Security Development SECDEV Document

Security Development SECDEV Document

This Security Development Agreement (the "Agreement") is entered into as of between the parties set forth below.

WHEREAS

WHEREAS, Party A maintains expertise in secure software development, secure architecture, and corrective security engineering and is willing to provide security development services for the project identified as ("Project");

WHEREAS, Party B desires to retain Party A to perform secure development, vulnerability remediation, and related professional services as described in this Agreement and Party A agrees to perform such services under the terms set forth herein.

WHEREAS, the parties intend to allocate responsibilities for deliverables, testing, acceptance, and remediation obligations, and to protect Confidential Information and intellectual property created in the course of performance.

Scope of Work

Party A shall provide security development services including secure coding, security architecture review, static and dynamic analysis, vulnerability remediation, and delivery of agreed deliverables. Deliverables shall include source code changes, technical reports, test evidence, and remediation plans as applicable. Acceptance criteria shall be defined in writing and may include automated test coverage, resolved severity-level vulnerabilities, and successful acceptance testing by Party B.

Payment Terms

In consideration for the services performed by Party A, Party B shall pay Party A the fees and expenses set forth below. All payments shall be made in U.S. dollars unless otherwise agreed in writing.

Late payments shall bear interest equal to the lesser of (a) the maximum rate permitted by applicable law, or (b) the greater of (i) % per month, or (ii) a late fee of $ .

Term and Termination

The term of this Agreement shall commence on and continue until , unless earlier terminated in accordance with this Section.

Either party may terminate this Agreement for material breach by the other party if the breach remains uncured after thirty (30) days' written notice specifying the nature of the breach. Termination shall not relieve the breaching party from liability for breaches occurring prior to termination.

Confidentiality

Each party shall maintain in strict confidence all Confidential Information received from the other party, and shall not disclose such information except as necessary to perform its obligations under this Agreement. Confidential Information includes source code, security findings, exploit proofs-of-concept, designs, and other technical materials. The receiving party shall use at least the same degree of care it uses to protect its own confidential information, but in no event less than reasonable care.

Security Obligations and Vulnerability Handling

Party A shall perform work in accordance with industry-standard secure development practices and shall promptly remediate confirmed security vulnerabilities in deliverables. Reported vulnerabilities shall be triaged and assigned severity levels; Party A shall provide remediation within timeframes agreed in the Scope of Work. Party A shall not introduce known insecure code in any deliverable.

Yes — subject to agreed test windows, rules of engagement, and written notice of at least days.

Intellectual Property and Deliverables

Unless otherwise agreed in writing, Party A grants Party B a perpetual, non-exclusive, worldwide license to use deliverables produced under this Agreement for Party B's internal business purposes. Party A represents that deliverables will not infringe third-party rights and that Party A has the right to grant the licenses contained herein.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of , without regard to conflict of law principles.

Entire Agreement

This Agreement, including any exhibits, statements of work, and change orders executed by the parties, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, and communications, whether written or oral.

Miscellaneous

Notices shall be sent to the addresses specified above. Neither party may assign this Agreement without the prior written consent of the other party, except to an affiliate or in connection with a merger or sale of substantially all assets. Remedies are cumulative and do not exclude any remedies available at law or in equity.

Sign Now