Cyber Security Incident Report Form Template

CYBER SECURITY INCIDENT REPORT FORM TEMPLATE

1. DOCUMENT PREAMBLE & RECITALS

THIS CYBER SECURITY INCIDENT REPORT FORM TEMPLATE AND BINDING AGREEMENT (the "Agreement") is entered into and made effective as of this [Day] day of [Month], [Year] (the "Effective Date"), by and between:

[Company Name], a [State/Country of Incorporation] [corporation/limited liability company], having its principal place of business at [Street Address, City, State, Zip] (hereinafter referred to as the "Disclosing Party" or "Company"), and

[Counterparty Name], a [State/Country of Incorporation] [corporation/limited liability company], having its principal place of business at [Street Address, City, State, Zip] (hereinafter referred to as the "Receiving Party" or "Vendor").

RECITALS

WHEREAS, the Parties have entered into one or more underlying commercial, operational, or service-level agreements (collectively, the "Master Services Agreement"); and

WHEREAS, in the performance of their respective obligations under the Master Services Agreement, the Parties acknowledge the critical necessity of maintaining robust cybersecurity protocols and ensuring the immediate, legally binding reporting of any Cyber Security Incident; and

WHEREAS, this Agreement establishes the operative legal framework, mandatory reporting timelines, investigation protocols, and legal liabilities associated with any actual or suspected compromise of information systems, networks, or Sensitive Data;

NOW, THEREFORE, in consideration of the mutual covenants, promises, and legal obligations contained herein, and for other good and valuable consideration, the receipt and legal sufficiency of which are hereby acknowledged, the Parties agree as follows:

---

2. OPERATIONAL DEFINITIONS

For the purposes of this Agreement, the following terms shall have the meanings ascribed below, and such definitions shall be strictly construed to enforce the intent of the Parties:

1. "Affiliate" means any legal entity that directly or indirectly controls, is controlled by, or is under common control with a Party, where "control" ownership of at least fifty percent (50%) of the voting securities or equity interest.
2. "Authorized Person" means any employee, contractor, agent, or representative of a Party who has been granted explicit, role-based access to Information Systems and whose duties necessitate the handling of Sensitive Data.
3. "Confidential Information" means all non-public information disclosed by one Party to the other, whether orally, visually, or in writing, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure.
4. "Cyber Security Incident" or "Incident" means any known, suspected, or imminent unauthorized access, acquisition, use, disclosure, alteration, disruption, or destruction of Information Systems, networks, or Sensitive Data, whether resulting from malicious cyber activity, human error, system failure, or physical breach.
5. "Data Protection Laws" means all applicable local, state, federal, national, and international privacy and data protection statutes, regulations, and directives (including, without limitation, the GDPR, CCPA, HIPAA, and any successor legislation) governing the collection, processing, storage, and transfer of Sensitive Data.
6. "Information Systems" means any electronic communications networks, computers, software, hardware, databases, cloud environments, or mobile devices owned, operated, leased, or utilized by or on behalf of a Party.
7. "Remediation Plan" means a comprehensive, written technical and operational strategy formulated to contain, eradicate, recover from, and prevent the recurrence of a Cyber Security Incident.
8. "Root Cause Analysis" means a systematic investigative process utilized to identify the fundamental, underlying systemic failures that permitted a Cyber Security Incident to occur.
9. "Sensitive Data" means any data or information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular natural person or proprietary business asset, including Personally Identifiable Information (PII), Protected Health Information (PHI), financial account numbers, trade secrets, and intellectual property.

---

3. SUBSTANTIVE TERMS & OBLIGATIONS

3.1 Mandatory Incident Notification Protocol

Upon the discovery, detection, or reasonable suspicion of a Cyber Security Incident affecting or potentially affecting the Information Systems, network perimeter, or Sensitive Data of the Disclosing Party, the Receiving Party shall adhere to the following strict timeline:

1. Initial Notice: The Receiving Party shall provide verbal and electronic written notification to the Disclosing Party’s designated Security Operations Center or legal counsel within [e.g., twenty-four (24)] hours of initial detection.
2. Formal Submission: The Receiving Party shall complete and submit this formal Cyber Security Incident Report Form Template within [e.g., forty-eight (48)] hours of initial detection.

3.2 Contents of the Incident Report

The formal report submitted pursuant to Section 3.1 must contain, at a minimum, the following verified particulars:

• Chronological timeline of the detection and escalation of the Incident.
• Precise technical vectors exploited (e.g., phishing, zero-day exploit, credential stuffing, insider threat).
• Specific Information Systems, servers, databases, or applications impacted.
• Categories and approximate volume of Sensitive Data exposed, accessed, or exfiltrated.
• Immediate containment measures deployed and status of network isolation.

3.3 Duty to Cooperate and Preserve Evidence

1. Evidence Preservation: The Receiving Party shall immediately take all commercially reasonable and technologically necessary steps to preserve, secure, and maintain forensic integrity of all digital evidence, including system logs, memory dumps, firewall configurations, packet captures, and affected hardware.
2. Cooperation: The Receiving Party shall grant the Disclosing Party, its external legal counsel, and its retained digital forensics investigators unhindered access to inspect affected Information Systems, conduct interviews with relevant personnel, and review forensic telemetry.

3.4 Performance Metrics & Representations

The Receiving Party represents, warrants, and covenants that:

• It maintains industry-standard cybersecurity frameworks (e.g., NIST CSF, ISO/IEC 27001) commensurate with the sensitivity of the data handled.
• All Information Systems utilized in connection with the Master Services Agreement are patched, monitored, and defended against known vulnerabilities.
• It possesses the legal authority, operational capability, and technical resources to fulfill all reporting and remediation mandates set forth herein.

---

4. DEFAULT, TERMINATION, AND REMEDIES

4.1 Classification of Breach

Any failure by the Receiving Party to timely report a Cyber Security Incident, willful suppression of incident telemetry, unauthorized modification or destruction of forensic evidence, or gross negligence in maintaining information security standards shall constitute a Material Breach of this Agreement and the underlying Master Services Agreement.

4.2 Notice and Cure Period

Upon the occurrence of a Material Breach under Section 4.1, the non-breaching Party shall provide written notice of default specifying the factual basis of the breach. The breaching Party shall have [e.g., thirty (30)] business days from the receipt of such notice to cure said breach to the reasonable satisfaction of the non-breaching Party; provided, however, that failures relating to data breaches or systemic security vulnerabilities that cannot be structurally cured within such timeframe may result in immediate termination without opportunity to cure at the sole discretion of the non-breaching Party.

4.3 Legal Recourse and Remedies

In the event of an uncured Material Breach or a catastrophic Cyber Security Incident resulting from the Receiving Party’s negligence or willful misconduct, the Disclosing Party reserves all legal and equitable remedies, including:

1. Immediate Termination: Unilateral termination of this Agreement and the Master Services Agreement, effective immediately upon written notice.
2. Injunctive Relief: Seeking temporary restraining orders, preliminary injunctions, or permanent injunctions in a court of competent jurisdiction to compel compliance, prevent further data exfiltration, or enforce evidence preservation.
3. Damages: Recovery of all direct, indirect, consequential, and punitive damages, including regulatory fines, third-party notification costs, credit monitoring expenses, forensic investigation fees, and reasonable attorney's fees.
4. Indemnification: The Receiving Party shall defend, indemnify, and hold harmless the Disclosing Party, its Affiliates, directors, officers, employees, and agents from and against any and all claims, liabilities, losses, damages, and expenses arising out of or related to the Receiving Party's Cyber Security Incident.

---

5. BOILERPLATE LEGAL PROVISIONS

5.1 Severability

If any provision of this Agreement is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such provision shall be modified to the minimum extent necessary to make it valid and enforceable, and the remaining provisions of this Agreement shall remain in full force and effect.

5.2 Entire Agreement

This Agreement, together with the Master Services Agreement and any incorporated schedules or exhibits, constitutes the entire understanding and agreement between the Parties with respect to the subject matter hereof and supersedes all prior or contemporaneous negotiations, representations, understandings, or agreements, whether written or oral.

5.3 Force Majeure

Neither Party shall be liable for any failure or delay in performance under this Agreement (excluding payment obligations and incident reporting mandates) to the extent such failure or delay is caused by acts of God, natural disasters, war, terrorism, civil unrest, or nationwide electrical grid failures beyond the reasonable control of the affected Party ("Force Majeure Event"); provided, however, that cyberattacks, malware infections, ransomware, or third-party IT failures shall not constitute a Force Majeure Event under any circumstances.

5.4 Governing Law

This Agreement, and all claims or causes of action (whether in contract, tort, or statute) that may be based upon, arise out of, or relate to this Agreement, shall be governed by, enforced under, and construed in accordance with the internal laws of the State of [Jurisdiction], without regard to its conflict of laws principles.

5.5 Dispute Resolution

Any dispute, controversy, or claim arising out of or relating to this Agreement, including its formation, breach, termination, or validity, shall be settled by binding arbitration administered by the [American Arbitration Association / designated arbitral body] in accordance with its Commercial Arbitration Rules. The place of arbitration shall be [City, State], and the proceedings shall be conducted in the English language before a single arbitrator. The award rendered by the arbitrator shall be final and binding, and judgment upon the award may be entered in any court having jurisdiction thereof.

---

6. FORMAL EXECUTION BLOCK

IN WITNESS WHEREOF, the Parties hereto have caused this Cyber Security Incident Report Form Template and Binding Agreement to be duly executed by their respective authorized officers as of the Effective Date written above.

DISCLOSING PARTY / COMPANY:

[Company Name]

By: _____________________________________________
Name: [Signatory Name]
Title: [Signatory Title]
Date: [Date]

---

RECEIVING PARTY / VENDOR:

[Counterparty Name]

By: _____________________________________________
Name: [Signatory Name]
Title: [Signatory Title]
Date: [Date]