Security Supplemental Form

Security Supplemental Form

This Security Supplemental Form ("Supplement") is entered into as of by and between Client Name: and Service Provider Name: .

WHEREAS

WHEREAS, Client and Service Provider are parties to a written agreement entitled Master Services Agreement dated (the "Master Agreement");

WHEREAS, the parties desire to supplement the Master Agreement to set forth specific security obligations, controls, incident response commitments, and payment adjustments associated with the provision of services that involve access to, processing of, or storage of Client data.

SCOPE OF WORK

SECURITY CONTROLS AND REQUIREMENTS

The Service Provider shall implement and maintain the following controls as applicable to the Services provided:

Network security controls (firewalls, segmentation, intrusion detection)

Encryption of Data at Rest and in Transit (specify algorithms and key management below)

Access controls and least-privilege administration

Incident response and notification procedures

Regular penetration testing and vulnerability scanning

Physical security for facilities (where applicable)

Employee background checks and security training

AUDIT, COMPLIANCE AND REPORTING

Service Provider shall permit Client or an independent assessor engaged by Client to conduct security audits or assessments no more than and upon prior written notice. All such audits shall be conducted during normal business hours and in a manner that does not unreasonably disrupt Service Provider operations.

INCIDENT NOTIFICATION AND RESPONSE

Service Provider shall notify Client of any confirmed or reasonably suspected security incident affecting Client data within hours of discovery and provide regular written updates until the incident is resolved. Notification shall include the nature of the incident, affected data categories, mitigation steps taken, and planned remediation.

PAYMENT TERMS

As consideration for the additional security services described in this Supplement, Client shall pay Service Provider the Security Fee in accordance with the terms below.

Invoices are payable within the period specified in Payment Schedule. Overdue amounts shall accrue interest as set forth in Late Payment above and Client shall be responsible for all reasonable collection costs and expenses incurred by Service Provider in enforcing payment.

TERM AND TERMINATION

This Supplement shall commence on and shall continue in effect until unless earlier terminated in accordance with this Supplement or the Master Agreement.

Either party may terminate this Supplement for material breach of the security obligations if the breaching party fails to cure the breach within days after receiving written notice. Termination of this Supplement shall not relieve any party of obligations accruing prior to termination, including payment obligations and obligations regarding the return or destruction of Client data.

CONFIDENTIALITY

The parties agree that any Client data, security assessments, vulnerability reports, and other information designated as confidential shall be treated as Confidential Information. Service Provider shall not use, disclose, or permit access to Confidential Information except as necessary to perform the Services. The obligations in this section shall not apply to information that: (a) is or becomes publicly known other than through a breach by the Service Provider; (b) is rightfully received from a third party without restriction; or (c) is independently developed by the Service Provider without reference to Client Confidential Information. The confidentiality obligations shall survive termination of this Supplement for a period of three (3) years or for as long as required by applicable law for certain categories of regulated data.

LIABILITY, INDEMNIFICATION AND REMEDIATION

Service Provider shall be liable for damages arising from Service Provider's willful misconduct or gross negligence in implementing the security controls required by this Supplement. Service Provider agrees to indemnify and hold Client harmless from third-party claims resulting from a failure to comply with the security obligations set forth herein, subject to any limitations or caps set forth in the Master Agreement. In the event of a data breach caused by Service Provider, Service Provider shall be responsible for reasonable remediation costs, including forensic investigation and required notifications as set out in Incident Notification and Response.

GOVERNING LAW

This Supplement shall be governed by and construed in accordance with the laws of the State of without regard to its conflicts of law principles.

ENTIRE AGREEMENT

This Supplement, together with the Master Agreement, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, or representations, whether written or oral, relating to the same subject matter. Any amendment to this Supplement must be in writing and signed by authorized representatives of both parties.

GENERAL PROVISIONS

If any provision of this Supplement is held invalid or unenforceable, the remainder of the Supplement will remain in full force and effect. The parties agree that monetary damages may be an inadequate remedy for breach of certain obligations contained herein and that injunctive relief may be sought in appropriate circumstances.

Sign Now