Cybersecurity services contract template (US)

Cybersecurity Services Agreement

This Agreement is made on Effective Date between Client Name, a Client Entity Type and State, at Client Address ("Client"), and Provider Name, a Provider Entity Type and State, at Provider Address ("Provider").

1. Services

Provider will perform the services in the statement of work attached as Exhibit A (the "Services"), which may include:

• Assessment Services, such as a Vulnerability Assessment or Risk Assessment against the NIST Cybersecurity Framework

• Testing Services, such as External and Internal Penetration Testing

• Managed Services, such as 24/7 Monitoring, Endpoint Detection and Response

• Other Services, such as Security Awareness Training or Policy Development

2. Authorization for Testing

Client authorizes Provider to test only the systems, IP addresses and applications listed in the Rules of Engagement in Exhibit B, during the windows stated there. Client confirms that it owns or has authority to approve testing of those systems, including any hosted by third parties, and will obtain any cloud or hosting provider approvals needed. Provider will not test anything outside that scope. This written authorization is given so that testing is authorized access under the federal Computer Fraud and Abuse Act and state law.

3. Testing Risks

Client understands that testing may cause slowdowns, outages or data changes despite reasonable care. Client will keep current backups and name an emergency contact: Client Emergency Contact. Provider will stop testing at once on request.

4. Fees

Fees: Fee Structure, such as a Fixed Fee of $___ for the Assessment, plus $___ per Month for Monitoring. Invoices are due within Payment Days days. Expenses approved in advance are billed at cost.

5. Term

This Agreement starts on Start Date and lasts Term. Managed services renew month to month unless either party gives Termination Notice Days days' written notice.

6. Findings and Reports

Provider will deliver a written report of findings, rated by severity, with recommended remediation, by Report Due Date. Reports are Client's confidential information. Provider does not guarantee that all vulnerabilities will be found or that Client's systems will be secure.

7. Incident Notification

If Provider discovers evidence of an actual compromise or illegal content, it will notify Client's designated contact promptly. Client is responsible for any legal notices to individuals, regulators or law enforcement, though Provider will reasonably assist.

8. Confidentiality and Data

Provider will access Client data only as necessary, keep it confidential, protect it with strong security controls, and delete or return it at the end of the engagement, keeping only its working papers as required. If Provider may access protected health information, the parties will sign a HIPAA business associate agreement first.

9. Personnel

Provider's staff assigned to Client will have passed background checks, done in line with applicable law, and will hold relevant certifications such as Certifications, such as OSCP, CISSP or GIAC.

10. Insurance and Liability

Provider will carry professional liability and cyber liability insurance of at least $Insurance Coverage. NEITHER PARTY IS LIABLE FOR INDIRECT OR CONSEQUENTIAL DAMAGES, AND PROVIDER'S TOTAL LIABILITY IS LIMITED TO Liability Cap, such as the Fees Paid in the Prior 12 Months, EXCEPT FOR BREACH OF CONFIDENTIALITY, GROSS NEGLIGENCE OR WILLFUL MISCONDUCT.

11. Independent Contractor

Provider is an independent contractor and is responsible for its own staff, taxes and insurance.

General Terms

Governing law. This Agreement is governed by the laws of the State of Governing State, without regard to its conflict of laws rules. Any lawsuit will be brought in the state or federal courts located in Venue County and State.

Entire agreement. This Agreement is the parties' complete agreement on its subject and replaces all earlier discussions. It may be changed only in a writing signed by both parties.

Severability. If a court finds any part of this Agreement unenforceable, that part will be enforced to the extent the law allows, and the rest stays in effect.

Assignment. Neither party may assign this Agreement without the other's written consent, except to a successor to its whole business.

Notices. Notices must be in writing and sent to the addresses above by personal delivery, certified mail or a nationally recognized courier.

Counterparts and e-signatures. This Agreement may be signed in counterparts and by electronic signature, which has the same effect as an original.

| Client | Provider |

| --- | --- |

| Signature: Client Signature | Signature: Provider Signature |

| Name: Client Printed Name | Name: Provider Printed Name |

| Date: Client Signing Date | Date: Provider Signing Date |