PCI Compliance Document

PCI Compliance Document

This PCI Compliance Document (the "Agreement") is entered into between the undersigned parties as of the Effective Date.

Effective Date:

Client Name:    Client Contact:

Service Provider Name:    Provider Contact:

RECITALS

WHEREAS, Service Provider is engaged in the business of performing Payment Card Industry Data Security Standard (PCI DSS) assessments, remediation planning and attestations for entities that store, process or transmit cardholder data; and

WHEREAS, Client operates systems and/or services that store, process or transmit cardholder data and desires to retain Service Provider to perform PCI compliance services and to provide written attestations or reports of compliance where applicable; and

NOW, THEREFORE, in consideration of the mutual covenants set forth below, the parties agree as follows.

SCOPE OF WORK

Deliverables shall include, at a minimum, a written assessment report describing findings, a remediation plan for identified deficiencies, and, if applicable, an attestation of compliance signed by an authorized representative of Service Provider.

PAYMENT TERMS

Late Payment: Client shall pay interest on overdue amounts at a rate of per month, or the maximum rate permitted by law, whichever is lower. Client is also responsible for reasonable collection costs, including attorney fees.

TERM AND TERMINATION

Term Commencement Date: . Term End Date:

Either party may terminate this Agreement for convenience upon written notice to the other party delivered at least days prior to the effective termination date. Either party may terminate immediately for material breach if the breaching party fails to cure such breach within thirty (30) days after receipt of written notice specifying the breach.

Termination shall not relieve Client of the obligation to pay for services rendered and expenses incurred through the effective date of termination.

CONFIDENTIALITY

Each party acknowledges that in the course of performance it may receive or have access to Confidential Information of the other party. "Confidential Information" includes, without limitation, cardholder data, assessment findings, security architecture, remediation plans, and any non-public business information. Each party shall: (a) use Confidential Information solely for performance under this Agreement; (b) restrict disclosure to employees, contractors or agents with a need to know and who are bound by confidentiality obligations at least as protective as those herein; and (c) implement and maintain appropriate administrative, technical and physical safeguards to protect Confidential Information from unauthorized access, use or disclosure.

Notwithstanding the foregoing, Confidential Information does not include information that is or becomes generally known to the public other than as a result of a breach of this Agreement, or is independently developed by the receiving party without use of the disclosing party’s Confidential Information. In the event of an actual or reasonably suspected breach affecting cardholder data, Service Provider shall notify Client promptly and cooperate in incident response and regulatory reporting as required.

ATTESTATION AND CERTIFICATIONS

Service Provider certifies that the assessment and any attestation will be conducted in accordance with applicable PCI DSS requirements and recognized industry assessment methodologies. Service Provider's attestation is based upon the representations and cooperation of Client and the accuracy of information provided by Client. Service Provider makes no guarantee that Client will achieve or maintain PCI compliance or that any payment card brand or acquiring bank will accept the attestation.

Service Provider attests that, to the best of its knowledge at the time of issuance, the assessment findings are accurate and complete: I attest.

LIMITATIONS; WARRANTIES

Service Provider warrants that services will be performed with reasonable care and in a professional manner consistent with industry standards. Except as expressly set forth in this Agreement, neither party makes any other warranties, express or implied, including any warranty of merchantability or fitness for a particular purpose.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to its conflict of law principles. The parties submit to the exclusive jurisdiction of state and federal courts located in that state for any disputes arising out of this Agreement.

INDEMNIFICATION

Each party shall indemnify, defend and hold harmless the other party and its officers, directors and employees from and against any third-party claims arising from the indemnifying party's gross negligence, willful misconduct or material breach of this Agreement. In the event of a data breach attributable to the negligence of Service Provider, Service Provider's indemnity obligations shall include reasonable costs of forensic investigation, notification and mitigation to the extent caused by Service Provider's acts or omissions.

ENTIRE AGREEMENT

This Agreement, together with any statements of work or exhibits expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior and contemporaneous agreements, proposals and communications, whether written or oral. Any amendment or modification must be in writing and signed by authorized representatives of both parties.

MISCELLANEOUS

If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect. Neither party may assign this Agreement without the other's prior written consent, except that Service Provider may assign to an affiliate or successor in interest.

Sign Now