Security Compliance Template

Security Compliance Template

WHEREAS

Client Name:

Service Provider:

Effective Date:

WHEREAS, Client seeks to engage Service Provider to perform technology, security, and related services described herein and Service Provider represents that it has the requisite expertise and controls to meet the security obligations set forth below.

WHEREAS, the parties desire to set forth minimum security requirements, audit rights, incident response obligations, payment terms, and other contractual provisions to ensure protection of Client Data and compliance with applicable controls.

Scope of Work

Security Requirements

Service Provider shall maintain administrative, technical, and physical safeguards appropriate to the nature of the Client Data processed. Minimum controls include, at a minimum, the items and attestations below; additional controls may be required by Client in writing.

ISO 27001 compliance or equivalent certification where applicable

SOC 2 Type II report or equivalent operational controls attestation

Other (specify):

Multi-factor authentication required for administrative access:

Encryption of Client Data at rest and in transit required:

Regular vulnerability scanning and remediation cadence:

Data Handling and Classification

Data retention and deletion: Service Provider shall retain Client Data only as necessary to perform the Services and shall securely delete or return Client Data upon termination or upon Client's written request in accordance with the agreed retention schedule.

Access Control and Authentication

Incident Response

Notification timeframe for confirmed security incidents affecting Client Data:

Audit, Monitoring and Reporting

Client audit rights: Service Provider shall permit Client or Client's designated auditor to perform security reviews and provide reasonable access to systems, logs, and personnel as necessary to verify compliance under reasonable confidentiality protections.

Audit frequency:

Payment Terms

Total Compensation: $

Late payment fee: on overdue balances.

Term and Termination

Term Commencement (Start Date):

Term Expiration (End Date):

Either party may terminate this Agreement for convenience upon written notice to the other party delivered not less than prior to the effective termination date.

Termination for material breach: Either party may terminate for uncured material breach if the breaching party fails to cure the breach within after receipt of written notice.

Confidentiality

Each party acknowledges that in performing under this Agreement it may receive Confidential Information of the other party. Confidential Information means non-public information designated as confidential or that, given the nature of the information, reasonably should be understood to be confidential. Recipient shall protect Confidential Information with at least the same degree of care it uses to protect its own confidential information but in no event less than reasonable care, shall use Confidential Information only to perform its obligations under this Agreement, and shall not disclose Confidential Information to third parties except as expressly permitted herein.

Confidentiality obligations survive termination for a period of unless a longer period is required by law or contract.

Limitation of Liability and Indemnification

Each party shall indemnify and hold harmless the other party from third-party claims arising from its gross negligence or willful misconduct in connection with this Agreement. Except for liability arising from willful misconduct, gross negligence, or breaches of confidentiality and data protection obligations, the parties' aggregate liability under this Agreement shall be limited to .

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of: without regard to its conflicts of law principles.

Entire Agreement

This Agreement, including any attachments or statements of work executed under it, constitutes the entire agreement between the parties regarding the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, and communications, whether written or oral. No amendment shall be effective unless in writing and signed by authorized representatives of both parties.

Miscellaneous

Assignment: Neither party may assign this Agreement without the prior written consent of the other party, except to a successor in interest in connection with a merger, acquisition, or sale of substantially all of such party's assets.

Severability: If any provision of this Agreement is held invalid or unenforceable, the remainder of this Agreement will remain in full force and effect.

Sign Now