Ransomware Response Supplement

Ransomware Response Supplement

This Ransomware Response Supplement (the Supplement) is entered into between the parties identified below on the Effective Date provided herein and amends or supplements the existing agreement between the parties for cybersecurity incident response services.

Parties and Effective Date

Effective Date:

Recitals

WHEREAS, Client requires immediate and coordinated professional services to respond to a ransomware-related cybersecurity incident, including containment, forensic investigation, remediation, and restoration; and

WHEREAS, Service Provider represents that it has the expertise, personnel, tools and authority necessary to provide emergency incident response and related services as set forth in this Supplement; and

WHEREAS, the parties desire to set forth the scope of work, payment terms, confidentiality protections, and other material terms specific to ransomware response in addition to the existing agreement between the parties.

Scope of Work

The Service Provider shall provide response services as reasonably necessary to address the ransomware incident, which may include emergency containment, eradication of malicious artifacts, forensic investigation, restoration of systems, data recovery efforts, coordination with third-party vendors, and support for client communications with affected stakeholders and regulators.

Response Components (check all that apply):

Containment and isolation of affected systems    Forensic investigation and evidence preservation    Data recovery and system restoration    Communications and stakeholder support    Third-party vendor coordination

Incident Date (if known):

Ransom Payment Authorization

The parties acknowledge that payment of a ransom is a separate, high-risk decision. Provider shall not use client funds to pay any ransom unless expressly authorized in writing by Client pursuant to the procedures below.

Authorization to negotiate or effectuate payment of a ransom: Client authorizes Provider to negotiate ransom    Client authorizes Provider to effectuate ransom payment

If authorization is granted above, Maximum Authorized Payment Amount: $

Approval requirement: Provider must obtain prior written or documented telephonic approval from an authorized Client representative before attempting any payment or final negotiation.

Payment Terms

Retainer (if applicable): $ payable within days of activation of services.

Hourly Rates: Lead technical personnel $ /hr; Other technical staff $ /hr.

Flat incident fee (if applicable): $

Invoice Due: days from invoice date. Late fee: per month on overdue balances.

Third-party costs and disbursements (including but not limited to forensic lab fees, travel, and extraordinary vendor fees) shall be reimbursed by Client upon presentation of reasonable documentation.

Term and Termination

Term Start Date:    Term End Date (if applicable):

Either party may terminate this Supplement for convenience upon days' written notice. Either party may terminate for material breach if the breach is not cured within days following written notice of breach.

Confidentiality and Data Handling

The parties agree that all non-public information disclosed in connection with the response services, including incident artifacts, forensic data, system logs, and personal data, shall be treated as Confidential Information. Service Provider shall use such Confidential Information solely to perform the services under this Supplement and shall not disclose such information except to personnel or approved subcontractors who have a need to know and are bound by confidentiality obligations at least as protective as those herein.

Exceptions: Confidentiality obligations shall not apply to information that is already public through no fault of the receiving party, independently developed by the receiving party without access to the disclosing party's Confidential Information, or required to be disclosed by law or valid subpoena, provided the receiving party provides prompt notice to permit the disclosing party to seek protective relief.

Liability, Indemnification and Disclaimers

Limitation of Liability: Except for willful misconduct or gross negligence, in no event shall either party be liable to the other for consequential, incidental, special or punitive damages, and aggregate liability for claims arising out of this Supplement shall be limited to the total fees paid to Service Provider under this Supplement in the twelve (12) months preceding the claim.

Indemnification: Each party shall indemnify and hold the other harmless from claims arising from its own acts or omissions in connection with this Supplement, subject to the limitations of liability set forth herein.

No Guarantee of Recovery: Client acknowledges that Service Provider does not guarantee recovery of encrypted data or that ransom payment (if any) will result in successful or complete restoration of systems or data.

Governing Law; Entire Agreement

Governing Law: This Supplement shall be governed by and construed in accordance with the laws of the state of without regard to its choice of law rules.

Entire Agreement: This Supplement, together with the underlying agreement between the parties, constitutes the entire agreement with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements and understandings relating to ransomware response services. In the event of any conflict between this Supplement and the underlying agreement, the terms of this Supplement shall control to the extent they specifically address ransomware response.

Notices

All notices required or permitted under this Supplement shall be in writing and delivered to the notice addresses provided above or to such other address as a party may designate in writing from time to time.

Acceptance

By signing below, the authorized representatives of the parties acknowledge and agree to the terms of this Ransomware Response Supplement.

Sign Now