Virtual Chief Information Security Officer Agreement

VIRTUAL CHIEF INFORMATION SECURITY OFFICER AGREEMENT

This Virtual Chief Information Security Officer Agreement (the Agreement) is entered into as of Effective Date: by and between Client Name: , located at (Client), and Service Provider Name: , located at (Provider).

RECITALS

WHEREAS, Client requires executive-level information security leadership, strategy, risk management and regulatory compliance oversight on a virtual/remote basis; and

WHEREAS, Provider represents that it possesses the qualifications, personnel, and experience necessary to provide virtual Chief Information Security Officer (vCISO) services and related advisory services to Client; and

WHEREAS, the parties desire to set forth their respective rights and obligations with respect to the provision of such services under the terms and conditions of this Agreement.

SCOPE OF WORK

Provider shall deliver vCISO services reasonably necessary to advise Client’s executive management and board, to develop and maintain information security strategy, program governance, risk assessments, incident response planning, vendor risk oversight, regulatory compliance guidance, and periodic reporting (Services). Detailed tasks, deliverables, milestones and service levels are described below and may be updated by mutual written agreement.

PAYMENT TERMS

Client shall pay Provider for Services as set forth below. Unless otherwise agreed in writing, payments are non-refundable and due in accordance with the schedule selected herein.

Monthly Retainer — Amount: payable in advance each month; or

Hourly Consulting — Rate: per hour, invoiced monthly.

Invoices are due within days of invoice date. Past due amounts shall accrue interest at % per month (or the maximum permitted by applicable law), together with all collection costs, including reasonable attorneys' fees.

TERM AND TERMINATION

This Agreement shall commence on Start Date: and shall continue until End Date: , unless earlier terminated in accordance with this Section.

Absent written notice by either party delivered at least days prior to the then-current term expiration, this Agreement will automatically renew for successive terms of the same duration.

Either party may terminate this Agreement immediately for material breach by the other party if such breach remains uncured for a period of days after receipt of written notice specifying the breach. Termination shall not relieve Client of its obligation to pay for Services performed through the effective date of termination.

CONFIDENTIALITY

Each party shall maintain in confidence all proprietary and non-public information disclosed by the other party, whether marked confidential or reasonably understood to be confidential (Confidential Information). Confidential Information shall not include information that (i) is or becomes publicly known through no breach of this Agreement, (ii) is rightfully received from a third party without restriction, (iii) is independently developed by the receiving party, or (iv) is required to be disclosed by law, provided that the receiving party gives prompt notice and cooperates in any lawful effort to avoid or limit such disclosure.

The obligations in this Confidentiality section shall survive termination of this Agreement for a period of years, except with respect to trade secrets which shall remain protected for as long as they qualify as trade secrets under applicable law.

INTELLECTUAL PROPERTY AND WORK PRODUCT

Subject to Client’s payment of all fees due hereunder, Provider grants Client a non-exclusive, non-transferable license to use deliverables and written work product prepared specifically for Client under this Agreement for Client’s internal business purposes. Provider retains ownership of Provider’s pre-existing tools, processes, methodologies, templates and know-how. Any third-party software or materials licensed to Provider remain subject to their separate license terms.

LIMITATION OF LIABILITY

Except for breaches of confidentiality or willful misconduct, neither party shall be liable to the other for incidental, consequential, punitive or special damages. Provider’s aggregate liability for any claim arising out of or relating to this Agreement shall not exceed the total fees paid by Client to Provider under this Agreement in the twelve (12) months preceding the event giving rise to the claim.

INSURANCE

Provider shall maintain commercially reasonable professional liability/errors & omissions insurance and cyber liability insurance where available, and shall provide evidence of such coverage upon Client’s reasonable request.

NOTICES

GOVERNING LAW; DISPUTE RESOLUTION

This Agreement shall be governed by and construed in accordance with the laws of the State of , without regard to its conflicts of law rules. The parties agree to attempt in good faith to resolve disputes by negotiation between senior executives prior to pursuing litigation. If unresolved, disputes shall be resolved in the state or federal courts located in the chosen state unless the parties agree otherwise in writing.

ENTIRE AGREEMENT

This Agreement, including any attachments and executed statements of work, constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior and contemporaneous agreements, proposals and communications, whether oral or written. Any modification to this Agreement must be in writing and signed by duly authorized representatives of both parties.

MISCELLANEOUS

If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect. Neither party may assign this Agreement without the prior written consent of the other, except that Provider may assign to an affiliate or in connection with a sale of substantially all of its assets.

Sign Now