Information Security Incident Report Template

INFORMATION SECURITY INCIDENT REPORTING AGREEMENT

THIS INFORMATION SECURITY INCIDENT REPORTING AGREEMENT (the "Agreement") is entered into as of [Date] (the "Effective Date") by and between [Company Name], a [Jurisdiction] corporation having its principal place of business at [Address] ("Disclosing Party"), and [Counterparty Name], a [Jurisdiction] corporation having its principal place of business at [Address] ("Receiving Party").

1. DOCUMENT PREAMBLE & RECITALS

WHEREAS, the Parties acknowledge that in the course of their business relationship, the Receiving Party may have access to, or encounter, Information Security Incidents involving the Disclosing Party’s Confidential Information; and WHEREAS, the Parties desire to establish a formal, legally binding framework for the mandatory reporting, assessment, and mitigation of such incidents to ensure compliance with applicable data protection laws and the maintenance of systemic integrity.

2. OPERATIONAL DEFINITIONS

1. "Confidential Information" means any non-public data, trade secrets, personal identifiable information (PII), or technical specifications owned or controlled by the Disclosing Party.
2. "Information Security Incident" means any unauthorized access, acquisition, disclosure, destruction, or alteration of the Disclosing Party’s systems or Confidential Information.
3. "Business Day" means any day other than a Saturday, Sunday, or a public holiday observed in [Jurisdiction].
4. "Remediation Costs" means all reasonable out-of-pocket expenses incurred by the Disclosing Party to investigate, contain, and resolve an Information Security Incident.
5. "Qualified Breach" means an Information Security Incident that involves the unauthorized access to sensitive financial, personal, or proprietary data that triggers a statutory notification requirement.

3. SUBSTANTIVE TERMS & OBLIGATIONS

1. Reporting Duty: Upon discovery of any Information Security Incident, the Receiving Party shall provide written notice to the Disclosing Party within twenty-four (24) hours.
2. Duty to Cooperate: The Receiving Party shall provide all necessary logs, forensic reports, and access to personnel reasonably required by the Disclosing Party to assess the scope of the incident.
3. Mitigation Obligations: The Receiving Party shall implement immediate containment measures, including the isolation of affected systems, to prevent further unauthorized access or data exfiltration.
4. Representations: The Receiving Party represents and warrants that it maintains administrative, physical, and technical safeguards designed to protect the integrity of the Disclosing Party’s data, meeting or exceeding industry standards (e.g., ISO/IEC 27001 or SOC2).
5. Performance Metrics: The Receiving Party must demonstrate a target Time-to-Acknowledge of four (4) hours upon discovery of any suspicious system activity.

4. DEFAULT, TERMINATION, AND REMEDIES

1. Material Breach: Failure by the Receiving Party to report an Information Security Incident within the specified timeframe shall constitute a material breach of this Agreement.
2. Cure Period: The breaching party shall have thirty (30) business days from the receipt of written notice to cure any non-monetary breach. Monetary breaches, including failure to reimburse Remediation Costs, must be cured within ten (10) business days.
3. Termination: The Disclosing Party may terminate the underlying commercial relationship immediately upon notice if the Receiving Party fails to cure a material breach within the notice period.
4. Liquidated Damages: In the event of a willful breach, the Receiving Party agrees to indemnify the Disclosing Party for losses, provided such liability shall not exceed [Dollar Amount], unless such breach results from gross negligence or willful misconduct.

5. BOILERPLATE LEGAL PROVISIONS

1. Severability: If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.
2. Entire Agreement: This Agreement constitutes the final, complete, and exclusive statement of the terms between the Parties regarding the subject matter hereof.
3. Force Majeure: Neither Party shall be liable for failure to perform duties due to causes beyond their reasonable control, provided that the affected Party provides prompt notice.
4. Governing Law: This Agreement shall be governed by and construed in accordance with the laws of [Jurisdiction], without regard to its conflict of laws principles.
5. Dispute Resolution: Any dispute arising out of this Agreement shall be settled by binding arbitration in [Jurisdiction] in accordance with the rules of the American Arbitration Association.

6. FORMAL EXECUTION BLOCK

IN WITNESS WHEREOF, the Parties have caused this Agreement to be executed by their duly authorized representatives as of the Effective Date.

[Disclosing Party Name]

Signature: __________________________ Name: _____________________________ Title: ______________________________ Date: ______________________________

[Receiving Party Name]

Signature: __________________________ Name: _____________________________ Title: ______________________________ Date: ______________________________