection in accordance with this Appendix until return or secure destruction is completed.

9. REMEDIES; TERMINATION

In the event of Material Non-Compliance, Client may (a) require immediate corrective action, (b) suspend performance by Vendor pending cure, (c) terminate the Agreement for cause if Vendor fails to cure within the remediation period, and (d) seek any other remedies available at law or equity. Remedies are cumulative and not exclusive.

10. INDEMNIFICATION

Vendor shall indemnify, defend and hold harmless Client and its officers, directors and employees from and against any third-party claims, losses, damages, liabilities and expenses (including reasonable attorneys' fees) arising out of Vendor's breach of its obligations under this Appendix, including unauthorized access to or disclosure of Client Data resulting from Vendor's acts or omissions.

11. LIMITATION OF LIABILITY

Except for liability arising from (i) willful misconduct, (ii) gross negligence, (iii) Vendor's breach of its confidentiality or data protection obligations, or (iv) indemnification obligations under this Appendix, neither party shall be liable for consequential, incidental, special or punitive damages. The parties agree that the limitations of liability in the Agreement shall apply to claims arising under this Appendix, subject to the foregoing exceptions.

12. NOTICES

Notices under this Appendix shall be provided to the following contacts by the method specified in the Agreement:

13. AMENDMENTS; WAIVER; COUNTERPARTS

This Appendix may be amended only by a written instrument signed by authorized representatives of both parties. No waiver of any provision shall be effective unless in writing and signed by the party against whom the waiver is asserted. This Appendix may be executed in counterparts, each of which shall be an original and all of which together shall constitute one instrument.

14. GOVERNING LAW; SEVERABILITY; ENTIRE AGREEMENT

This Appendix shall be governed by and construed in accordance with the laws specified in the Agreement. If any provision of this Appendix is held invalid or unenforceable, the remaining provisions shall remain in full force and effect. This Appendix, together with the Agreement, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous understandings.

15. CERTIFICATION

Vendor certifies that the representations and commitments set forth herein are true and accurate as of the Effective Date and will be maintained throughout the term of the Agreement. Vendor acknowledges that breach of these obligations may cause Client to suffer irreparable harm and that remedies at law may be inadequate.

Sign Now