Policy Compliance Template

POLICY COMPLIANCE AGREEMENT

This Policy Compliance Agreement ("Agreement") is entered into by and between Client Name: and Provider Name: on Effective Date: .

RECITALS

WHEREAS, Client maintains policies, standards and procedures governing information security, data protection, confidentiality, and acceptable use (collectively, "Client Policies"); and

WHEREAS, Provider provides services to Client and, in connection with such services, may access Client information and systems and therefore must comply with Client Policies; and

WHEREAS, the parties wish to set forth the obligations, attestations, and remedies related to Provider's compliance with the Client Policies.

SCOPE OF WORK

POLICIES COVERED & ATTESTATIONS

Provider attests that it has reviewed and will comply with the following Client Policies during performance of the Scope of Work (check all that apply):

Information Security Policy

Data Privacy and Protection Policy

Acceptable Use Policy

Incident Response and Breach Notification Policy

Provider further certifies that personnel performing services have received training necessary to comply with the checked policies and that records of such training will be maintained for a period of years.

AUDIT, REPORTING & CORRECTIVE ACTION

Client shall have the right, upon reasonable notice and during normal business hours, to audit Provider's compliance with the Client Policies and this Agreement. Provider shall fully cooperate with any reasonable audits, provide requested records, and implement corrective actions within days of written notice of noncompliance.

PAYMENT TERMS

TERM AND TERMINATION

Term: This Agreement commences on Start Date: and will continue until End Date: unless earlier terminated in accordance with this section.

Either party may terminate this Agreement for convenience upon days' prior written notice to the other party. Either party may terminate immediately upon written notice if the other party materially breaches the Agreement and fails to cure such breach within days after receipt of written notice describing the breach.

CONFIDENTIALITY

Provider acknowledges that in performing services it may receive Confidential Information of Client. Provider shall (i) maintain such information in strict confidence, (ii) use it solely for the purposes of performing under this Agreement, (iii) limit access to employees, contractors and agents who have a need to know and who are bound by confidentiality obligations at least as protective as those herein, and (iv) promptly notify Client of any unauthorized disclosure or loss. Confidential Information does not include information that is publicly available without breach, independently developed without use of Confidential Information, or rightfully received from a third party without restriction.

BREACH NOTIFICATION

In the event of an actual or suspected security incident or unauthorized access affecting Client data, Provider shall notify Client without undue delay and in no event later than hours of discovery. Provider shall cooperate with Client's investigation and take all reasonable measures to contain and remediate the incident.

INDEMNIFICATION

Provider shall indemnify, defend and hold harmless Client and its officers, directors and employees from and against any and all losses, liabilities, damages, costs and expenses (including reasonable attorneys' fees) arising out of Provider's breach of this Agreement, negligent acts or willful misconduct, or failure to comply with the Client Policies.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to its conflicts of law principles.

ENTIRE AGREEMENT

This Agreement (including any attachments or exhibits executed by the parties) constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior and contemporaneous agreements, proposals, and communications, whether written or oral. Any amendment must be in writing and signed by authorized representatives of both parties.

MISCELLANEOUS PROVISIONS

Notices required under this Agreement shall be in writing and delivered to the contact information provided by each party. If any provision is held invalid or unenforceable, the remaining provisions shall remain in full force and effect. Neither party may assign this Agreement without the other party's prior written consent, except to a successor in interest by merger or sale of substantially all assets.

The undersigned representative of Provider hereby certifies that the information provided herein is true and accurate and that the signer is authorized to bind Provider to the obligations set forth in this Agreement.

Sign Now