Retainer Addendum for MFA

RETainer ADDENDUM FOR MFA

This Retainer Addendum for Multi-Factor Authentication and Related Security Services ("Addendum") is made effective as of by and between Firm Name: and Client Name: (each a "Party" and collectively the "Parties").

RECITALS

WHEREAS, the Parties entered into a written retainer or engagement agreement dated (the "Retainer Agreement"); and

WHEREAS, the Parties desire to augment the Retainer Agreement with specific terms governing the implementation, maintenance and responsibilities relating to Multi-Factor Authentication ("MFA") and related authentication controls for access to systems, communications, and confidential materials; and

WHEREAS, the Parties intend that the security measures described herein be incorporated into the Retainer Agreement by reference to ensure protection of Confidential Information and reasonable operational safeguards.

NOW, THEREFORE

NOW, THEREFORE, in consideration of the mutual promises set forth below and other good and valuable consideration, the receipt and sufficiency of which are acknowledged, the Parties agree as follows:

1. SCOPE OF ADDENDUM

1.1 Purpose. This Addendum governs the selection, implementation, operation and maintenance of MFA controls for access to systems, portals, communications channels, file repositories and other services provided under the Retainer Agreement. The MFA measures described herein supplement and do not replace any technical, administrative or contractual safeguards otherwise required by the Retainer Agreement.

1.2 Applicability. This Addendum applies to all users granted access to services covered by the Retainer Agreement, including but not limited to Client personnel, representatives, consultants and any third-party users for whom access is provisioned by either Party.

2. MFA IMPLEMENTATION

2.1 Methods. The Parties agree that acceptable MFA methods include at least one of the following selected methods: Authenticator application (TOTP) SMS one-time passcode Hardware token Biometric factor Federated single sign-on with MFA.

2.2 Deployment. Firm shall deploy or configure MFA on systems under its control in accordance with industry-standard practices and the specific methods checked above. Implementation Start Date: . Any change to selected methods shall require written notice to the other Party in accordance with the Notices provision.

3. RESPONSIBILITIES

3.1 Client Obligations. Client shall: (a) ensure authorized users maintain accurate contact information and registered authentication devices; (b) not share MFA credentials or devices; (c) promptly report lost, stolen or suspected compromised authenticators to Firm; and (d) comply with Firm's reasonable policies for enrollment and re-enrollment.

3.2 Firm Obligations. Firm shall: (a) enable and maintain MFA configurations consistent with the selected methods; (b) provide reasonable enrollment and support for Client users; (c) maintain administrative controls to revoke access in case of compromise; and (d) log administrative changes to MFA settings for a period of not less than days.

4. FEES AND COSTS

4.1 MFA Fees. Client agrees to reimburse Firm for reasonable, documented costs associated with MFA hardware, licensing or third-party services where applicable. Estimated Fee Amount: . Billing Frequency: Monthly One-time Annual.

4.2 Expense Approval. Any single expense over requires prior written approval from Client's authorized representative.

5. CONFIDENTIALITY AND DATA SECURITY

5.1 Protection of Credentials. The Parties acknowledge that authentication credentials and related metadata constitute Confidential Information under the Retainer Agreement. Each Party shall protect such information with at least the same degree of care it uses to protect its own confidential information, but no less than reasonable care.

5.2 Data Handling. Any personally identifiable information collected in the enrollment or operation of MFA shall be processed and stored only for purposes necessary to provide the MFA services and in compliance with applicable law. Firm shall segregate authentication data from other client data where technologically feasible.

6. INCIDENT RESPONSE AND NOTIFICATION

6.1 Notification. In the event of a suspected compromise of MFA credentials or an incident affecting access controls, the discovering Party shall notify the other Party without unreasonable delay and, in any event, within hours of discovery of the incident.

6.2 Response. The Parties shall cooperate to investigate the incident, mitigate harm, revoke or re-issue credentials, and implement remediation measures as reasonably required. Costs of remediation shall be allocated as set forth in the Retainer Agreement unless caused by the gross negligence or willful misconduct of the responsible Party.

7. LIMITATION OF LIABILITY; INDEMNIFICATION

7.1 Limitation of Liability. Except for willful misconduct or gross negligence, neither Party shall be liable for indirect, incidental, special, punitive or consequential damages arising out of or related to the implementation or operation of MFA services under this Addendum, even if advised of the possibility of such damages.

7.2 Indemnification. Each Party shall indemnify, defend and hold harmless the other Party from and against any third-party claims arising from that Party's breach of this Addendum, negligence, willful misconduct, or violation of applicable law in connection with MFA implementation. The indemnifying Party shall have the right to control the defense and settlement of any claim, provided that no settlement shall admit liability or impose obligations on the indemnified Party without its prior written consent.

8. TERM AND TERMINATION

8.1 Term. This Addendum commences on the Effective Date and continues for the term of the Retainer Agreement unless earlier terminated in accordance with this Section.

8.2 Termination for Convenience. Either Party may terminate this Addendum for convenience upon days' prior written notice to the other Party. Termination shall not relieve Client of obligations to pay for services performed or expenses incurred prior to termination.

9. NOTICES

10. AMENDMENTS; WAIVER; COUNTERPARTS

10.1 Amendments. Any amendment or modification of this Addendum must be in writing and signed by authorized representatives of both Parties.

10.2 Waiver. Failure or delay by either Party to exercise any right shall not constitute a waiver of that right. A waiver is effective only if in writing and signed by the waiving Party.

10.3 Counterparts. This Addendum may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument.

11. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

11.1 Governing Law. This Addendum shall be governed by and construed in accordance with the laws of the State of without regard to its conflict of laws principles.

11.2 Entire Agreement. This Addendum, together with the Retainer Agreement, constitutes the entire agreement between the Parties with respect to MFA and supersedes all prior and contemporaneous agreements and understandings related to the subject matter hereof.

11.3 Severability. If any provision of this Addendum is held invalid or unenforceable, the remaining provisions shall remain in full force and effect and the Parties shall negotiate in good faith a substitute provision that effectuates the original intent to the greatest extent permitted by law.

SIGNATURES

The Parties have executed this Addendum as of the dates set forth below.

Sign Now