Security Service Level Agreement

SECURITY SERVICE LEVEL AGREEMENT

This Security Service Level Agreement (the "Agreement") is entered into as of by and between Provider Name: with principal place of business at , and Client Name: with principal place of business at .

RECITALS

WHEREAS, Provider is in the business of providing managed security services, monitoring, and incident response using personnel, tools and processes designed to protect information systems and data; and

WHEREAS, Client desires to engage Provider to render security services described herein and Provider is willing to provide such services pursuant to the terms and service levels set forth in this Agreement; and

WHEREAS, the parties intend by this Agreement to define the scope of services, performance standards, remedies for non-performance, and responsibilities of each party.

NOW THEREFORE

In consideration of the mutual covenants contained herein, the parties agree as follows:

1. DEFINITIONS

1.1 "Services" means the security monitoring, threat detection, vulnerability management, incident response and related professional services described in Schedule A and performed by Provider. Schedule A description:

1.2 "Availability" means the percentage of time the monitored security services and alerting infrastructure are operational and capable of producing alerts and reports in accordance with this Agreement.

2. TERM

2.1 Term. The initial term of this Agreement shall commence on the effective date and continue for months, and shall automatically renew for successive terms of months unless either party provides written notice of non-renewal at least days prior to the end of the then-current term.

3. SERVICES AND SERVICE LEVELS

3.1 Scope of Services. Provider shall perform the Services in a professional manner consistent with industry standards and as further described in Schedule A. Provider shall use commercially reasonable efforts to maintain monitoring and detection capabilities and to provide the deliverables set forth in Schedule A.

3.2 Availability Commitment. Provider guarantees Availability of % measured monthly, excluding Scheduled Maintenance and Excluded Events (as defined below).

3.3 Incident Response. Provider shall adhere to the following maximum response and resolution targets for incidents reported to Provider:

- Severity 1 (Critical): initial response within hours; target remediation or mitigation action within hours.

- Severity 2 (High): initial response within hours; target remediation within hours.

3.4 Monitoring and Reporting. Provider shall continuously monitor the agreed scope of systems during the Monitoring Hours specified as . Provider shall produce monthly reports including metrics, incidents, actions taken, and recommendations.

4. SERVICE CREDITS

4.1 Credit Schedule. If Provider fails to meet the Availability Commitment in any monthly measurement period, Client shall be eligible for a service credit equal to % of the monthly service fee for each full percentage point below the committed Availability, subject to a maximum credit of % of the monthly fee for that period.

4.2 Claim Procedure. To receive a credit, Client must submit a written claim within days of the end of the month in which the failure occurred, detailing the incident and any supporting logs. Provider shall validate the claim and apply an offset to the next invoice when approved.

5. CLIENT OBLIGATIONS

5.1 Cooperation. Client shall provide Provider with reasonable access to systems, documentation, personnel, and written authorization required to perform the Services. Failure to provide such access that materially delays performance shall excuse Provider's obligations to the extent of the delay.

5.2 Customer-Side Security. Client shall maintain baseline security controls, timely patching, and endpoint hygiene as set forth in Schedule B; Provider's obligations do not extend to correcting deficiencies that are the result of Client's failure to meet its obligations.

6. CONFIDENTIALITY AND DATA PROTECTION

6.1 Confidential Information. Each party shall hold the other party's Confidential Information in strict confidence and shall not disclose it except to employees or subcontractors who have a need to know and are bound by confidentiality obligations no less protective than those set forth herein.

6.2 Personal Data. Where Services require processing of Personal Data, Provider shall process such data only for the purposes of providing the Services and in accordance with documented instructions from Client, applicable data protection laws, and reasonable technical and organizational measures to protect data against unauthorized or unlawful processing and accidental loss or destruction.

7. AUDIT AND COMPLIANCE

7.1 Audit Rights. Client may, no more than once per calendar year and upon reasonable prior notice, audit Provider's compliance with the security obligations relevant to Client's data. Audits shall be conducted during normal business hours and may be performed by an independent third party selected by Client, subject to Provider's written approval, not to be unreasonably withheld.

8. FEES AND PAYMENT

8.1 Fees. Client shall pay Provider a recurring service fee of per month, plus any agreed one-time professional services fees as set forth in an applicable statement of work.

8.2 Payment Terms. Invoices are due within days of receipt. Unpaid amounts accrue interest at a rate of % per month or the maximum permitted by law, whichever is lower.

9. REPRESENTATIONS, WARRANTIES, AND DISCLAIMERS

9.1 Mutual Representations. Each party represents that it has the authority to enter into this Agreement and to perform its obligations hereunder.

9.2 Provider Warranty. Provider warrants that it will perform the Services in a professional and workmanlike manner in accordance with generally accepted industry standards. Provider does not warrant that the Services will prevent all security incidents or that all vulnerabilities will be identified.

9.3 Disclaimer. EXCEPT FOR THE EXPRESS WARRANTIES SET FORTH IN THIS SECTION, PROVIDER DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.

10. LIMITATION OF LIABILITY

10.1 Exclusion of Consequential Damages. NEITHER PARTY SHALL BE LIABLE FOR SPECIAL, INDIRECT, INCIDENTAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES, INCLUDING LOST PROFITS, DATA LOSS OR BUSINESS INTERRUPTION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

10.2 Aggregate Cap. EXCEPT FOR LIABILITY ARISING FROM GROSS NEGLIGENCE, WILLFUL MISCONDUCT, BREACH OF CONFIDENTIALITY, OR LIABILITY FOR INDEMNIFICATION OBLIGATIONS, A PARTY'S AGGREGATE LIABILITY UNDER THIS AGREEMENT SHALL NOT EXCEED THE TOTAL AMOUNTS PAID BY CLIENT TO PROVIDER IN THE SIX (6) MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY.

11. INDEMNIFICATION

11.1 Provider Indemnity. Provider shall indemnify and defend Client from and against third-party claims arising out of Provider's gross negligence or willful misconduct in the performance of the Services, subject to Client providing prompt notice and reasonable cooperation in the defense of such claims.

11.2 Client Indemnity. Client shall indemnify and defend Provider from and against third-party claims arising from Client's failure to comply with its obligations under this Agreement or Client's misuse of the Services.

12. TERMINATION

12.1 Termination for Cause. Either party may terminate this Agreement upon written notice if the other party materially breaches any provision and fails to cure such breach within days after receipt of written notice specifying the breach.

12.2 Effect of Termination. Upon termination, Provider shall cease providing Services and Client shall pay Provider for all Services performed through the effective date of termination. Termination shall not relieve either party of obligations intended to survive termination.

13. NOTICES

Notices shall be delivered to the addresses above by certified mail, courier, or email with confirmation, and shall be deemed given upon receipt.

14. AMENDMENT AND WAIVER

Any amendment to this Agreement must be in writing and signed by authorized representatives of both parties. Failure to exercise any right shall not constitute a waiver of that right unless in writing and signed by the waiving party.

15. COUNTERPARTS

This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument. Signatures delivered electronically or by facsimile shall be binding.

16. GOVERNING LAW; SEVERABILITY; ENTIRE AGREEMENT

16.1 Governing Law. This Agreement shall be governed by and construed in accordance with the laws of , without regard to conflict of law principles.

16.2 Severability. If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

16.3 Entire Agreement. This Agreement, including all Schedules and Statements of Work incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior agreements and understandings.

17. ADDITIONAL PROVISIONS

17.1 Subcontracting. Provider may engage subcontractors to perform portions of the Services provided that Provider remains responsible for subcontractor performance and compliance with this Agreement.

17.2 Change Control. Any change to the scope of Services shall be documented in a written change order executed by both parties, including adjustments to fees and timelines.

SCHEDULE A — DETAILED SERVICE DESCRIPTION

SCHEDULE B — BASELINE CUSTOMER SECURITY RESPONSIBILITIES

Sign Now