Security Endpoint Policy Template

Security Endpoint Policy Template

Parties

Recitals

WHEREAS, Company Name: operates information systems and endpoints that process or store data essential to Company operations; and

WHEREAS, Service Provider: will provide maintenance, support, software installation, or management services that require access to such endpoints; and

WHEREAS, the parties desire to set forth minimum security controls, responsibilities and enforcement measures applicable to endpoints, including laptops, desktops, mobile devices, servers and other network-connected devices (collectively, "Endpoints"), to protect the confidentiality, integrity and availability of Company data.

Scope of Work (Endpoint Security Requirements)

The Provider shall implement, maintain and enforce Endpoint security measures as described below. The Provider shall document procedures and evidence of compliance and make such records available to Company upon request.

Minimum technical requirements include, at a minimum:

- Endpoint protection platform (EPP) and endpoint detection and response (EDR) deployed and managed across all covered Endpoints; real-time monitoring and automatic remediation where feasible.
- Operating system and application patching regime with documented schedule and critical patch deployment timeline not exceeding days for critical fixes.
- Full disk encryption enabled on all portable and removable Endpoints handling Company data.
- Administrative privilege management and least-privilege enforcement on user accounts.

Payment Terms

As consideration for services rendered under this Policy Agreement, Company agrees to pay Provider as set forth below.

All invoices shall itemize services and any reimbursable expenses. Disputed invoice amounts must be identified in writing by Company within days of receipt; undisputed amounts remain payable as provided above.

Term and Termination

This Agreement shall commence on Effective Date: and shall continue until Expiration Date: , unless earlier terminated in accordance with this section.

Either party may terminate for convenience upon written notice of days to the other party. Either party may terminate immediately for material breach that is not cured within days after written notice specifying the breach. Termination shall not relieve Company of its obligation to pay for services performed prior to termination.

Confidentiality

Provider acknowledges that in the course of performing services it will receive or have access to Confidential Information of Company. Confidential Information includes, without limitation, endpoint configurations, security logs, credentials, system architecture, and any personal data processed on behalf of Company. Provider shall:

(a) Maintain Confidential Information in strict confidence using at least the same degree of care it uses to protect its own confidential information but in no event less than reasonable care;
(b) Use Confidential Information solely for the purposes of performing obligations under this Agreement;
(c) Not disclose Confidential Information to any third party except to personnel or subcontractors who have a need-to-know and are bound by confidentiality obligations no less protective than those herein;
(d) Promptly notify Company upon discovery of any unauthorized disclosure or suspected breach and cooperate with Company in investigative and remediation efforts.

Incident Response and Notification

Provider shall maintain an incident response process and shall notify Company no later than hours after discovery of any security incident involving Company data or Endpoints. Provider shall provide timely updates, root cause analysis and remediation actions in accordance with Company reasonable directions.

Compliance, Audit and Reporting

Provider shall comply with applicable laws and industry standards applicable to endpoint security and data protection. Company reserves the right to audit Provider's security controls, with reasonable notice, no more frequently than times per year. Provider will promptly remediate any material non-conformance identified during audits.

Data Retention and Disposal

Provider shall retain Company data only as necessary to perform services and shall securely delete or return Company data upon termination or at Company’s direction within days. Secure deletion shall follow industry-accepted methods appropriate to the media.

Limitation of Liability and Indemnification

Each party's liability arising from this Agreement shall be subject to the limitations and exclusions set forth in the parties' primary services agreement. Provider shall indemnify and hold Company harmless from third-party claims arising from Provider's gross negligence or willful misconduct in connection with Endpoint security obligations.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to its conflict of laws principles.

Entire Agreement

This document, together with any referenced statements of work or annexes executed by the parties, constitutes the entire agreement between the parties with respect to Endpoint security obligations and supersedes all prior and contemporaneous agreements, understandings and communications, whether written or oral.

Amendment

Any amendment to this Agreement must be in writing and signed by authorized representatives of both parties.

Acknowledgment

By signing below, the undersigned represent and warrant that they are authorized to enter into this Agreement on behalf of the named party and that the party accepts and will comply with the terms set forth herein.

Sign Now